detect/mpm: improve stats reporting

pull/3988/head
Victor Julien 6 years ago
parent 24f0092b72
commit d6323ae33d

@ -1047,14 +1047,38 @@ static MpmStore *MpmStoreLookup(DetectEngineCtx *de_ctx, MpmStore *s)
return rs;
}
static const DetectBufferMpmRegistery *GetByMpmStore(const DetectEngineCtx *de_ctx,
const MpmStore *ms)
{
const DetectBufferMpmRegistery *am = de_ctx->app_mpms_list;
while (am != NULL) {
if (ms->sm_list == am->sm_list &&
ms->direction == am->direction) {
return am;
}
am = am->next;
}
am = de_ctx->pkt_mpms_list;
while (am != NULL) {
if (ms->sm_list == am->sm_list) {
return am;
}
am = am->next;
}
return NULL;
}
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
{
HashListTableBucket *htb = NULL;
int app_mpms_cnt = de_ctx->app_mpms_list_cnt;
uint32_t stats[MPMB_MAX] = {0};
int app_mpms_cnt = de_ctx->buffer_type_map_elements;
uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build
memset(&appstats, 0x00, sizeof(appstats));
int pkt_mpms_cnt = de_ctx->buffer_type_map_elements;
uint32_t pktstats[pkt_mpms_cnt + 1]; // +1 to silence scan-build
memset(&pktstats, 0x00, sizeof(pktstats));
for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table);
htb != NULL;
@ -1067,23 +1091,29 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
if (ms->buffer < MPMB_MAX)
stats[ms->buffer]++;
else if (ms->sm_list != DETECT_SM_LIST_PMATCH) {
int i = 0;
const DetectBufferMpmRegistery *am = de_ctx->app_mpms_list;
while (am != NULL) {
if (ms->sm_list == am->sm_list &&
ms->direction == am->direction)
{
SCLogDebug("%s %s: %u patterns. Min %u, Max %u. Ctx %p",
am->name,
am->direction == SIG_FLAG_TOSERVER ? "toserver":"toclient",
ms->mpm_ctx->pattern_cnt,
ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
ms->mpm_ctx);
appstats[am->sm_list]++;
break;
const DetectBufferMpmRegistery *am = GetByMpmStore(de_ctx, ms);
if (am != NULL) {
switch (am->type) {
case DETECT_BUFFER_MPM_TYPE_PKT:
SCLogDebug("%s: %u patterns. Min %u, Max %u. Ctx %p",
am->name,
ms->mpm_ctx->pattern_cnt,
ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
ms->mpm_ctx);
pktstats[am->sm_list]++;
break;
case DETECT_BUFFER_MPM_TYPE_APP:
SCLogDebug("%s %s: %u patterns. Min %u, Max %u. Ctx %p",
am->name,
am->direction == SIG_FLAG_TOSERVER ? "toserver":"toclient",
ms->mpm_ctx->pattern_cnt,
ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
ms->mpm_ctx);
appstats[am->sm_list]++;
break;
case DETECT_BUFFER_MPM_TYPE_SIZE:
break;
}
i++;
am = am->next;
}
}
}
@ -1094,15 +1124,22 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
}
const DetectBufferMpmRegistery *am = de_ctx->app_mpms_list;
while (am != NULL) {
if (appstats[am->sm_list] == 0)
goto next;
const char *name = am->name;
const char *direction = am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient";
SCLogPerf("AppLayer MPM \"%s %s\": %u", direction, name, appstats[am->sm_list]);
next:
if (appstats[am->sm_list] > 0) {
const char *name = am->name;
const char *direction = am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient";
SCLogPerf("AppLayer MPM \"%s %s (%s)\": %u", direction, name,
AppProtoToString(am->app_v2.alproto), appstats[am->sm_list]);
}
am = am->next;
}
const DetectBufferMpmRegistery *pm = de_ctx->pkt_mpms_list;
while (pm != NULL) {
if (pktstats[pm->sm_list] > 0) {
const char *name = pm->name;
SCLogPerf("Pkt MPM \"%s\": %u", name, pktstats[pm->sm_list]);
}
pm = pm->next;
}
}
}

Loading…
Cancel
Save