zam-prof.bif.zeek

GLOBAL

ZAM::Prof

Functions to enable script-level control & querying of ZAM profiling.

Namespaces:: GLOBAL, ZAM::Prof

Summary

Functions

`ZAM::Prof::estimated_profiling_overhead`: `function`	Returns an estimate of the timing overhead of each CPU/memory measurement.
`ZAM::Prof::get_module_profile`: `function`	Returns the profile for the given module so far.
`ZAM::Prof::set_module_profiling`: `function`	Activates/deactivates CPU+memory profiling for all ZAM-compiled bodies that include the given module.

Detailed Interface

Functions

ZAM::Prof::estimated_profiling_overhead

Type:: function () : interval

Returns an estimate of the timing overhead of each CPU/memory measurement. Can be used to attempt to remove bias in assessing those measurements.

Returns:: The estimate of the total overhead, as a non-negative interval.

Note

This value is fixed per Zeek run. Repeated calls to it from within that run will return the same value.

ZAM::Prof::get_module_profile

Type:: function (mod: string) : ZAM::Prof::Profile

Returns the profile for the given module so far.

ZAM::Prof::set_module_profiling

Type:: function (mod: string, active: bool) : count

Activates/deactivates CPU+memory profiling for all ZAM-compiled bodies that include the given module.

Parameters:

mod – the name of the module
active – if true, active, otherwise deactivate

Returns:

How many bodies were set to the given profiling.

Note

Overrides any previously set sampling for the module.

Note

The return value will often indicate fewer bodies than present in the module due to inlining. On the flip side, it can indicate more bodies than present in the module due to ZAM generates bodies for both standalone and “coalesced” versions of event handlers.

Note

Due to event handler coalescence (enabled by default), some ZAM-compiled bodies will correspond to multiple modules. For these bodies, sampling activation follows the most recent call for any of those modules.

Note

A return value of 0 means the module name doesn’t correspond to any compiled bodies. This will always be the case if Zeek is not running with some form of -O ZAM enabled.