mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
bec965b66f
- On-demand access to sumstats results through "return from" functions named SumStats::request and Sumstats::request_key. Both functions are tested in standalone and clustered modes. - $name field has returned to SumStats which simplifies cluster code and makes the on-demand access stuff possible. - Clustered results can only be collected for 1 minute from their time of creation now instead of time of last read. - Thresholds use doubles instead of counts everywhere now. - Calculation dependency resolution occurs at start up time now instead of doing it at observation time which provide a minor cpu performance improvement. A new plugin registration mechanism was created to support this change. - AppStats now has a minimal doc string and is broken into hook-based plugins. - AppStats and traceroute detection added to local.bro
47 lines
No EOL
968 B
Text
47 lines
No EOL
968 B
Text
@load ./main
|
|
|
|
module SumStats;
|
|
|
|
event SumStats::finish_epoch(ss: SumStat)
|
|
{
|
|
if ( ss$name in result_store )
|
|
{
|
|
local data = result_store[ss$name];
|
|
if ( ss?$epoch_finished )
|
|
ss$epoch_finished(data);
|
|
|
|
reset(ss);
|
|
}
|
|
|
|
schedule ss$epoch { SumStats::finish_epoch(ss) };
|
|
}
|
|
|
|
function data_added(ss: SumStat, key: Key, result: Result)
|
|
{
|
|
if ( check_thresholds(ss, key, result, 1.0) )
|
|
threshold_crossed(ss, key, result);
|
|
}
|
|
|
|
function request(ss_name: string): ResultTable
|
|
{
|
|
# This only needs to be implemented this way for cluster compatibility.
|
|
return when ( T )
|
|
{
|
|
if ( ss_name in result_store )
|
|
return result_store[ss_name];
|
|
else
|
|
return table();
|
|
}
|
|
}
|
|
|
|
function request_key(ss_name: string, key: Key): Result
|
|
{
|
|
# This only needs to be implemented this way for cluster compatibility.
|
|
return when ( T )
|
|
{
|
|
if ( ss_name in result_store && key in result_store[ss_name] )
|
|
return result_store[ss_name][key];
|
|
else
|
|
return table();
|
|
}
|
|
} |