Introduce a potpourri of smaller improvements #2832

dominiklohmann · 2023-01-03T09:28:12Z

This is a set of improvements seemingly unrelated to one another that amassed in one branch locally whenever I was traveling this vacation season.

These are the notable changes:

Plugin names are now case-insensitive
VASTQL is now a query-language plugin (builtin) so it no longer requires special-casing; this will allow for making the query language choice explicit in the future
Removed PCAP-specific logic from the export command
Removed handling of old deprecated options since the next release is going to be a major release
VAST now shuts down instantly when metrics are enabled instead of being held alive for up to the duration of the telemetry interval (10s)

(1), (4), and (5) probably need changelog entries.

Not urgent to review, I won't be back in action before next week anyways, and it might very well be the case that I push another few things onto this. :)

examples/plugins/analyzer/example_analyzer.cpp

libvast/builtins/query-languages/vastql.cpp

This makes it easier to add additional logic to query parsing in the future, as now query parsing is centralized in the plugin API.

This whole early expression-modifying approach for queries with the PCAP writer attached didn't work properly as soon as a pipeline was attached anyways, so we might as well remove it. We already had the correct check in place within the writer, and this essentially just improves its error message.

Now that we have broken anyways the next release will have to be a major release—so let's also clean up older deprecation warnings while we're at it.

To review this, run: ```bash vast --bare-mode --enable-metrics --plugins= start --commands=stop ``` Before this change, this took exactly 10s to shut down as the telemetry loops held some actors alive with strong references on the actor clock's scheduler.

libvast/include/vast/plugin.hpp

libvast/src/plugin.cpp

libvast/src/system/spawn_arguments.cpp

plugins/pcap/main.cpp

mavam

Neat stuff.

I know the PR is still an draft mode, but it was very reviewable already. 🙂

…on-improvements

mavam

Nice touch ups. 🌴

libvast/builtins/commands/rebuild.cpp

libvast/src/plugin.cpp

This PR updates the documentation after VASTQL became its own language frontend in #2832.

mavam added the enhancement label Jan 3, 2023

mavam reviewed Jan 3, 2023

View reviewed changes

examples/plugins/analyzer/example_analyzer.cpp Outdated Show resolved Hide resolved

mavam reviewed Jan 3, 2023

View reviewed changes

libvast/builtins/query-languages/vastql.cpp Show resolved Hide resolved

dominiklohmann added 11 commits January 4, 2023 02:25

Make plugin names case-insensitive

fa37b9e

Introduce a VASTQL query language plugin

604c2bd

This makes it easier to add additional logic to query parsing in the future, as now query parsing is centralized in the plugin API.

Fix log message for invalid plugin dirs

88d372f

Apply clang-format to plugin.hpp

dcd6e5d

Remove unnecessary CAF version check

c109ac6

Remove old deprecation warnings

62d5cab

Now that we have broken anyways the next release will have to be a major release—so let's also clean up older deprecation warnings while we're at it.

Use weak_handle<T> over untyped weak_actor_ptr

f9acbfa

Make plugin::name() harder to misuse

2b0cf48

Replace source wakeup handler with actions

6a133d7

dominiklohmann force-pushed the topic/random-vacation-improvements branch from 95fcc1f to 6953dd0 Compare January 4, 2023 01:26

Replace internal telemetry handlers with actions

6958bb2

dominiklohmann force-pushed the topic/random-vacation-improvements branch from 6953dd0 to 6958bb2 Compare January 4, 2023 01:45