void server_stats(SERVER_STATS *ssp, int dumpall)
{
unsigned total, fail, success, nodes, anr, overhead, memcap;
memcap = overhead = nodes = anr = total = fail = success = 0;
if(ssp && ssp->ipv4_table)
{
total = sfxhash_find_total(ssp->ipv4_table);
fail = sfxhash_find_fail(ssp->ipv4_table);
success = sfxhash_find_success(ssp->ipv4_table);
nodes = sfxhash_count(ssp->ipv4_table);
anr = sfxhash_anr_count(ssp->ipv4_table);
memcap = server_stats_memcap(ssp);
overhead = server_stats_overhead_bytes(ssp);
}
flow_printf(",-----[SERVER STATS]------------\n");
flow_printf(" Memcap: %u Overhead Bytes: %u\n",
memcap, overhead);
flow_printf(" Finds: %u (Sucessful: %u(%%%lf) Unsucessful: %u(%%%lf))\n",
total,
success, calc_percent(success,total),
fail, calc_percent(fail,total));
flow_printf(" Nodes: %u\n", nodes);
flow_printf(" Recovered Nodes: %u\n", anr);
flow_printf("`-------------------------------\n");
if(dumpall)
server_stats_dump(ssp);
}
/* Prune file entries based on LRU
*/
static int pruneFileCache(FileCache *fileCache, FileEntry *file)
{
SFXHASH_NODE *lru_node = NULL;
int pruned = 0;
int mustdie = fileCache->cleanup_files;
while (pruned < mustdie &&
(sfxhash_count(fileCache->hashTable) > 0))
{
if ((lru_node = sfxhash_lru_node(fileCache->hashTable)) != NULL)
{
if (lru_node->data == file)
break;
if (sfxhash_free_node(fileCache->hashTable, lru_node) != SFXHASH_OK)
{
LogMessage("WARNING: failed to remove file entry from hash.\n");
}
pruned++;
}
}
fileCache->status.prunes += pruned;
return pruned;
}
int CleanHashTable(SFXHASH *table, u_int32_t thetime, Session *save_me, int memCheck)
{
Session *idx;
u_int32_t pruned = 0;
u_int32_t timeout = s4data.timeout;
if (thetime != 0)
{
char got_one;
idx = (Session *) sfxhash_lru(table);
if(idx == NULL)
{
return 0;
}
do
{
got_one = 0;
if(idx == save_me)
{
SFXHASH_NODE *lastNode = sfxhash_lru_node(table);
sfxhash_gmovetofront(table, lastNode);
lastNode = sfxhash_lru_node(table);
if ((lastNode) && (lastNode->data != idx))
{
idx = (Session *)lastNode->data;
continue;
}
else
{
return pruned;
}
}
timeout = s4data.timeout;
if(idx->drop_traffic)
{
/* If we're dropping traffic on the session, keep
* it around longer. */
timeout = s4data.timeout * 2;
}
if((idx->last_session_time+timeout) < thetime)
{
Session *savidx = idx;
if(sfxhash_count(table) > 1)
{
DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "pruning stale session\n"););
DeleteSession(savidx, thetime, SESSION_CLOSED_TIMEDOUT);
idx = (Session *) sfxhash_lru(table);
pruned++;
got_one = 1;
}
int PruneLWSessionCache(Stream5SessionCache *sessionCache,
uint32_t thetime,
Stream5LWSession *save_me,
int memCheck)
{
Stream5LWSession *idx;
uint32_t pruned = 0;
if (thetime != 0)
{
/* Pruning, look for sessions that have time'd out */
char got_one;
idx = (Stream5LWSession *) sfxhash_lru(sessionCache->hashTable);
if(idx == NULL)
{
return 0;
}
do
{
got_one = 0;
if(idx == save_me)
{
SFXHASH_NODE *lastNode = sfxhash_lru_node(sessionCache->hashTable);
sfxhash_gmovetofront(sessionCache->hashTable, lastNode);
lastNode = sfxhash_lru_node(sessionCache->hashTable);
if ((lastNode) && (lastNode->data != idx))
{
idx = (Stream5LWSession *)lastNode->data;
continue;
}
else
{
sessionCache->prunes += pruned;
return pruned;
}
}
if((idx->last_data_seen+sessionCache->timeout) < thetime)
{
Stream5LWSession *savidx = idx;
if(sfxhash_count(sessionCache->hashTable) > 1)
{
DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "pruning stale session\n"););
savidx->session_flags |= SSNFLAG_TIMEDOUT;
DeleteLWSession(sessionCache, savidx, "stale/timeout");
idx = (Stream5LWSession *) sfxhash_lru(sessionCache->hashTable);
pruned++;
got_one = 1;
}
void scoreboard_stats(SCOREBOARD *sbp, int dumpall)
{
unsigned total = sfxhash_find_total(sbp->ipv4_table);
unsigned fail = sfxhash_find_fail(sbp->ipv4_table);
unsigned success = sfxhash_find_success(sbp->ipv4_table);
flow_printf("SCOREBOARD_STATS: %s\n", (char *) sbp->description);
flow_printf(" Memcap: %u Overhead Bytes: %u\n",
sbp->ipv4_table->mc.memcap,
sfxhash_overhead_bytes(sbp->ipv4_table));
flow_printf(" Finds: %u (Sucessful: %u(%%%f) Unsucessful: %u(%%%f))\n",
total,
success, calc_percent(success,total),
fail, calc_percent(fail,total));
flow_printf(" Nodes: %u\n", sfxhash_count(sbp->ipv4_table));
flow_printf(" Recovered Nodes: %u\n", sfxhash_anr_count(sbp->ipv4_table));
flow_printf(" Score Entry Size:: %u\n", sizeof(SCORE_ENTRY));
if(dumpall)
scoreboard_dump(sbp);
}
void flowcache_stats(FILE *stream, FLOWCACHE *flowcachep)
{
int could_hold;
int i;
time_t low_time = 0, high_time = 0, diff_time = 0;
int diff_hours = 0, diff_min = 0, diff_sec = 0;
int diff_blocks = 0;
FLOW *flow_mrup, *flow_lrup;
#ifdef INDEPTH_DEBUG
printf("table max depth: %u\n",
sfxhash_maxdepth(flowcachep->ipv4_table));
#endif /* INDEPTH_DEBUG */
if((flowcache_mru(flowcachep, &flow_mrup) == FLOW_SUCCESS) &&
(flowcache_lru(flowcachep, &flow_lrup) == FLOW_SUCCESS))
{
low_time = flow_lrup->stats.last_packet;
high_time = flow_mrup->stats.last_packet;
diff_time = high_time - low_time;
diff_hours = diff_time / 3600;
diff_min = (diff_time - (3600 * diff_hours)) / 60;
diff_sec = diff_time % 60;
}
diff_blocks = flowcachep->ipv4_table->mc.nblocks -
flowcache_overhead_blocks(flowcachep);
//could_hold = flowcachep->ipv4_table->mc.memcap /
// (sizeof(FLOW) + sizeof(FLOWKEY) + sizeof(SFXHASH_NODE));
/* this is a bad calculation -- should clean this up */
if(diff_blocks > 0)
{
could_hold = (flowcachep->ipv4_table->mc.memused - flowcache_overhead_bytes(flowcachep)) / diff_blocks;
could_hold = flowcachep->ipv4_table->mc.memcap / could_hold;
}
else
{
could_hold = diff_blocks;
}
flow_printf(",----[ FLOWCACHE STATS ]----------\n");
flow_printf("Memcap: %u Overhead Bytes %u used(%%%f)/blocks (%u/%u)\nOverhead blocks: %u Could Hold: (%u)\n",
flowcachep->ipv4_table->mc.memcap,
flowcache_overhead_bytes(flowcachep),
calc_percent(flowcachep->ipv4_table->mc.memused,
flowcachep->ipv4_table->mc.memcap),
flowcachep->ipv4_table->mc.memused,
flowcachep->ipv4_table->mc.nblocks,
flowcache_overhead_blocks(flowcachep),
could_hold);
flow_printf("IPV4 count: %u frees: %u\nlow_time: %u, high_time: %u,"
" diff: %dh:%02d:%02ds\n",
sfxhash_count(flowcachep->ipv4_table),
sfxhash_anr_count(flowcachep->ipv4_table),
(unsigned) low_time,
(unsigned) high_time,
diff_hours,diff_min,diff_sec);
flow_printf(" finds: " STDu64 " reversed: " STDu64 "(%%%f) \n find_success: " STDu64 " "
"find_fail: " STDu64 "\npercent_success: (%%%f) new_flows: " STDu64 "\n",
flowcachep->total.find_ops,
flowcachep->total.reversed_ops,
calc_percent64(flowcachep->total.reversed_ops,
flowcachep->total.find_ops),
flowcachep->total.find_success,
flowcachep->total.find_fail,
calc_percent64(flowcachep->total.find_success,
flowcachep->total.find_ops),
flowcachep->total.new_flows);
for(i=0;i<256;i++)
{
if(flowcachep->per_proto[i].find_ops > 0)
{
flow_printf(" Protocol: %d (%%%f)\n"
" finds: " STDu64 "\n"
" reversed: " STDu64 "(%%%f)\n"
" find_success: " STDu64 "\n"
" find_fail: " STDu64 "\n"
" percent_success: (%%%f)\n"
" new_flows: " STDu64 "\n",
i,
calc_percent64(flowcachep->per_proto[i].find_ops,
flowcachep->total.find_ops),
flowcachep->per_proto[i].find_ops,
flowcachep->per_proto[i].reversed_ops,
calc_percent64(flowcachep->per_proto[i].reversed_ops,
flowcachep->per_proto[i].find_ops),
flowcachep->per_proto[i].find_success,
flowcachep->per_proto[i].find_fail,
calc_percent64(flowcachep->per_proto[i].find_success,
flowcachep->per_proto[i].find_ops),
flowcachep->per_proto[i].new_flows);
}
}
}
