aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

profiling: add formatted totals, percents to packet stats

Browse Source
pull/346/head
Victor Julien 12 years ago
parent 4165de4771
commit ffffe6c10e
1 changed files with 124 additions and 34 deletions
Show Stats Download Patch File Download Diff File

158
src/util-profiling.c
Unescape Escape View File

@ -104,6 +104,17 @@ __thread int profiling_rules_entered = 0;
void SCProfilingDumpPacketStats(void);
const char * PacketProfileDetectIdToString(PacketProfileDetectId id);
static void FormatNumber(uint64_t num, char *str, size_t size) {
if (num < 1000UL)
snprintf(str, size, "%"PRIu64, num);
else if (num < 1000000UL)
snprintf(str, size, "%3.1fk", (float)num/1000UL);
else if (num < 1000000000UL)
snprintf(str, size, "%3.1fm", (float)num/1000000UL);
else
snprintf(str, size, "%3.1fb", (float)num/1000000000UL);
}
/**
* \brief Initialize profiling.
*/
@ -278,6 +289,8 @@ SCProfilingDump(void)
void SCProfilingDumpPacketStats(void) {
int i;
FILE *fp;
char totalstr[256];
uint64_t total;
if (profiling_packets_enabled == 0)
return;
@ -296,10 +309,17 @@ void SCProfilingDumpPacketStats(void) {
fprintf(fp, "\n\nPacket profile dump:\n");
fprintf(fp, "\n%-6s %-5s %-12s %-12s %-12s %-12s\n",
"IP ver", "Proto", "cnt", "min", "max", "avg");
fprintf(fp, "%-6s %-5s %-12s %-12s %-12s %-12s\n",
"------", "-----", "----------", "------------", "------------", "-----------");
fprintf(fp, "\n%-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s\n",
"IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%");
fprintf(fp, "%-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s\n",
"------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---");
total = 0;
for (i = 0; i < 257; i++) {
SCProfilePacketData *pd = &packet_profile_data4[i];
total += pd->tot;
pd = &packet_profile_data6[i];
total += pd->tot;
}
for (i = 0; i < 257; i++) {
SCProfilePacketData *pd = &packet_profile_data4[i];
@ -308,8 +328,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, " IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n", i, pd->cnt,
pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, " IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", i, pd->cnt,
pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
for (i = 0; i < 257; i++) {
@ -319,23 +343,27 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, " IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n", i, pd->cnt,
pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, " IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", i, pd->cnt,
pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
fprintf(fp, "Note: Protocol 256 tracks pseudo/tunnel packets.\n");
fprintf(fp, "\nPer Thread module stats:\n");
fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s",
"Thread Module", "IP ver", "Proto", "cnt", "min", "max", "avg");
fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s",
"Thread Module", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%");
#ifdef PROFILE_LOCKING
fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n",
"locks", "ticks", "cont.", "cont.avg", "slocks", "sticks", "scont.", "scont.avg");
#else
fprintf(fp, "\n");
#endif
fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s",
"------------------------", "------", "-----", "----------", "------------", "------------", "-----------");
fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s",
"------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---");
#ifdef PROFILE_LOCKING
fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n",
"--------", "--------", "----------", "-----------", "--------", "--------", "------------", "-----------");
@ -343,6 +371,18 @@ void SCProfilingDumpPacketStats(void) {
fprintf(fp, "\n");
#endif
int m;
total = 0;
for (m = 0; m < TMM_SIZE; m++) {
int p;
for (p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p];
total += pd->tot;
pd = &packet_profile_tmm_data6[m][p];
total += pd->tot;
}
}
for (m = 0; m < TMM_SIZE; m++) {
int p;
for (p = 0; p < 257; p++) {
@ -352,8 +392,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64,
TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f",
TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
#ifdef PROFILE_LOCKING
fprintf(fp, " %10.2f %12"PRIu64" %12"PRIu64" %10.2f %10.2f %12"PRIu64" %12"PRIu64" %10.2f\n",
(float)pd->lock/pd->cnt, (uint64_t)pd->ticks/pd->cnt, pd->contention, (float)pd->contention/pd->cnt, (float)pd->slock/pd->cnt, (uint64_t)pd->sticks/pd->cnt, pd->scontention, (float)pd->scontention/pd->cnt);
@ -372,8 +416,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n",
TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
}
fprintf(fp, "Note: TMM_STREAMTCP includes TCP app layer parsers, see below.\n");
@ -384,6 +432,18 @@ void SCProfilingDumpPacketStats(void) {
"App Layer", "IP ver", "Proto", "cnt", "min", "max", "avg");
fprintf(fp, "%-20s %-6s %-5s %-12s %-12s %-12s %-12s\n",
"--------------------", "------", "-----", "----------", "------------", "------------", "-----------");
total = 0;
for (m = 0; m < ALPROTO_MAX; m++) {
int p;
for (p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data4[m][p];
total += pd->tot;
pd = &packet_profile_app_data6[m][p];
total += pd->tot;
}
}
for (m = 0; m < ALPROTO_MAX; m++) {
int p;
for (p = 0; p < 257; p++) {
@ -393,8 +453,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
}
@ -407,8 +471,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
}
@ -422,8 +490,9 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
"Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s\n",
"Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr);
}
for (p = 0; p < 257; p++) {
@ -433,17 +502,29 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
"Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s\n",
"Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr);
}
}
total = 0;
for (m = 0; m < PROF_DETECT_SIZE; m++) {
int p;
for (p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_detect_data4[m][p];
total += pd->tot;
pd = &packet_profile_detect_data6[m][p];
total += pd->tot;
}
}
fprintf(fp, "\nGeneral detection engine stats:\n");
fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s\n",
"Detection phase", "IP ver", "Proto", "cnt", "min", "max", "avg");
fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s\n",
"------------------------", "------", "-----", "----------", "------------", "------------", "-----------");
fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n",
"Detection phase", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot");
fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n",
"------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------");
for (m = 0; m < PROF_DETECT_SIZE; m++) {
int p;
for (p = 0; p < 257; p++) {
@ -453,8 +534,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n",
PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
}
for (m = 0; m < PROF_DETECT_SIZE; m++) {
@ -466,8 +551,12 @@ void SCProfilingDumpPacketStats(void) {
continue;
}
fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64"\n",
PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt));
FormatNumber(pd->tot, totalstr, sizeof(totalstr));
double percent = (long double)pd->tot /
(long double)total * 100;
fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n",
PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
}
}
fclose(fp);
@ -769,7 +858,7 @@ const char * PacketProfileDetectIdToString(PacketProfileDetectId id)
switch (id) {
CASE_CODE (PROF_DETECT_MPM);
CASE_CODE (PROF_DETECT_MPM_PACKET);
CASE_CODE (PROF_DETECT_MPM_PKT_STREAM);
// CASE_CODE (PROF_DETECT_MPM_PKT_STREAM);
CASE_CODE (PROF_DETECT_MPM_STREAM);
CASE_CODE (PROF_DETECT_MPM_URI);
CASE_CODE (PROF_DETECT_MPM_HCBD);
@ -789,7 +878,8 @@ const char * PacketProfileDetectIdToString(PacketProfileDetectId id)
CASE_CODE (PROF_DETECT_ALERT);
CASE_CODE (PROF_DETECT_CLEANUP);
CASE_CODE (PROF_DETECT_GETSGH);
case PROF_DETECT_MPM_PKT_STREAM:
return "PROF_DETECT_MPM_PKT_STR";
default:
return "UNKNOWN";
}

Write Preview
Loading…
Cancel
Save