Skip to content
Permalink
Browse files

encoder: added support for exporting metrics live

  • Loading branch information...
dreadl0ck committed May 2, 2019
1 parent 495d0e2 commit ee2869e2f7fcc2ed1d98ebf9f8fe8f7a34c3b0b2
Showing with 37 additions and 7 deletions.
  1. +1 −0 encoder/config.go
  2. +18 −3 encoder/customEncoder.go
  3. +18 −4 encoder/layerEncoder.go
@@ -26,4 +26,5 @@ type Config struct {
Source string
Version string
IncludePayloads bool
Export bool
}
@@ -61,6 +61,7 @@ type (
numRecords int64

writer *netcap.Writer
export bool
}
)

@@ -153,6 +154,9 @@ func InitCustomEncoders(c Config) {
}
}

// export metrics?
e.export = c.Export

// write header
err := e.writer.WriteHeader(e.Type, c.Source, c.Version, c.IncludePayloads)
if err != nil {
@@ -182,17 +186,28 @@ func CreateCustomEncoder(t types.Type, name string, postinit func(*CustomEncoder
func (e *CustomEncoder) Encode(p gopacket.Packet) error {

// call the Handler function of the encoder
decoded := e.Handler(p)
if decoded != nil {
record := e.Handler(p)
if record != nil {

// increase counter
atomic.AddInt64(&e.numRecords, 1)

// write record
err := e.writer.WriteProto(decoded)
err := e.writer.WriteProto(record)
if err != nil {
return err
}

// export metrics if configured
if e.export {
// assert to audit record
if p, ok := record.(types.AuditRecord); ok {
// export metrics
p.Inc()
} else {
log.Fatal("netcap type does not implement the types.AuditRecord interface!")
}
}
}
return nil
}
@@ -100,6 +100,7 @@ type (

Handler LayerEncoderHandler
writer *netcap.Writer
export bool
}
)

@@ -177,6 +178,9 @@ func InitLayerEncoders(c Config) {
log.Fatal("failed to write header for audit record: ", e.Type.String())
}

// export metrics?
e.export = c.Export

// add to layer encoders map
LayerEncoders[e.Layer] = append(LayerEncoders[e.Layer], e)
}
@@ -197,15 +201,25 @@ func CreateLayerEncoder(nt types.Type, lt gopacket.LayerType, handler LayerEncod
// and writes the serialized protobuf into the data pipe
func (e *LayerEncoder) Encode(l gopacket.Layer, timestamp time.Time) error {

// fmt.Println("decode", e.Layer.String())
record := e.Handler(l, utils.TimeToString(timestamp))
if record != nil {

decoded := e.Handler(l, utils.TimeToString(timestamp))
if decoded != nil {
// write record
err := e.writer.WriteProto(decoded)
err := e.writer.WriteProto(record)
if err != nil {
return err
}

// export metrics if configured
if e.export {
// assert to audit record
if p, ok := record.(types.AuditRecord); ok {
// export metrics
p.Inc()
} else {
log.Fatal("netcap type does not implement the types.AuditRecord interface!")
}
}
}
return nil
}

0 comments on commit ee2869e

Please sign in to comment.
You can’t perform that action at this time.