mirror of https://github.com/OISF/suricata
detect/prefilter: redo profiling
Victor Julien
8 years ago
parent
31648913e6
commit
cf2feeecf4
@ -0,0 +1,311 @@
|
||||
/* Copyright (C) 2007-2017 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Endace Technology Limited.
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*
|
||||
* An API for rule profiling operations.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
#include "conf.h"
|
||||
|
||||
#include "tm-threads.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-byte.h"
|
||||
#include "util-profiling.h"
|
||||
#include "util-profiling-locks.h"
|
||||
|
||||
#ifdef PROFILING
|
||||
|
||||
extern uint32_t g_prefilter_id;
|
||||
extern HashListTable *g_prefilter_hash_table;
|
||||
|
||||
typedef struct SCProfilePrefilterData_ {
|
||||
uint64_t called;
|
||||
uint64_t total;
|
||||
uint64_t max;
|
||||
const char *name;
|
||||
} SCProfilePrefilterData;
|
||||
|
||||
typedef struct SCProfilePrefilterDetectCtx_ {
|
||||
uint32_t id;
|
||||
uint32_t size; /**< size in elements */
|
||||
SCProfilePrefilterData *data;
|
||||
pthread_mutex_t data_m;
|
||||
} SCProfilePrefilterDetectCtx;
|
||||
|
||||
static int profiling_prefilter_output_to_file = 0;
|
||||
int profiling_prefilter_enabled = 0;
|
||||
__thread int profiling_prefilter_entered = 0;
|
||||
static char profiling_file_name[PATH_MAX];
|
||||
static const char *profiling_file_mode = "a";
|
||||
|
||||
void SCProfilingPrefilterGlobalInit(void)
|
||||
{
|
||||
ConfNode *conf;
|
||||
|
||||
conf = ConfGetNode("profiling.prefilter");
|
||||
if (conf != NULL) {
|
||||
if (ConfNodeChildValueIsTrue(conf, "enabled")) {
|
||||
profiling_prefilter_enabled = 1;
|
||||
const char *filename = ConfNodeLookupChildValue(conf, "filename");
|
||||
if (filename != NULL) {
|
||||
const char *log_dir;
|
||||
log_dir = ConfigGetLogDirectory();
|
||||
|
||||
snprintf(profiling_file_name, sizeof(profiling_file_name), "%s/%s",
|
||||
log_dir, filename);
|
||||
|
||||
const char *v = ConfNodeLookupChildValue(conf, "append");
|
||||
if (v == NULL || ConfValIsTrue(v)) {
|
||||
profiling_file_mode = "a";
|
||||
} else {
|
||||
profiling_file_mode = "w";
|
||||
}
|
||||
|
||||
profiling_prefilter_output_to_file = 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static void DoDump(SCProfilePrefilterDetectCtx *rules_ctx, FILE *fp, const char *name)
|
||||
{
|
||||
int i;
|
||||
fprintf(fp, " ----------------------------------------------"
|
||||
"------------------------------------------------------"
|
||||
"----------------------------\n");
|
||||
fprintf(fp, " Stats for: %s\n", name);
|
||||
fprintf(fp, " ----------------------------------------------"
|
||||
"------------------------------------------------------"
|
||||
"----------------------------\n");
|
||||
fprintf(fp, " %-32s %-15s %-15s %-15s %-15s\n", "Prefilter", "Ticks", "Called", "Max Ticks", "Avg");
|
||||
fprintf(fp, " -------------------------------- "
|
||||
"--------------- "
|
||||
"--------------- "
|
||||
"--------------- "
|
||||
"--------------- "
|
||||
"\n");
|
||||
for (i = 0; i < (int)rules_ctx->size; i++) {
|
||||
SCProfilePrefilterData *d = &rules_ctx->data[i];
|
||||
if (d == NULL || d->called== 0)
|
||||
continue;
|
||||
|
||||
uint64_t ticks = d->total;
|
||||
double avgticks = 0;
|
||||
if (ticks && d->called) {
|
||||
avgticks = (ticks / d->called);
|
||||
}
|
||||
|
||||
fprintf(fp,
|
||||
" %-32s %-15"PRIu64" %-15"PRIu64" %-15"PRIu64" %-15.2f\n",
|
||||
d->name,
|
||||
ticks,
|
||||
d->called,
|
||||
d->max,
|
||||
avgticks);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
SCProfilingPrefilterDump(DetectEngineCtx *de_ctx)
|
||||
{
|
||||
FILE *fp;
|
||||
struct timeval tval;
|
||||
struct tm *tms;
|
||||
struct tm local_tm;
|
||||
|
||||
if (profiling_prefilter_enabled == 0 || de_ctx->profile_prefilter_ctx == NULL)
|
||||
return;
|
||||
|
||||
gettimeofday(&tval, NULL);
|
||||
tms = SCLocalTime(tval.tv_sec, &local_tm);
|
||||
|
||||
if (profiling_prefilter_output_to_file == 1) {
|
||||
SCLogDebug("file %s mode %s", profiling_file_name, profiling_file_mode);
|
||||
|
||||
fp = fopen(profiling_file_name, profiling_file_mode);
|
||||
|
||||
if (fp == NULL) {
|
||||
SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_file_name,
|
||||
strerror(errno));
|
||||
return;
|
||||
}
|
||||
} else {
|
||||
fp = stdout;
|
||||
}
|
||||
|
||||
fprintf(fp, " ----------------------------------------------"
|
||||
"------------------------------------------------------"
|
||||
"----------------------------\n");
|
||||
fprintf(fp, " Date: %" PRId32 "/%" PRId32 "/%04d -- "
|
||||
"%02d:%02d:%02d\n", tms->tm_mon + 1, tms->tm_mday, tms->tm_year + 1900,
|
||||
tms->tm_hour,tms->tm_min, tms->tm_sec);
|
||||
|
||||
/* global stats first */
|
||||
DoDump(de_ctx->profile_prefilter_ctx, fp, "total");
|
||||
|
||||
fprintf(fp,"\n");
|
||||
if (fp != stdout)
|
||||
fclose(fp);
|
||||
|
||||
SCLogPerf("Done dumping prefilter profiling data.");
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Update a rule counter.
|
||||
*
|
||||
* \param id The ID of this counter.
|
||||
* \param ticks Number of CPU ticks for this rule.
|
||||
* \param match Did the rule match?
|
||||
*/
|
||||
void
|
||||
SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks)
|
||||
{
|
||||
if (det_ctx != NULL && det_ctx->prefilter_perf_data != NULL &&
|
||||
id < (int)g_prefilter_id)
|
||||
{
|
||||
SCProfilePrefilterData *p = &det_ctx->prefilter_perf_data[id];
|
||||
|
||||
p->called++;
|
||||
if (ticks > p->max)
|
||||
p->max = ticks;
|
||||
p->total += ticks;
|
||||
}
|
||||
}
|
||||
|
||||
static SCProfilePrefilterDetectCtx *SCProfilingPrefilterInitCtx(void)
|
||||
{
|
||||
SCProfilePrefilterDetectCtx *ctx = SCMalloc(sizeof(SCProfilePrefilterDetectCtx));
|
||||
if (ctx != NULL) {
|
||||
memset(ctx, 0x00, sizeof(SCProfilePrefilterDetectCtx));
|
||||
|
||||
if (pthread_mutex_init(&ctx->data_m, NULL) != 0) {
|
||||
SCLogError(SC_ERR_MUTEX,
|
||||
"Failed to initialize hash table mutex.");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
return ctx;
|
||||
}
|
||||
|
||||
static void DetroyCtx(SCProfilePrefilterDetectCtx *ctx)
|
||||
{
|
||||
if (ctx) {
|
||||
if (ctx->data != NULL)
|
||||
SCFree(ctx->data);
|
||||
pthread_mutex_destroy(&ctx->data_m);
|
||||
SCFree(ctx);
|
||||
}
|
||||
}
|
||||
|
||||
void SCProfilingPrefilterDestroyCtx(DetectEngineCtx *de_ctx)
|
||||
{
|
||||
if (de_ctx != NULL) {
|
||||
SCProfilingPrefilterDump(de_ctx);
|
||||
|
||||
DetroyCtx(de_ctx->profile_prefilter_ctx);
|
||||
}
|
||||
}
|
||||
|
||||
void SCProfilingPrefilterThreadSetup(SCProfilePrefilterDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
|
||||
{
|
||||
if (ctx == NULL)
|
||||
return;
|
||||
|
||||
const uint32_t size = g_prefilter_id;
|
||||
|
||||
SCProfilePrefilterData *a = SCMalloc(sizeof(SCProfilePrefilterData) * size);
|
||||
if (a != NULL) {
|
||||
memset(a, 0x00, sizeof(SCProfilePrefilterData) * size);
|
||||
det_ctx->prefilter_perf_data = a;
|
||||
}
|
||||
}
|
||||
|
||||
static void SCProfilingPrefilterThreadMerge(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
|
||||
{
|
||||
if (de_ctx == NULL || de_ctx->profile_prefilter_ctx == NULL ||
|
||||
de_ctx->profile_prefilter_ctx->data == NULL || det_ctx == NULL ||
|
||||
det_ctx->prefilter_perf_data == NULL)
|
||||
return;
|
||||
|
||||
for (uint32_t i = 0; i < g_prefilter_id; i++) {
|
||||
de_ctx->profile_prefilter_ctx->data[i].called += det_ctx->prefilter_perf_data[i].called;
|
||||
de_ctx->profile_prefilter_ctx->data[i].total += det_ctx->prefilter_perf_data[i].total;
|
||||
if (det_ctx->prefilter_perf_data[i].max > de_ctx->profile_prefilter_ctx->data[i].max)
|
||||
de_ctx->profile_prefilter_ctx->data[i].max = det_ctx->prefilter_perf_data[i].max;
|
||||
}
|
||||
}
|
||||
|
||||
void SCProfilingPrefilterThreadCleanup(DetectEngineThreadCtx *det_ctx)
|
||||
{
|
||||
if (det_ctx == NULL || det_ctx->de_ctx == NULL || det_ctx->prefilter_perf_data == NULL)
|
||||
return;
|
||||
|
||||
pthread_mutex_lock(&det_ctx->de_ctx->profile_prefilter_ctx->data_m);
|
||||
SCProfilingPrefilterThreadMerge(det_ctx->de_ctx, det_ctx);
|
||||
pthread_mutex_unlock(&det_ctx->de_ctx->profile_prefilter_ctx->data_m);
|
||||
|
||||
SCFree(det_ctx->prefilter_perf_data);
|
||||
det_ctx->prefilter_perf_data = NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Register the prefilter profiling counters.
|
||||
*
|
||||
* \param de_ctx The active DetectEngineCtx, used to get at the loaded rules.
|
||||
*/
|
||||
void
|
||||
SCProfilingPrefilterInitCounters(DetectEngineCtx *de_ctx)
|
||||
{
|
||||
if (profiling_prefilter_enabled == 0)
|
||||
return;
|
||||
|
||||
const uint32_t size = g_prefilter_id;
|
||||
if (g_prefilter_id == 0)
|
||||
return;
|
||||
|
||||
de_ctx->profile_prefilter_ctx = SCProfilingPrefilterInitCtx();
|
||||
BUG_ON(de_ctx->profile_prefilter_ctx == NULL);
|
||||
de_ctx->profile_prefilter_ctx->size = size;
|
||||
|
||||
de_ctx->profile_prefilter_ctx->data = SCMalloc(sizeof(SCProfilePrefilterData) * size);
|
||||
BUG_ON(de_ctx->profile_prefilter_ctx->data == NULL);
|
||||
memset(de_ctx->profile_prefilter_ctx->data, 0x00, sizeof(SCProfilePrefilterData) * size);
|
||||
|
||||
HashListTableBucket *hb = HashListTableGetListHead(g_prefilter_hash_table);
|
||||
for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
|
||||
PrefilterStore *ctx = HashListTableGetListData(hb);
|
||||
de_ctx->profile_prefilter_ctx->data[ctx->id].name = ctx->name;
|
||||
SCLogNotice("prefilter %s set up", de_ctx->profile_prefilter_ctx->data[ctx->id].name);
|
||||
}
|
||||
SCLogNotice("size alloc'd %u", (uint32_t)size * (uint32_t)sizeof(SCProfilePrefilterData));
|
||||
|
||||
SCLogPerf("Registered %"PRIu32" prefilter profiling counters.", size);
|
||||
}
|
||||
|
||||
#endif /* PROFILING */
|
||||
Loading…
Reference in New Issue