zeek/scripts/base/frameworks/cluster
Christian Kreibich ead6134501 Add backpressure disconnect notification to cluster.log and via telemetry
This adds a Broker-specific script to the cluster framework, loaded only when
Zeek is running in cluster mode. It adds logging in cluster.log as well as
telemetry via a metrics counter for Broker-observed backpressure disconnects.

The new zeek_broker_backpressure_disconnects counter, labeled by the neighboring
peer that the reporting node has determined to be unresponsive, counts the
number of unpeerings for this reason.

Here the node "worker" has observed node "proxy" falling behind once:

# HELP zeek_broker_backpressure_disconnects_total Number of Broker peering drops due to a neighbor falling too far behind in message I/O
# TYPE zeek_broker_backpressure_disconnects_total counter
zeek_broker_backpressure_disconnects_total{endpoint="worker",peer="proxy"} 1

Includes small btest baseline update to reflect @load of a new script.
2024-12-06 15:18:05 -08:00
..
nodes all: Fix typos identified by typos pre-commit hook 2023-06-13 17:57:32 +02:00
__load__.zeek Add backpressure disconnect notification to cluster.log and via telemetry 2024-12-06 15:18:05 -08:00
broker-backpressure.zeek Add backpressure disconnect notification to cluster.log and via telemetry 2024-12-06 15:18:05 -08:00
broker-stores.zeek Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
main.zeek Add Cluster::nodeid_to_node() helper function 2024-12-06 15:18:05 -08:00
pools.zeek Do not default PoolSpec topics to the empty string. 2024-02-05 18:03:08 -08:00
README More bro-to-zeek renaming in scripts and other files 2019-05-16 02:36:41 -05:00
setup-connections.zeek cluster/setup-connections: Switch to Cluster::subscribe(), short-circuit broker 2024-11-26 12:58:23 +01:00
supervisor.zeek Remove deprecated Cluster::Node::interface field 2024-08-07 11:58:22 -07:00

The cluster framework provides for establishing and controlling a cluster
of Zeek instances.