zeek/scripts/base/frameworks
Christian Kreibich 90ecf7ff0d Add backpressure disconnect notification to cluster.log and via telemetry
This adds a Broker-specific script to the cluster framework, loaded only when
Zeek is running in cluster mode. It adds logging in cluster.log as well as
telemetry via a metrics counter for Broker-observed backpressure disconnects.

The new zeek_broker_backpressure_disconnects counter, labeled by the neighboring
peer that the reporting node has determined to be unresponsive, counts the
number of unpeerings for this reason.

Here the node "worker" has observed node "proxy" falling behind once:

# HELP zeek_broker_backpressure_disconnects_total Number of Broker peering drops due to a neighbor falling too far behind in message I/O
# TYPE zeek_broker_backpressure_disconnects_total counter
zeek_broker_backpressure_disconnects_total{endpoint="worker",peer="proxy"} 1

Includes small btest baseline update to reflect @load of a new script.

(cherry picked from commit ead6134501)
2025-04-08 15:09:44 -07:00
..
analyzer Add logging of disabled analyzers to analyzer.log 2024-07-09 18:22:43 +02:00
broker Support re-peering with Broker peers that fall behind 2025-04-08 15:09:44 -07:00
cluster Add backpressure disconnect notification to cluster.log and via telemetry 2025-04-08 15:09:44 -07:00
config Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
control annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
files Fix cid propagation into files.log 2024-04-29 14:13:19 +01:00
input More bro-to-zeek renaming in scripts and other files 2019-05-16 02:36:41 -05:00
intel Fix markup typo in the Intel::seen_policy hook docstring [skip ci] 2024-02-02 12:30:39 -08:00
logging logging: Do not keep delay state persistent 2023-11-29 11:53:11 +01:00
netcontrol Netcontrol: add rule_added_policy 2024-02-05 18:52:27 +00:00
notice http: Prevent request/response de-synchronization and unbounded state growth 2023-08-28 15:02:58 +02:00
openflow Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
packet-filter Add PacketFilter::remove_exclude function 2024-04-17 21:25:35 +00:00
reporter Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
signatures allow signature actions to be dynamically updated 2023-07-13 17:25:32 -07:00
software frameworks/software: Fix stale value used for stripping 2023-11-17 14:37:28 +01:00
spicy Merge remote-tracking branch 'origin/topic/robin/gh-3881-spicy-ports' 2024-08-30 13:26:16 -07:00
sumstats Remove script functions marked as unused (6.1 deprecations) 2023-06-14 10:07:22 -07:00
supervisor Management framework: add metrics port in management & Supervisor node records 2024-07-08 23:05:24 -07:00
telemetry Telemetry framework: move BIFs to the primary-bif stage 2025-04-08 14:50:45 -07:00
tunnels Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00