detect/profile: add support for tx inspection

Add 'inspect_type' "packet" and "tx" for the two record types. Add more metadata
when available.
pull/6324/head
Victor Julien 5 years ago
parent a2e37522bb
commit e7a74348d7

@ -35,6 +35,51 @@
#ifdef PROFILING
SCMutex g_rule_dump_write_m = SCMUTEX_INITIALIZER;
void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt,
const uint32_t pkt_prefilter_cnt)
{
JsonBuilder *js =
CreateEveHeaderWithTxId(p, LOG_DIR_PACKET, "inspectedrules", NULL, tx_id, NULL);
if (js == NULL)
return;
jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
jb_open_object(js, "inspectedrules");
jb_set_string(js, "inspect_type", "tx");
jb_set_uint(js, "rule_group_id", sgh->id);
jb_set_uint(js, "rule_cnt", rule_cnt);
jb_set_uint(js, "pkt_rule_cnt", pkt_prefilter_cnt);
jb_set_uint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
jb_open_array(js, "rules");
for (uint32_t x = 0; x < rule_cnt; x++) {
SigIntId iid = det_ctx->tx_candidates[x].id;
const Signature *s = det_ctx->de_ctx->sig_array[iid];
if (s == NULL)
continue;
jb_append_uint(js, s->id);
}
jb_close(js); // close array
jb_close(js); // close inspectedrules object
jb_close(js); // final close
const char *filename = "packet_inspected_rules.json";
const char *log_dir = ConfigGetLogDirectory();
char log_path[PATH_MAX] = "";
snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, filename);
SCMutexLock(&g_rule_dump_write_m);
FILE *fp = fopen(log_path, "a");
if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
fclose(fp);
}
SCMutexUnlock(&g_rule_dump_write_m);
jb_free(js);
}
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
const SigGroupHead *sgh, const Packet *p)
{
@ -42,9 +87,15 @@ void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
if (js == NULL)
return;
if (p->flow) {
jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
}
jb_open_object(js, "inspectedrules");
jb_set_string(js, "inspect_type", "packet");
jb_set_uint(js, "rule_group_id", sgh->id);
jb_set_uint(js, "rule_cnt", det_ctx->match_array_cnt);
jb_set_uint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
jb_open_array(js, "rules");
for (uint32_t x = 0; x < det_ctx->match_array_cnt; x++) {
@ -72,4 +123,4 @@ void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
SCMutexUnlock(&g_rule_dump_write_m);
jb_free(js);
}
#endif /* PROFILING */
#endif /* PROFILING */

@ -24,6 +24,9 @@
#ifndef _DETECT_ENGINE_PROFILE_H
#define _DETECT_ENGINE_PROFILE_H
void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt,
const uint32_t pkt_prefilter_cnt);
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
const SigGroupHead *sgh, const Packet *p);

@ -1419,7 +1419,10 @@ static void DetectRunTx(ThreadVars *tv,
tx.tx_ptr, tx.tx_id, array_idx - old);
}
}
#ifdef PROFILING
if (array_idx >= de_ctx->profile_match_logging_threshold)
RulesDumpTxMatchArray(det_ctx, scratch->sgh, p, tx.tx_id, array_idx, x);
#endif
det_ctx->tx_id = tx.tx_id;
det_ctx->tx_id_set = 1;
det_ctx->p = p;

Loading…
Cancel
Save