stats: Do not expand dots of tm_name #10316
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When an interface with dots is used, per worker stats are nested by the
dot-separated-components of the interface due to the usage of
OutputStats2Json().
Prevent this by using OutputStats2Json() on a per-thread specific object
and setting this object into the threads object using the
json_object_set_new() which won't do the dot expansion.
This was tested by creating an interface with dots in the name
and checking the stats.
ip link add name a.b.c type dummy
With Suricata 7.0.2, sniffing on the a.b.c interface results in the
following worker stats format:
"threads": {
"W#01-a": {
"b": {
"c": {
"capture": {
"kernel_packets": 0,
After this fix, the output looks as follows:
"threads": {
"W#01-a.b.c": {
"capture": {
"kernel_packets": 0,
Ticket: OISF#6732
awelzel
commented
Feb 5, 2024
src/output-json-stats.c
Outdated
| /* for each counter */ | ||
| for (u = offset; u < (offset + st->nstats); u++) { | ||
| if (st->tstats[u].name == NULL) | ||
| continue; | ||
|
|
||
| // Seems this holds, but assert in debug builds. | ||
| assert(strcmp(st->tstats[u].tm_name, st->tstats[u].tm_name) == 0); |
There was a problem hiding this comment.
Ewh, this was meant to be - let me know whether to open v2 with that and any more suggestions or it can be fixed during the merge. Thanks.
Suggested change
| assert(strcmp(st->tstats[u].tm_name, st->tstats[u].tm_name) == 0); | |
| assert(strcmp(st->tstats[offset].tm_name, st->tstats[u].tm_name) == 0); |
Use DEBUG_VALIDATE_BUG_ON instead of plain assert()
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #10316 +/- ##
===========================================
+ Coverage 73.31% 82.34% +9.02%
===========================================
Files 895 978 +83
Lines 148215 272035 +123820
===========================================
+ Hits 108666 224010 +115344
- Misses 39549 48025 +8476
Flags with carried forward coverage won't be shown. Click here to find out more. |
3 tasks
|
Replaced by #10338 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Make sure these boxes are signed before submitting your Pull Request -- thank you.
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Link to redmine 6732 ticket:
Describe changes:
When an interface with dots is used, per worker stats are nested by the dot-separated-components of the interface due to the usage of OutputStats2Json().
Prevent this by using OutputStats2Json() on a per-thread specific object and setting this object into the threads object using the json_object_set_new() which won't do the dot expansion.
This was tested by creating an interface with dots in the name and checking the stats.
With Suricata 7.0.2, sniffing on the a.b.c interface results in the following worker stats format:
After this fix, the output looks as follows:
Provide values to any of the below to override the defaults.
To use a pull request use a branch name like
pr/NwhereNis thepull request number.
Alternatively,
SV_BRANCHmay also be a link to anOISF/suricata-verify pull-request.