mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
3f7881a57b
While it seems interesting functionality, this hasn't been documented, maintained or knowingly leveraged for many years. There are various other approaches today, too: * We track the number of event handler invocations regardless of profiling. It's possible to approximate a load_sample event by comparing the result of two get_event_stats() calls. Or, visualize the corresponding counters in a Prometheus setup to get an idea of event/s broken down by event names. * HookCallFunction() allows to intercept script execution, including measuring the time execution takes. * The global call_stack and g_frame_stack can be used from plugins (and even external processes) to walk the Zeek script stack at certain points to implement a sampling profiler. * USDT probes or more plugin hooks will likely be preferred over Zeek builtin functionality in the future. Relates to #3458
12 lines
737 B
Text
12 lines
737 B
Text
# @TEST-EXEC: zeek -b -r $TRACES/smtp.trace policy/misc/dump-events %INPUT >all-events.log
|
|
# @TEST-EXEC: zeek -b -r $TRACES/smtp.trace policy/misc/dump-events %INPUT DumpEvents::include_args=F >all-events-no-args.log
|
|
# @TEST-EXEC: zeek -b -r $TRACES/smtp.trace policy/misc/dump-events %INPUT DumpEvents::include=/smtp_/ >smtp-events.log
|
|
# @TEST-EXEC: zeek -b -r $TRACES/smtp.trace policy/misc/dump-events %INPUT DumpEvents::dump_all_events=T | grep -v "CPU: interval\|path: string" > really-all-events.log
|
|
#
|
|
# @TEST-EXEC: btest-diff all-events.log
|
|
# @TEST-EXEC: btest-diff all-events-no-args.log
|
|
# @TEST-EXEC: btest-diff smtp-events.log
|
|
# @TEST-EXEC: btest-diff really-all-events.log
|
|
|
|
@load base/protocols/conn
|
|
@load base/protocols/smtp
|