Implement ntopng plugins

Plugins are a convenient way to group together related lua scripts.
Their primary use case is to group user scripts and their alert/status
definition.
The builtin ntopng user scripts and definitions are now
packed into plugins directories. In future, we will support loading of
user created plugins.
Plugins are loaded at startup into some runtime directories and then
used. Other changes provided by this commit include:

- Add sample flow logger plugin
- Initial support for system user scripts
- Rename edge to threshold
- Migrate system probes to user scripts/plugins
- Migrate scripts to more explicit alerts_api.checkThresholdAlert api

scripts/plugins/threshold_cross/user_scripts/host/active.lua

@@ -0,0 +1,36 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.activity_time",
+    i18n_description = "alerts_thresholds_config.alert_active_description",
+    i18n_field_unit = user_scripts.field_units.seconds,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.host_delta_val(script.key, params.granularity, host.getTime()["total_activity_time"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/bytes.lua

@@ -0,0 +1,37 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.alert_bytes_title",
+    i18n_description = "alerts_thresholds_config.alert_bytes_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local host_bytes = host.getBytes()
+  local value = alerts_api.host_delta_val(script.key, params.granularity, host_bytes["bytes.sent"] + host_bytes["bytes.rcvd"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/dns.lua

@@ -0,0 +1,40 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.dns_traffic",
+    i18n_description = "alerts_thresholds_config.alert_dns_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  },
+
+  env = {
+     dns_app_id = interface.getnDPIProtoId("DNS")
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.host_delta_val(script.key, params.granularity, host.getApplicationBytes(script.env.dns_app_id)["bytes"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/flows.lua

@@ -0,0 +1,37 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.alert_flows_title",
+    i18n_description = "alerts_thresholds_config.alert_flows_description",
+    i18n_field_unit = user_scripts.field_units.flows,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local nf = host.getNumFlows()
+  local value = alerts_api.host_delta_val(script.key, params.granularity, nf["total_flows.as_client"] + nf["total_flows.as_server"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/idle.lua

@@ -0,0 +1,36 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.idle_time",
+    i18n_description = "alerts_thresholds_config.alert_idle_description",
+    i18n_field_unit = user_scripts.field_units.seconds,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.host_delta_val(script.key, params.granularity, os.time() - host.getTime()["seen.last"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/p2p.lua

@@ -0,0 +1,40 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.p2p_traffic",
+    i18n_description = "alerts_thresholds_config.alert_p2p_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  },
+
+  env = {
+     p2p_app_id = interface.getnDPICategoryId("FileSharing")
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.host_delta_val(script.key, params.granularity, host.getCategoryBytes(script.env.p2p_app_id)["bytes"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/packets.lua

@@ -0,0 +1,37 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.alert_packets_title",
+    i18n_description = "alerts_thresholds_config.alert_packets_description",
+    i18n_field_unit = user_scripts.field_units.packets,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local num_packets = host.getPackets()
+  local value =  alerts_api.host_delta_val(script.key, params.granularity, num_packets["packets.sent"] + num_packets["packets.rcvd"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/host/throughput.lua

@@ -0,0 +1,37 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  local_only = true,
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.throughput",
+    i18n_description = "alerts_thresholds_config.alert_throughput_description",
+    i18n_field_unit = user_scripts.field_units.mbits,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local host_bytes = host.getBytes()
+  local value = alerts_api.host_delta_val(script.key, params.granularity, host_bytes["bytes.sent"] + host_bytes["bytes.rcvd"]) * 8 / granularity2sec(params.granularity)
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/active_local_hosts.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.active_local_hosts",
+    i18n_description = "alerts_thresholds_config.active_local_hosts_threshold_descr",
+    i18n_field_unit = user_scripts.field_units.hosts,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = params.entity_info["stats"]["local_hosts"]
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/bytes.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.alert_bytes_title",
+    i18n_description = "alerts_thresholds_config.alert_bytes_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, params.entity_info["stats"]["bytes"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/dns.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.dns_traffic",
+    i18n_description = "alerts_thresholds_config.alert_dns_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, alerts_api.application_bytes(params.entity_info, "DNS"))
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/idle.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.idle_time",
+    i18n_description = "alerts_thresholds_config.alert_idle_description",
+    i18n_field_unit = user_scripts.field_units.mbits,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, os.time() - params.entity_info["seen.last"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/p2p.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.p2p_traffic",
+    i18n_description = "alerts_thresholds_config.alert_p2p_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, alerts_api.category_bytes(params.entity_info, "FileSharing"))
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/packets.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.alert_packets_title",
+    i18n_description = "alerts_thresholds_config.alert_packets_description",
+    i18n_field_unit = user_scripts.field_units.packets,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, params.entity_info["stats"]["packets"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/interface/throughput.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.throughput",
+    i18n_description = "alerts_thresholds_config.alert_throughput_description",
+    i18n_field_unit = user_scripts.field_units.mbits,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.interface_delta_val(script.key, params.granularity, params.entity_info["stats"]["bytes"]) * 8 / granularity2sec(params.granularity)
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/network/egress.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.egress_traffic",
+    i18n_description = "alerts_thresholds_config.alert_network_egress_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.network_delta_val(script.key, params.granularity, params.entity_info["egress"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/network/ingress.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.ingress_traffic",
+    i18n_description = "alerts_thresholds_config.alert_network_ingress_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.network_delta_val(script.key, params.granularity, params.entity_info["ingress"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script

scripts/plugins/threshold_cross/user_scripts/network/inner.lua

@@ -0,0 +1,35 @@
+--
+-- (C) 2019 - ntop.org
+--
+
+local alerts_api = require("alerts_api")
+local alert_consts = require("alert_consts")
+local user_scripts = require("user_scripts")
+
+local script = {
+  default_enabled = false,
+
+  -- See below
+  hooks = {},
+
+  gui = {
+    i18n_title = "alerts_thresholds_config.inner_traffic",
+    i18n_description = "alerts_thresholds_config.alert_network_inner_description",
+    i18n_field_unit = user_scripts.field_units.bytes,
+    input_builder = user_scripts.threshold_cross_input_builder,
+    post_handler = user_scripts.threshold_cross_post_handler,
+  }
+}
+
+-- #################################################################
+
+function script.hooks.all(params)
+  local value = alerts_api.network_delta_val(script.key, params.granularity, params.entity_info["inner"])
+
+  -- Check if the configured threshold is crossed by the value and possibly trigger an alert
+  alerts_api.checkThresholdAlert(params, alert_consts.alert_types.alert_threshold_cross, value)
+end
+
+-- #################################################################
+
+return script