Skip to content

Commit

Permalink
Add option to ignore outgoing messages from the server.
Browse files Browse the repository at this point in the history
If Ignore_outgoing is set to true, then the agent is not publishing
the messages that are originating from the server on which the agent
is installed. This can help with removing duplicates in cases where
there is communication between two servers running agents.
  • Loading branch information
monicasarbu committed May 9, 2014
1 parent 51122cc commit 4abf417
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 2 deletions.
5 changes: 5 additions & 0 deletions packetbeat.conf
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,11 @@ device = "any"
#
#name=

# Uncomment the following if you want to ignore transactions created
# by the server on which the agent is installed. This option is useful
# to remove duplicates if agents are installed on multiple servers.
#ignore_outgoing = true

[runoptions]
# The Packetbeat agent can drop privileges after creating the sniffing
# socket. Root access is required for opening the socket but everything
Expand Down
21 changes: 19 additions & 2 deletions publish.go
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ var Publisher PublisherType
type tomlAgent struct {
Name string
Refresh_topology_freq int
Ignore_outgoing bool
}
type tomlMothership struct {
Host string
Expand Down Expand Up @@ -102,12 +103,14 @@ func (publisher *PublisherType) PublishHttpTransaction(t *HttpTransaction) error
src_server := publisher.GetServerName(t.Src.Ip)
dst_server := publisher.GetServerName(t.Dst.Ip)

if dst_server != publisher.name {
if _Config.Agent.Ignore_outgoing && dst_server != "" &&
dst_server != publisher.name {
// duplicated transaction -> ignore it
DEBUG("publish", "Ignore duplicated Http transaction on %s: %s -> %s", publisher.name, src_server, dst_server)
DEBUG("publish", "Ignore duplicated HTTP transaction on %s: %s -> %s", publisher.name, src_server, dst_server)
return nil
}


var src_country = ""
if _GeoLite != nil {
if len(src_server) == 0 { // only for external IP addresses
Expand Down Expand Up @@ -150,6 +153,13 @@ func (publisher *PublisherType) PublishMysqlTransaction(t *MysqlTransaction) err
src_server := publisher.GetServerName(t.Src.Ip)
dst_server := publisher.GetServerName(t.Dst.Ip)

if _Config.Agent.Ignore_outgoing && dst_server != "" &&
dst_server != publisher.name {
// duplicated transaction -> ignore it
DEBUG("publish", "Ignore duplicated MySQL transaction on %s: %s -> %s", publisher.name, src_server, dst_server)
return nil
}

event := Event{
t.ts, "mysql", t.Src.Ip, t.Src.Port, t.Src.Proc, "", src_server,
t.Dst.Ip, t.Dst.Port, t.Dst.Proc, dst_server,
Expand Down Expand Up @@ -179,6 +189,13 @@ func (publisher *PublisherType) PublishRedisTransaction(t *RedisTransaction) err
src_server := publisher.GetServerName(t.Src.Ip)
dst_server := publisher.GetServerName(t.Dst.Ip)

if _Config.Agent.Ignore_outgoing && dst_server != "" &&
dst_server != publisher.name {
// duplicated transaction -> ignore it
DEBUG("publish", "Ignore duplicated REDIS transaction on %s: %s -> %s", publisher.name, src_server, dst_server)
return nil
}

event := Event{
t.ts, "redis", t.Src.Ip, t.Src.Port, t.Src.Proc, "", src_server,
t.Dst.Ip, t.Dst.Port, t.Dst.Proc, dst_server,
Expand Down

0 comments on commit 4abf417

Please sign in to comment.