policy/misc/stats.zeek

Stats

Log memory/packet/lag statistics.

Namespace:

Stats

Imports:

base/frameworks/notice, base/frameworks/telemetry, base/utils/time.zeek

Summary

Runtime Options

Stats::report_interval: interval &redef

How often stats are reported.

Types

Stats::Info: record

Redefinitions

Log::ID: enum

Events

Stats::log_stats: event

Event to catch stats as they are written to the logging stream.

Hooks

Stats::log_policy: Log::PolicyHook

Detailed Interface

Runtime Options

Stats::report_interval
Type:

interval

Attributes:

&redef

Default:

5.0 mins

How often stats are reported.

Types

Stats::Info
Type:

record

Fields:
ts: time &log

Timestamp for the measurement.

peer: string &log

Peer that generated this log. Mostly for clusters.

mem: count &log

Amount of memory currently in use in MB.

pkts_proc: count &log

Number of packets processed since the last stats interval.

bytes_recv: count &log

Number of bytes received since the last stats interval if reading live traffic.

pkts_dropped: count &log &optional

Number of packets dropped since the last stats interval if reading live traffic.

Number of packets seen on the link since the last stats interval if reading live traffic.

pkt_lag: interval &log &optional

Lag between the wall clock and packet timestamps if reading live traffic.

pkts_filtered: count &log &optional

Number of packets filtered from the link since the last stats interval if reading live traffic.

events_proc: count &log

Number of events processed since the last stats interval.

events_queued: count &log

Number of events that have been queued since the last stats interval.

active_tcp_conns: count &log

TCP connections currently in memory.

active_udp_conns: count &log

UDP connections currently in memory.

active_icmp_conns: count &log

ICMP connections currently in memory.

tcp_conns: count &log

TCP connections seen since last stats interval.

udp_conns: count &log

UDP connections seen since last stats interval.

icmp_conns: count &log

ICMP connections seen since last stats interval.

timers: count &log

Number of timers scheduled since last stats interval.

active_timers: count &log

Current number of scheduled timers.

files: count &log

Number of files seen since last stats interval.

active_files: count &log

Current number of files actively being seen.

dns_requests: count &log

Number of DNS requests seen since last stats interval.

active_dns_requests: count &log

Current number of DNS requests awaiting a reply.

reassem_tcp_size: count &log

Current size of TCP data in reassembly.

reassem_file_size: count &log

Current size of File data in reassembly.

reassem_frag_size: count &log

Current size of packet fragment data in reassembly.

reassem_unknown_size: count &log

Current size of unknown data in reassembly (this is only PIA buffer right now).

Events

Stats::log_stats
Type:

event (rec: Stats::Info)

Event to catch stats as they are written to the logging stream.

Hooks

Stats::log_policy
Type:

Log::PolicyHook