mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 08:38:20 +00:00
80 lines
2.6 KiB
Text
80 lines
2.6 KiB
Text
# $Id: stats.bro 4011 2007-02-28 07:01:12Z vern $
|
|
|
|
# Track memory/lag statistics. Differs from profiling.bro in that this
|
|
# is lighter-weight (much less info, and less load to generate).
|
|
|
|
@load notice
|
|
|
|
redef enum Notice += {
|
|
ResourceStats, # generated when running live packet capture
|
|
OfflineResourceStats, # generated when reading trace files
|
|
};
|
|
|
|
# ResourceStats should by default be sent to the notice file
|
|
redef notice_action_filters += {
|
|
[[ResourceStats, OfflineResourceStats]] = file_notice
|
|
};
|
|
|
|
# Interval in which the results are sent as a notice. If this is less
|
|
# than heartbeat_interval, then it is set to heartbeat_interval, since
|
|
# some of the reported statistics are only gathered via the heartbeat.
|
|
global stats_report_interval = 10 sec &redef;
|
|
|
|
event check_stats(last_time: time, last_ns: NetStats, last_res: bro_resources)
|
|
{
|
|
local now = current_time();
|
|
local lag = now - network_time();
|
|
local report_delta = now - last_time;
|
|
|
|
local res = resource_usage();
|
|
local ns = net_stats();
|
|
|
|
local total_CPU_time = res$user_time + res$system_time;
|
|
local last_CPU_time = last_res$user_time + last_res$system_time;
|
|
local CPU_util = ((total_CPU_time - last_CPU_time) / report_delta) * 100.0;
|
|
|
|
local pkts_recvd = ns$pkts_recvd - last_ns$pkts_recvd;
|
|
local pkts_dropped = ns$pkts_dropped - last_ns$pkts_dropped;
|
|
local pkts_link = ns$pkts_link - last_ns$pkts_link;
|
|
|
|
if ( bro_is_terminating() )
|
|
# No more stats will be written or scheduled when Bro is
|
|
# shutting down.
|
|
return;
|
|
|
|
local delta_pkts_processed = res$num_packets - last_res$num_packets;
|
|
local delta_events = res$num_events_dispatched - last_res$num_events_dispatched;
|
|
local delta_queued = res$num_events_queued - last_res$num_events_queued;
|
|
|
|
local stat_msg =
|
|
fmt("mem=%dMB pkts_proc=%d events_proc=%d events_queued=%d",
|
|
res$mem / 1000000, delta_pkts_processed,
|
|
delta_events, delta_queued);
|
|
|
|
if ( reading_live_traffic() )
|
|
{
|
|
stat_msg = fmt("%s et=%.2f lag=%fsec util=%.01f%% pkts_rcv=%d pkts_drp=%d pkts_link=%d",
|
|
stat_msg, report_delta, lag, CPU_util,
|
|
pkts_recvd, pkts_dropped, pkts_link);
|
|
NOTICE([$note=ResourceStats, $msg=stat_msg]);
|
|
}
|
|
|
|
else if ( reading_traces() )
|
|
NOTICE([$note=OfflineResourceStats, $msg=stat_msg]);
|
|
|
|
else
|
|
{
|
|
# Remote communication only.
|
|
stat_msg = fmt("mem=%dMB events_proc=%d events_queued=%d lag=%fsec util=%.01f%%",
|
|
res$mem / 1000000, delta_events, delta_queued,
|
|
lag, CPU_util);
|
|
NOTICE([$note=ResourceStats, $msg=stat_msg]);
|
|
}
|
|
|
|
schedule stats_report_interval { check_stats(now, ns, res) };
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
schedule stats_report_interval { check_stats(current_time(), net_stats(), resource_usage()) };
|
|
}
|