51 #define MODULE_NAME "JsonStatsLog"
83 json_t *jdata = json_object();
91 json_object_set_new(jdata,
"last_reload", json_string(timebuf));
98 json_object_set_new(jdata,
"rules_loaded",
100 json_object_set_new(jdata,
"rules_failed",
102 json_object_set_new(jdata,
"rules_skipped", json_integer(sig_stat->
skipped_sigs_total));
117 json_t *js_tenant_list = json_array();
118 json_t *js_tenant = NULL;
120 if (js_tenant_list == NULL) {
125 js_tenant = json_object();
126 if (js_tenant == NULL) {
129 json_object_set_new(js_tenant,
"id", json_integer(list->
tenant_id));
131 json_t *js_stats = EngineStats2Json(list, output);
132 if (js_stats == NULL) {
135 json_object_update(js_tenant, js_stats);
136 json_array_append_new(js_tenant_list, js_tenant);
137 json_decref(js_stats);
142 *jdata = js_tenant_list;
146 json_object_clear(js_tenant);
147 json_decref(js_tenant);
150 json_object_clear(js_tenant_list);
151 json_decref(js_tenant_list);
157 json_object_set_new(*jdata,
"message", json_string(
"Unable to get info"));
169 static json_t *OutputStats2Json(json_t *js,
const char *key)
173 const char *dot = strchr(key,
'.');
176 if (strlen(dot) > 2) {
177 if (*(dot + 1) ==
'.' && *(dot + 2) !=
'\0')
178 dot = strchr(dot + 2,
'.');
181 size_t predot_len = (dot - key) + 1;
185 iter = json_object_iter_at(js, s);
186 const char *s2 = strchr(dot+1,
'.');
188 json_t *value = json_object_iter_value(iter);
190 value = json_object();
192 if (!strncmp(s,
"detect", 6)) {
193 json_t *js_engine = NULL;
197 json_object_set_new(value,
"engines", js_engine);
200 json_object_set_new(js, s, value);
203 return OutputStats2Json(value, &key[dot-key+1]);
213 const char delta_suffix[] =
"_delta";
215 gettimeofday(&tval, NULL);
217 json_t *js_stats = json_object();
223 double up_time_d = difftime(tval.tv_sec, st->
start_time);
224 json_object_set_new(js_stats,
"uptime",
225 json_integer((
int)up_time_d));
229 for (u = 0; u < st->
nstats; u++) {
236 json_t *js_type = NULL;
246 js_type = OutputStats2Json(js_stats, st->
stats[u].
name);
248 if (js_type != NULL) {
249 json_object_set_new(js_type, stat_name, json_integer(st->
stats[u].
value));
253 char deltaname[strlen(stat_name) + strlen(delta_suffix) + 2];
254 snprintf(deltaname,
sizeof(deltaname),
"%s%s", stat_name, delta_suffix);
255 json_object_set_new(js_type, deltaname,
265 json_t *threads = json_object();
267 json_decref(js_stats);
271 for (x = 0; x < st->
ntstats; x++) {
273 const char *tm_name = NULL;
274 json_t *thread = NULL;
286 if (tm_name == NULL) {
290 thread = json_object();
292 json_decref(js_stats);
293 json_decref(threads);
301 json_t *js_type = NULL;
307 js_type = OutputStats2Json(thread, st->
tstats[u].
name);
310 if (js_type != NULL) {
311 json_object_set_new(js_type, stat_name, json_integer(st->
tstats[u].
value));
314 char deltaname[strlen(stat_name) + strlen(delta_suffix) + 2];
315 snprintf(deltaname,
sizeof(deltaname),
"%s%s", stat_name, delta_suffix);
316 json_object_set_new(js_type, deltaname,
321 if (tm_name != NULL) {
323 json_object_set_new(threads, tm_name, thread);
326 json_object_set_new(js_stats,
"threads", threads);
337 gettimeofday(&tval, NULL);
339 json_t *js = json_object();
344 json_object_set_new(js,
"timestamp", json_string(timebuf));
345 json_object_set_new(js,
"event_type", json_string(
"stats"));
348 if (js_stats == NULL) {
353 json_object_set_new(js,
"stats", js_stats);
356 MemBufferReset(aft->
buffer);
358 json_object_clear(js_stats);
359 json_object_del(js,
"stats");
360 json_object_clear(js);
366 static TmEcode JsonStatsLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
374 SCLogDebug(
"Error getting context for EveLogStats. \"initdata\" argument NULL");
379 if (aft->
buffer == NULL) {
395 if (aft->
buffer != NULL) {
418 static void OutputStatsLogDeinitSub(
OutputCtx *output_ctx)
431 SCLogError(
"eve.stats: stats are disabled globally: set stats.enabled to true. "
432 "See %s/configuration/suricata-yaml.html#stats",
444 "all decoder events correctly. See ticket #2225. Set a prefix in "
445 "stats.decoder-events-prefix.");
455 SCLogDebug(
"totals %s threads %s deltas %s", totals, threads, deltas);
460 SCLogError(
"Cannot disable both totals and threads in stats logging");
485 SCLogDebug(
"Preparing file context for stats submodule logger");
494 output_ctx->
data = stats_ctx;
495 output_ctx->
DeInit = OutputStatsLogDeinitSub;
497 result.
ctx = output_ctx;
505 OutputStatsLogInitSub, JsonStatsLogger, JsonStatsLogThreadInit,
506 JsonStatsLogThreadDeinit);