void MonitorInitialize(void)
{
int i, j, k;
char vbuff[CF_BUFSIZE];
sprintf(vbuff, "%s/state/cf_users", CFWORKDIR);
MapName(vbuff);
CreateEmptyFile(vbuff);
snprintf(ENVFILE_NEW, CF_BUFSIZE, "%s/state/%s", CFWORKDIR, CF_ENVNEW_FILE);
MapName(ENVFILE_NEW);
snprintf(ENVFILE, CF_BUFSIZE, "%s/state/%s", CFWORKDIR, CF_ENV_FILE);
MapName(ENVFILE);
MonEntropyClassesInit();
GetDatabaseAge();
for (i = 0; i < CF_OBSERVABLES; i++)
{
LOCALAV.Q[i] = QDefinite(0.0);
}
for (i = 0; i < 7; i++)
{
for (j = 0; j < CF_OBSERVABLES; j++)
{
for (k = 0; k < CF_GRAINS; k++)
{
HISTOGRAM[i][j][k] = 0;
}
}
}
for (i = 0; i < CF_OBSERVABLES; i++)
{
CHI[i] = 0;
CHI_LIMIT[i] = 0.1;
LDT_AVG[i] = 0;
LDT_SUM[i] = 0;
}
srand((unsigned int) time(NULL));
LoadHistogram();
/* Look for local sensors - this is unfortunately linux-centric */
MonNetworkInit();
MonTempInit();
MonOtherInit();
Log(LOG_LEVEL_DEBUG, "Finished with monitor initialization");
}
void UpdateLastSawHost(const char *hostkey, const char *address,
bool incoming, time_t timestamp)
{
DBHandle *db = NULL;
if (!OpenDB(&db, dbid_lastseen))
{
Log(LOG_LEVEL_ERR, "Unable to open last seen db");
return;
}
/* Update quality-of-connection entry */
char quality_key[CF_BUFSIZE];
snprintf(quality_key, CF_BUFSIZE, "q%c%s", incoming ? 'i' : 'o', hostkey);
KeyHostSeen newq = { .lastseen = timestamp };
KeyHostSeen q;
if (ReadDB(db, quality_key, &q, sizeof(q)))
{
newq.Q = QAverage(q.Q, newq.lastseen - q.lastseen, 0.4);
}
else
{
/* FIXME: more meaningful default value? */
newq.Q = QDefinite(0);
}
WriteDB(db, quality_key, &newq, sizeof(newq));
/* Update forward mapping */
char hostkey_key[CF_BUFSIZE];
snprintf(hostkey_key, CF_BUFSIZE, "k%s", hostkey);
WriteDB(db, hostkey_key, address, strlen(address) + 1);
/* Update reverse mapping */
char address_key[CF_BUFSIZE];
snprintf(address_key, CF_BUFSIZE, "a%s", address);
WriteDB(db, address_key, hostkey, strlen(hostkey) + 1);
CloseDB(db);
}
void NovaNamedEvent(const char *eventname, double value)
{
Event ev_new, ev_old;
time_t now = time(NULL);
CF_DB *dbp;
if (!OpenDB(&dbp, dbid_measure))
{
return;
}
ev_new.t = now;
if (ReadDB(dbp, eventname, &ev_old, sizeof(ev_old)))
{
if (isnan(ev_old.Q.expect))
{
ev_old.Q.expect = value;
}
if (isnan(ev_old.Q.var))
{
ev_old.Q.var = 0;
}
ev_new.Q = QAverage(ev_old.Q, value, 0.7);
}
else
{
ev_new.Q = QDefinite(value);
}
Log(LOG_LEVEL_VERBOSE, "Wrote scalar named event \"%s\" = (%.2lf,%.2lf,%.2lf)", eventname, ev_new.Q.q,
ev_new.Q.expect, sqrt(ev_new.Q.var));
WriteDB(dbp, eventname, &ev_new, sizeof(ev_new));
CloseDB(dbp);
}
void NoteClassUsage(AlphaList baselist, int purge)
{
CF_DB *dbp;
CF_DBC *dbcp;
void *stored;
char *key;
int ksize, vsize;
Event e, entry, newe;
double lsea = SECONDS_PER_WEEK * 52; /* expire after (about) a year */
time_t now = time(NULL);
Item *list = NULL;
const Item *ip;
double lastseen;
double vtrue = 1.0; /* end with a rough probability */
/* Only do this for the default policy, too much "downgrading" otherwise */
if (MINUSF)
{
return;
}
AlphaListIterator it = AlphaListIteratorInit(&baselist);
for (ip = AlphaListIteratorNext(&it); ip != NULL; ip = AlphaListIteratorNext(&it))
{
if ((IGNORECLASS(ip->name)))
{
CfDebug("Ignoring class %s (not packing)", ip->name);
continue;
}
IdempPrependItem(&list, ip->name, NULL);
}
if (!OpenDB(&dbp, dbid_classes))
{
return;
}
/* First record the classes that are in use */
for (ip = list; ip != NULL; ip = ip->next)
{
if (ReadDB(dbp, ip->name, &e, sizeof(e)))
{
CfDebug("FOUND %s with %lf\n", ip->name, e.Q.expect);
lastseen = now - e.t;
newe.t = now;
newe.Q = QAverage(e.Q, vtrue, 0.7);
}
else
{
lastseen = 0.0;
newe.t = now;
/* With no data it's 50/50 what we can say */
newe.Q = QDefinite(0.5 * vtrue);
}
if (lastseen > lsea)
{
CfDebug("Class usage record %s expired\n", ip->name);
DeleteDB(dbp, ip->name);
}
else
{
WriteDB(dbp, ip->name, &newe, sizeof(newe));
}
}
/* Then update with zero the ones we know about that are not active */
if (purge)
{
/* Acquire a cursor for the database and downgrade classes that did not
get defined this time*/
if (!NewDBCursor(dbp, &dbcp))
{
CfOut(cf_inform, "", " !! Unable to scan class db");
CloseDB(dbp);
DeleteItemList(list);
return;
}
memset(&entry, 0, sizeof(entry));
while (NextDB(dbp, dbcp, &key, &ksize, &stored, &vsize))
{
time_t then;
char eventname[CF_BUFSIZE];
memset(eventname, 0, CF_BUFSIZE);
strncpy(eventname, (char *) key, ksize);
if (stored != NULL)
{
memcpy(&entry, stored, sizeof(entry));
then = entry.t;
lastseen = now - then;
if (lastseen > lsea)
{
CfDebug("Class usage record %s expired\n", eventname);
DBCursorDeleteEntry(dbcp);
}
else if (!IsItemIn(list, eventname))
{
newe.t = then;
newe.Q = QAverage(entry.Q, 0, 0.5);
if (newe.Q.expect <= 0.0001)
{
CfDebug("Deleting class %s as %lf is zero\n", eventname, newe.Q.expect);
DBCursorDeleteEntry(dbcp);
}
else
{
CfDebug("Downgrading class %s from %lf to %lf\n", eventname, entry.Q.expect, newe.Q.expect);
DBCursorWriteEntry(dbcp, &newe, sizeof(newe));
}
}
}
}
DeleteDBCursor(dbp, dbcp);
}
CloseDB(dbp);
DeleteItemList(list);
}
static void UpdateLastSawHost(char *rkey, char *ipaddress)
{
CF_DB *dbp = NULL;
KeyHostSeen q, newq;
double lastseen, delta2;
time_t now = time(NULL);
char timebuf[26];
if (!OpenDB(&dbp, dbid_lastseen))
{
CfOut(cf_inform, "", " !! Unable to open last seen db");
return;
}
if (ReadDB(dbp, rkey, &q, sizeof(q)))
{
lastseen = (double) now - q.Q.q;
if (q.Q.q <= 0)
{
lastseen = 300;
q.Q = QDefinite(0.0);
}
newq.Q.q = (double) now;
newq.Q.dq = newq.Q.q - q.Q.q;
newq.Q.expect = GAverage(lastseen, q.Q.expect, 0.4);
delta2 = (lastseen - q.Q.expect) * (lastseen - q.Q.expect);
newq.Q.var = GAverage(delta2, q.Q.var, 0.4);
strncpy(newq.address, ipaddress, CF_ADDRSIZE - 1);
}
else
{
lastseen = 0.0;
newq.Q.q = (double) now;
newq.Q.dq = 0;
newq.Q.expect = 0.0;
newq.Q.var = 0.0;
strncpy(newq.address, ipaddress, CF_ADDRSIZE - 1);
}
if (strcmp(rkey + 1, PUBKEY_DIGEST) == 0)
{
Item *ip;
int match = false;
for (ip = IPADDRESSES; ip != NULL; ip = ip->next)
{
if (strcmp(VIPADDRESS, ip->name) == 0)
{
match = true;
break;
}
if (strcmp(ipaddress, ip->name) == 0)
{
match = true;
break;
}
}
if (!match)
{
CfOut(cf_verbose, "", " ! Not updating last seen, as this appears to be a host with a duplicate key");
CloseDB(dbp);
return;
}
}
CfOut(cf_verbose, "", " -> Last saw %s (alias %s) at %s\n", rkey, ipaddress, cf_strtimestamp_local(now, timebuf));
PurgeMultipleIPReferences(dbp, rkey, ipaddress);
WriteDB(dbp, rkey, &newq, sizeof(newq));
CloseDB(dbp);
}