Feature #5816
openException policy stats counters
Description
Exception policies support applying a default action to packets in various exceptional cases, but don't have related stats counters. I am interested in counters for each of the exception policies counting the number of times they are applied. The visibility these counters provide is important for understanding the source of these drops since they can not be reported in things like alert logs.
I think a single counter per exception policy counting the number of times it is invoked would be enough for the visibility we need. Importantly, the counters should be enabled for all values of the exception policy (including "ignore") so that it's possible to know the impact they will have before they are enabled.
Updated by Jamie Lavigne 8 months ago
Jamie Lavigne wrote:
Importantly, the counters should be enabled for all values of the exception policy (including "ignore") so that it's possible to know the impact they will have before they are enabled.
I suppose alternately an exception policy value like "count" would work for this.
Updated by Juliana Fajardini Reichow 8 months ago
- Related to Feature #5828: exceptions: add stats added
Updated by Juliana Fajardini Reichow 7 months ago
- Assignee changed from OISF Dev to Juliana Fajardini Reichow
Updated by Juliana Fajardini Reichow 7 months ago
- Target version changed from TBD to 7.0.0-rc2
Updated by Juliana Fajardini Reichow 7 months ago
- Status changed from New to In Progress
Jamie Lavigne wrote in #note-1:
Jamie Lavigne wrote:
Importantly, the counters should be enabled for all values of the exception policy (including "ignore") so that it's possible to know the impact they will have before they are enabled.
I suppose alternately an exception policy value like "count" would work for this.
Do you mean like besides `pass-flow`, `pass-packet`, `bypass`, `reject`, `drop-flow`, `drop-packet`, and `ignore`, there could also be a `count` value?
I'm thinking that the counters could be enabled, maybe under the Exception-policy master-switch.
I was thinking that the `exception-policy` stats counter could look something like:
{ "exception_policy":{ "totals":{ "drop-flow":4, "drop-pkt":4, "pass-flow":3, "pass-pkt":0, "bypass":0, "ignore":15 }, "stream":{ "memcap":{ "policy":"drop-flow", "counter":0 }, "midstream":{ "policy":"pass-flow", "counter":3 }, "reassembly_memcap":{ "policy":"ignore", "counter":8 } }, "app_layer_error":{ "policy":"drop-pkt", "counter":4 }, "defrag_memcap":{ "policy":"drop-flow", "counter":4 }, "flow_memcap":{ "policy":"ignore", "counter":7 } } }
Would this be: useful? Or too verbose?
Updated by Jamie Lavigne 7 months ago
It would work - I'm not sure we would need the policy values like "policy":"drop-flow" echoed in the stats output though, as we will know the configured values of those already. I assume that the _delta counters will be supported for these as well?
Updated by Juliana Fajardini Reichow 7 months ago
Jamie Lavigne wrote in #note-6:
It would work - I'm not sure we would need the policy values like "policy":"drop-flow" echoed in the stats output though, as we will know the configured values of those already. I assume that the _delta counters will be supported for these as well?
Thanks for the quick feedback :)
About delta counters: At the moment, I don't see a reason why we can't have them. Thanks for the reminder!
Updated by Juliana Fajardini Reichow 5 months ago
Current PR under review/discussion: https://github.com/OISF/suricata/pull/8735
Updated by Juliana Fajardini Reichow 4 months ago
To add: if exception policy is `ignore`, don't output to log events.
Updated by Juliana Fajardini Reichow 4 months ago
- Related to deleted (Feature #5828: exceptions: add stats)
Updated by Juliana Fajardini Reichow 4 months ago
- Has duplicate Feature #5828: exceptions: add stats added
Updated by Juliana Fajardini Reichow 4 months ago
- Target version changed from 7.0.0-rc2 to 8.0.0-beta1
Updated by Victor Julien 2 months ago
- Related to Feature #6230: stats: add drop reason counters added