mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
bec965b66f
- On-demand access to sumstats results through "return from" functions named SumStats::request and Sumstats::request_key. Both functions are tested in standalone and clustered modes. - $name field has returned to SumStats which simplifies cluster code and makes the on-demand access stuff possible. - Clustered results can only be collected for 1 minute from their time of creation now instead of time of last read. - Thresholds use doubles instead of counts everywhere now. - Calculation dependency resolution occurs at start up time now instead of doing it at observation time which provide a minor cpu performance improvement. A new plugin registration mechanism was created to support this change. - AppStats now has a minimal doc string and is broken into hook-based plugins. - AppStats and traceroute detection added to local.bro
45 lines
1.1 KiB
Text
45 lines
1.1 KiB
Text
# @TEST-EXEC: bro %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
redef exit_only_after_terminate=T;
|
|
|
|
|
|
event on_demand()
|
|
{
|
|
when ( local results = SumStats::request("test") )
|
|
{
|
|
print "Complete SumStat request";
|
|
for ( key in results )
|
|
{
|
|
print fmt(" Host: %s -> %.0f", key$host, results[key]["test.reducer"]$sum);
|
|
}
|
|
}
|
|
}
|
|
|
|
event on_demand_key()
|
|
{
|
|
local host = 1.2.3.4;
|
|
when ( local result = SumStats::request_key("test", [$host=host]) )
|
|
{
|
|
print fmt("Key request for %s", host);
|
|
print fmt(" Host: %s -> %.0f", host, result["test.reducer"]$sum);
|
|
terminate();
|
|
}
|
|
}
|
|
|
|
event bro_init() &priority=5
|
|
{
|
|
local r1: SumStats::Reducer = [$stream="test.reducer",
|
|
$apply=set(SumStats::SUM)];
|
|
SumStats::create([$name="test",
|
|
$epoch=1hr,
|
|
$reducers=set(r1)]);
|
|
|
|
# Seed some data but notice there are no callbacks defined in the sumstat!
|
|
SumStats::observe("test.reducer", [$host=1.2.3.4], [$num=42]);
|
|
SumStats::observe("test.reducer", [$host=4.3.2.1], [$num=7]);
|
|
|
|
schedule 0.1 secs { on_demand() };
|
|
schedule 1 secs { on_demand_key() };
|
|
}
|
|
|