aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

schema: add descriptions for flow stats counters

Browse Source 
Task #7794
pull/13767/head
Juliana Fajardini 3 months ago committed by Victor Julien
parent fc6b96fb85
commit 1d27e268d1
2 changed files with 59 additions and 26 deletions
Show Stats Download Patch File Download Diff File

81
etc/schema.json
Unescape Escape View File

@ -6656,6 +6656,7 @@
}, },
"flow": { "flow": {
"type": "object", "type": "object",
"description": "Stats on flow-related diagnostics",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"active": { "active": {
@ -6683,61 +6684,78 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"capture_bypassed": { "capture_bypassed": {
"type": "integer" "type": "integer",
"description": "Number of flows bypassed at the capture level -- counted at the time of flow end"
}, },
"closed": { "closed": {
"type": "integer" "type": "integer",
"description": "Number of flows in 'closed' state at the time of flow end"
}, },
"established": { "established": {
"type": "integer" "type": "integer",
"description": "Number of flows in 'established' state at the time of flow end"
}, },
"local_bypassed": { "local_bypassed": {
"type": "integer" "type": "integer",
"description": "Number of flows bypassed internally -- counted at the time of flow end"
}, },
"new": { "new": {
"type": "integer" "type": "integer",
"description": "Number of flows in 'new' state at the time of flow end"
} }
} }
}, },
"tcp_liberal": { "tcp_liberal": {
"type": "integer" "type": "integer",
"description": "Number of TCP flows ended that had liberal state"
}, },
"tcp_state": { "tcp_state": {
"type": "object", "type": "object",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"close_wait": { "close_wait": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in CLOSE_WAIT state"
}, },
"closed": { "closed": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in CLOSED state"
}, },
"closing": { "closing": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in CLOSING state"
}, },
"established": { "established": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in ESTABLISHED state"
}, },
"fin_wait1": { "fin_wait1": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in FIN_WAIT_1 state"
}, },
"fin_wait2": { "fin_wait2": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in FIN_WAIT_2 state"
}, },
"last_ack": { "last_ack": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in LAST_ACK state"
}, },
"none": { "none": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions newly created"
}, },
"syn_recv": { "syn_recv": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in SYN_RECV state"
}, },
"syn_sent": { "syn_sent": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in SYN_SENT state"
}, },
"time_wait": { "time_wait": {
"type": "integer" "type": "integer",
"description": "Number of TCP sessions in TIME_WAIT state"
} }
} }
} }
@ -6786,6 +6804,7 @@
}, },
"mgr": { "mgr": {
"type": "object", "type": "object",
"description": "Flow manager stats counters",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"flows_checked": { "flows_checked": {
@ -6867,34 +6886,44 @@
}, },
"wrk": { "wrk": {
"type": "object", "type": "object",
"description": "Flow worker threads stats",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"flows_evicted": { "flows_evicted": {
"type": "integer" "type": "integer",
"description": "Number of flows that were evicted"
}, },
"flows_evicted_needs_work": { "flows_evicted_needs_work": {
"type": "integer" "type": "integer",
"description": "Number of TCP flows that were returned to the workers in case reassembly, detection, logging still needs work"
}, },
"flows_evicted_pkt_inject": { "flows_evicted_pkt_inject": {
"type": "integer" "type": "integer",
"description": "Number of pseudo packets injected into worker threads to complete flows' processing. For any flow this can be between 0-2, this is the total for all flows."
}, },
"flows_injected": { "flows_injected": {
"type": "integer" "type": "integer",
"description": "Number of flows injected into the worker thread from another thread"
}, },
"flows_injected_max": { "flows_injected_max": {
"type": "integer" "type": "integer",
"description": "Maximum number of flows injected into the worker thread from another thread"
}, },
"spare_sync": { "spare_sync": {
"type": "integer" "type": "integer",
"description": "Number of times the engine attempted to fetch flows from the master flow pool/spare queue"
}, },
"spare_sync_avg": { "spare_sync_avg": {
"type": "integer" "type": "integer",
"description": "Average number of flows a thread could fetch from the master flow pool/spare queue"
}, },
"spare_sync_empty": { "spare_sync_empty": {
"type": "integer" "type": "integer",
"description": "Number of times the master spare pool was empty when requesting flows from it"
}, },
"spare_sync_incomplete": { "spare_sync_incomplete": {
"type": "integer" "type": "integer",
"description": "Number of times spare flow syncs were incomplete (fetched with less than 100 flows in sync)"
} }
} }
} }

4
src/flow-hash.c
Unescape Escape View File

@ -641,6 +641,10 @@ static inline Flow *FlowSpareSync(ThreadVars *tv, FlowLookupStruct *fls,
if (f != NULL) { if (f != NULL) {
StatsAddUI64(tv, fls->dtv->counter_flow_spare_sync_avg, fls->spare_queue.len+1); StatsAddUI64(tv, fls->dtv->counter_flow_spare_sync_avg, fls->spare_queue.len+1);
if (fls->spare_queue.len < 99) { if (fls->spare_queue.len < 99) {
/* When a new flow pool is fetched it has 100 flows in sync,
* so there should be 99 left if we're in full sync.
* If len is below 99, means the spare sync is incomplete */
/* Track these instances */
StatsIncr(tv, fls->dtv->counter_flow_spare_sync_incomplete); StatsIncr(tv, fls->dtv->counter_flow_spare_sync_incomplete);
} }
} else if (fls->spare_queue.len == 0) { } else if (fls->spare_queue.len == 0) {

Write Preview
Loading…
Cancel
Save