Writing a NoDrop Chisel, a Tutorial

This guide explains how to write your own NoDrop Chisel.

Chisels are Lua scripts that process system events captured by NoDrop. They allow users to implement custom monitoring logic such as:

• extracting system call arguments
• filtering events
• generating logs
• forwarding events to external systems

A Chisel runs inside the NoDrop monitor and receives events as they occur.

Basic Structure

A minimal Chisel looks like this:

function on_init()
    return true
end

function on_event()
    return true
end

Function	Description
on_init()	Runs once when the Chisel starts
on_event()	Runs for every captured event

Both functions typically return true to continue processing events.

Requesting Event Fields

Before accessing event data, a Chisel must request field handles. Example:

ftype = chisel.request_field("evt.type")

This registers the event type field and returns a handle that can later be used to retrieve the value.

Reading Event Fields

Example:

local t = evt.field(ftype)

This returns the value of the requested field for the current event.

Writing Events to Log Files

NoDrop provides a built-in function to store events in readable format: evt.save()

function on_event()
    evt.save()
    return true
end

This will save events into .log files in the NoDrop storage directory.

The file naming format is the same as .buf files: tid-timestamp.log.

Sending Events to Remote Systems

Events can also be forwarded using UDP: evt.send(ip, port)

function on_event()
    evt.send("127.0.0.1", 9000)
    return true
end

This sends readable event data to the specified IP and port.