sink

Documentation

Index

• type Dispatch
  • func NewDispatch(sinkQueueSize int) (*Dispatch, error)
  • func (d *Dispatch) NotifyAgentEvent(typ int, message interface{})
  • func (d *Dispatch) NotifyPerfEvent(data []byte, cpu int)
  • func (d *Dispatch) NotifyPerfEventLost(numLostEvents uint64, cpu int)
  • func (d *Dispatch) StartSink(ctx context.Context, p PcapSink) (*Handle, error)
• type Handle
  • func (h *Handle) Err() error
  • func (h *Handle) Stats() Statistics
  • func (h *Handle) Stop()
• type PcapSink
• type Statistics
• type StopConditions

Types

type Dispatch

type Dispatch struct {
	// contains filtered or unexported fields
}

Dispatch implements consumer.MonitorConsumer and dispatches incoming recorder captures to registered sinks based on their rule ID.

func NewDispatch

func NewDispatch(sinkQueueSize int) (*Dispatch, error)

NewDispatch creates a new sink dispatcher. Each registered sink may have a queue of up to sinkQueueSize pending captures.

func (*Dispatch) NotifyAgentEvent

func (d *Dispatch) NotifyAgentEvent(typ int, message interface{})

NotifyAgentEvent implements consumer.MonitorConsumer

func (*Dispatch) NotifyPerfEvent

func (d *Dispatch) NotifyPerfEvent(data []byte, cpu int)

NotifyPerfEvent implements consumer.MonitorConsumer

func (*Dispatch) NotifyPerfEventLost

func (d *Dispatch) NotifyPerfEventLost(numLostEvents uint64, cpu int)

NotifyPerfEventLost implements consumer.MonitorConsumer

func (*Dispatch) StartSink

func (d *Dispatch) StartSink(ctx context.Context, p PcapSink) (*Handle, error)

StartSink starts a new sink for the pcap sink configuration p. Any captures with a matching rule ID will be forwarded to the pcap sink p.Writer. The provided p.Header is written to the pcap sink during initialization. The sink is unregistered automatically when it stops. A sink is stopped for one of the following four reasons. In all cases, Handle.Done will be closed.

• Explicitly via Handle.Stop (Handle.Err() == nil)
• When one of the p.StopCondition is hit (Handle.Err() == nil)
• When the context ctx is cancelled (Handle.Err() != nil)
• When an error occurred (Handle.Err() != nil)

type Handle

type Handle struct {
	// StatsUpdated is a channel on which receives a new empty message whenever
	// there was an update to the sink statistics.
	StatsUpdated <-chan struct{}
	// Done is a channel which is closed when this sink has been shut down.
	Done <-chan struct{}
	// contains filtered or unexported fields
}

Handle enables the owner to subscribe to sink statistics

func (*Handle) Err

func (h *Handle) Err() error

Err returns the last error on this sink once the channel has stopped

func (*Handle) Stats

func (h *Handle) Stats() Statistics

Stats returns the latest statistics for this sink.

func (*Handle) Stop

func (h *Handle) Stop()

Stop requests the underlying sink to stop. Handle.Done will be closed once the sink has drained its queue and stopped.

type PcapSink

type PcapSink struct {
	RuleID        uint16
	Header        pcap.Header
	Writer        pcap.RecordWriter
	StopCondition StopConditions
}

PcapSink defines the parameters of a sink which writes to a pcap.RecordWriter

type Statistics

type Statistics struct {
	PacketsWritten uint64
	BytesWritten   uint64
	PacketsLost    uint64
	BytesLost      uint64
}

Statistics contains the statistics for a pcap sink

type StopConditions

type StopConditions struct {
	PacketsCaptured uint64
	BytesCaptured   uint64
	DurationElapsed time.Duration
}

StopConditions defines a set of values which cause the sink to stop recording if any of them are hit. Zero-valued conditions are ignored.