Migrate interface alerts to in-memory alerts

This commit is contained in:
emanuele-f 2017-11-16 16:05:49 +01:00
parent 346627eb74
commit d85fc2b06b
5 changed files with 78 additions and 31 deletions

View file

@ -62,7 +62,7 @@ typedef struct {
* @ingroup NetworkInterface * @ingroup NetworkInterface
* *
*/ */
class NetworkInterface { class NetworkInterface : public Checkpointable {
protected: protected:
char *ifname, *ifDescription; char *ifname, *ifDescription;
const char *customIftype; const char *customIftype;
@ -288,8 +288,11 @@ class NetworkInterface {
inline void incLostPkts(u_int32_t num) { tcpPacketStats.incLost(num); }; inline void incLostPkts(u_int32_t num) { tcpPacketStats.incLost(num); };
bool checkPointHostCounters(lua_State* vm, u_int8_t checkpoint_id, char *host_ip, u_int16_t vlan_id); bool checkPointHostCounters(lua_State* vm, u_int8_t checkpoint_id, char *host_ip, u_int16_t vlan_id);
bool checkPointNetworkCounters(lua_State* vm, u_int8_t checkpoint_id, u_int8_t network_id); bool checkPointNetworkCounters(lua_State* vm, u_int8_t checkpoint_id, u_int8_t network_id);
inline bool checkPointInterfaceCounters(lua_State* vm, u_int8_t checkpoint_id) { checkpoint(vm, checkpoint_id); return true; }
void checkPointCounters(bool drops_only); void checkPointCounters(bool drops_only);
virtual char* serializeCheckpoint();
virtual u_int64_t getCheckPointNumPackets(); virtual u_int64_t getCheckPointNumPackets();
virtual u_int64_t getCheckPointNumBytes(); virtual u_int64_t getCheckPointNumBytes();
virtual u_int32_t getCheckPointNumPacketDrops(); virtual u_int32_t getCheckPointNumPacketDrops();

View file

@ -71,6 +71,17 @@ end
-- ################################################################## -- ##################################################################
-- Remove the json dumps previously needed for alerts generation
for _, ifname in pairs(interface.getIfNames()) do
interface.select(ifname)
local ifid = getInterfaceId(ifname)
local alerts_status_path = fixPath(dirs.workingdir .. "/" .. ifid .. "/json/")
ntop.rmdir(alerts_status_path)
end
-- ##################################################################
initCustomnDPIProtoCategories() initCustomnDPIProtoCategories()
loadHostBlackList() loadHostBlackList()

View file

@ -1835,37 +1835,25 @@ end
-- ################################# -- #################################
local function entity_threshold_status_rw(granularity, ifname_id, fname, to_write --[[nil if it's a read]], additional_path)
local basedir = fixPath(dirs.workingdir .. "/" .. ifname_id .. "/json/" .. granularity .. (additional_path and ("/"..additional_path) or ""))
local fpath = fixPath(basedir.."/"..fname)
if to_write ~= nil then
if not(ntop.exists(basedir)) then
ntop.mkdir(basedir)
end
-- Write new version
persistence.store(fpath, to_write)
elseif ntop.exists(fpath) then
-- Read old version
return persistence.load(fpath)
end
end
-- #################################
local function interface_threshold_status_rw(granularity, ifid, to_write)
return entity_threshold_status_rw(granularity, ifid, "iface_"..ifid.."_lastdump", to_write)
end
-- #################################
local function check_interface_alerts(ifid, working_status) local function check_interface_alerts(ifid, working_status)
local ifstats = interface.getStats() local ifstats = interface.getStats()
local entity_value = "iface_"..ifid local entity_value = "iface_"..ifid
local old_entity_info = interface_threshold_status_rw(working_status.granularity, ifid) -- read old json local checkpoints = interface.checkpointInterface(ifid, working_status.engine) or {}
local new_entity_info = ifstats local old_entity_info = checkpoints["previous"] and j.decode(checkpoints["previous"])
local new_entity_info = checkpoints["current"] and j.decode(checkpoints["current"])
if new_entity_info == nil then
if warning_shown == false then
print("["..__FILE__().."]:["..__LINE__().."] Unexpected new_entity_info == nil")
tprint({
old_entity_info = old_entity_info,
granularity = working_status.granularity,
entity_value = entity_value,
ifname=getInterfaceName(ifid)})
end
return
end
if (old_entity_info ~= nil) and (old_entity_info.stats ~= nil) and (old_entity_info.stats.bytes ~= nil) then if (old_entity_info ~= nil) and (old_entity_info.stats ~= nil) and (old_entity_info.stats.bytes ~= nil) then
-- wrap check -- wrap check
@ -1880,8 +1868,6 @@ local function check_interface_alerts(ifid, working_status)
end end
check_entity_alerts(ifid, "interface", entity_value, working_status, old_entity_info, new_entity_info) check_entity_alerts(ifid, "interface", entity_value, working_status, old_entity_info, new_entity_info)
interface_threshold_status_rw(working_status.granularity, ifid, new_entity_info) -- write new json
end end
local function check_networks_alerts(ifid, working_status) local function check_networks_alerts(ifid, working_status)

View file

@ -2374,6 +2374,29 @@ static int ntop_checkpoint_interface_network(lua_State* vm) {
/* ****************************************** */ /* ****************************************** */
static int ntop_checkpoint_network_interface(lua_State* vm) {
int ifid;
NetworkInterface *iface = NULL;
u_int8_t checkpoint_id;
ntop->getTrace()->traceEvent(TRACE_DEBUG, "%s() called", __FUNCTION__);
if(ntop_lua_check(vm, __FUNCTION__, 1, LUA_TNUMBER)) return(CONST_LUA_ERROR);
if(ntop_lua_check(vm, __FUNCTION__, 2, LUA_TNUMBER)) return(CONST_LUA_ERROR);
ifid = (int)lua_tointeger(vm, 1);
iface = ntop->getInterfaceById(ifid);
checkpoint_id = (u_int8_t)lua_tointeger(vm, 3);
if(!iface || iface->isView() || !iface->checkPointInterfaceCounters(vm, checkpoint_id)){
lua_pushnil(vm);
return(CONST_LUA_ERROR);
} else
return(CONST_LUA_OK);
}
/* ****************************************** */
static int ntop_get_interface_flow_key(lua_State* vm) { static int ntop_get_interface_flow_key(lua_State* vm) {
NetworkInterface *ntop_interface = getCurrentInterface(vm); NetworkInterface *ntop_interface = getCurrentInterface(vm);
Host *cli, *srv; Host *cli, *srv;
@ -6400,6 +6423,7 @@ static const luaL_Reg ntop_interface_reg[] = {
{ "restoreHost", ntop_restore_interface_host }, { "restoreHost", ntop_restore_interface_host },
{ "checkpointHost", ntop_checkpoint_interface_host }, { "checkpointHost", ntop_checkpoint_interface_host },
{ "checkpointNetwork", ntop_checkpoint_interface_network }, { "checkpointNetwork", ntop_checkpoint_interface_network },
{ "checkpointInterface", ntop_checkpoint_network_interface },
{ "getFlowsInfo", ntop_get_interface_flows_info }, { "getFlowsInfo", ntop_get_interface_flows_info },
{ "getGroupedFlows", ntop_get_interface_get_grouped_flows }, { "getGroupedFlows", ntop_get_interface_get_grouped_flows },
{ "getFlowsStats", ntop_get_interface_flows_stats }, { "getFlowsStats", ntop_get_interface_flows_stats },

View file

@ -3005,6 +3005,29 @@ bool NetworkInterface::checkPointNetworkCounters(lua_State* vm, u_int8_t checkpo
/* **************************************************** */ /* **************************************************** */
char* NetworkInterface::serializeCheckpoint() {
json_object *my_object, *inner;
if((my_object = json_object_new_object()) == NULL) return(NULL);
if((inner = json_object_new_object()) == NULL) { json_object_put(my_object); return(NULL); }
json_object_object_add(my_object, "seen.last", json_object_new_int64(getTimeLastPktRcvd()));
json_object_object_add(my_object, "ndpiStats", ndpiStats.getJSONObjectForCheckpoint(this));
json_object_object_add(inner, "bytes", json_object_new_int64(getNumBytes()));
json_object_object_add(inner, "packets", json_object_new_int64(getNumPackets()));
json_object_object_add(my_object, "stats", inner);
char *rsp = strdup(json_object_to_json_string(my_object));
/* Free memory */
json_object_put(my_object);
return(rsp);
}
/* **************************************************** */
Host* NetworkInterface::findHostsByIP(AddressTree *allowed_hosts, Host* NetworkInterface::findHostsByIP(AddressTree *allowed_hosts,
char *host_ip, u_int16_t vlan_id) { char *host_ip, u_int16_t vlan_id) {
if(host_ip != NULL) { if(host_ip != NULL) {