Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stats framework missing data in output #713

Open
brittanydonowho opened this issue Dec 19, 2019 · 4 comments
Open

Stats framework missing data in output #713

brittanydonowho opened this issue Dec 19, 2019 · 4 comments

Comments

@brittanydonowho
Copy link

@brittanydonowho brittanydonowho commented Dec 19, 2019

Whenever stats framework is run on pcap the output is missing data. I found that if I move

if (zeek_is_terminating() )
return;

in policy/misc/stats.zeek to the end of stats.zeek as follows:

Log::write(Stats::LOG, info);

if ( zeek_is_terminating() )
return;

schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) };

The numbers output are as expected. Can someone verify that this is correct?

@jsiwek

This comment has been minimized.

Copy link
Member

@jsiwek jsiwek commented Dec 23, 2019

I can't think of a reason why the original code returned so early and I'd also move it to return just before the schedule as you show. Would you like to create a Pull Request with the change?

@brittanydonowho

This comment has been minimized.

Copy link
Author

@brittanydonowho brittanydonowho commented Dec 23, 2019

Great - yes will do!

@jsiwek

This comment has been minimized.

Copy link
Member

@jsiwek jsiwek commented Jan 10, 2020

Just checking if you still plan to make a Pull Request for this? No problem if not; will just make the change directly.

@brittanydonowho

This comment has been minimized.

Copy link
Author

@brittanydonowho brittanydonowho commented Jan 10, 2020

Still waiting on approval from work but will do this asap. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.