mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
bec965b66f
- On-demand access to sumstats results through "return from" functions named SumStats::request and Sumstats::request_key. Both functions are tested in standalone and clustered modes. - $name field has returned to SumStats which simplifies cluster code and makes the on-demand access stuff possible. - Clustered results can only be collected for 1 minute from their time of creation now instead of time of last read. - Thresholds use doubles instead of counts everywhere now. - Calculation dependency resolution occurs at start up time now instead of doing it at observation time which provide a minor cpu performance improvement. A new plugin registration mechanism was created to support this change. - AppStats now has a minimal doc string and is broken into hook-based plugins. - AppStats and traceroute detection added to local.bro
54 lines
1.3 KiB
Text
54 lines
1.3 KiB
Text
@load base/utils/queue
|
|
@load ../main
|
|
|
|
module SumStats;
|
|
|
|
export {
|
|
redef enum Calculation += {
|
|
## Collect a sample of the last few observations.
|
|
SAMPLE
|
|
};
|
|
|
|
redef record Reducer += {
|
|
## A number of sample Observations to collect.
|
|
samples: count &default=0;
|
|
};
|
|
|
|
redef record ResultVal += {
|
|
## This is the queue where samples are maintained. Use the
|
|
## :bro:see:`SumStats::get_samples` function to get a vector of the samples.
|
|
samples: Queue::Queue &optional;
|
|
};
|
|
|
|
## Get a vector of sample Observation values from a ResultVal.
|
|
global get_samples: function(rv: ResultVal): vector of Observation;
|
|
}
|
|
|
|
function get_samples(rv: ResultVal): vector of Observation
|
|
{
|
|
local s: vector of Observation = vector();
|
|
if ( rv?$samples )
|
|
Queue::get_vector(rv$samples, s);
|
|
return s;
|
|
}
|
|
|
|
hook register_observe_plugins()
|
|
{
|
|
register_observe_plugin(SAMPLE, function(r: Reducer, val: double, obs: Observation, rv: ResultVal)
|
|
{
|
|
if ( ! rv?$samples )
|
|
rv$samples = Queue::init([$max_len=r$samples]);
|
|
Queue::put(rv$samples, obs);
|
|
});
|
|
}
|
|
|
|
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
|
|
{
|
|
# Merge $samples
|
|
if ( rv1?$samples && rv2?$samples )
|
|
result$samples = Queue::merge(rv1$samples, rv2$samples);
|
|
else if ( rv1?$samples )
|
|
result$samples = rv1$samples;
|
|
else if ( rv2?$samples )
|
|
result$samples = rv2$samples;
|
|
}
|