callgraph/capture-connections.lua

description = "description";
short_description = "desc";
category = "Net";

args = {}

require "common"

local fields = {}
function on_init()
  local mapping = {
    isread    = "evt.is_io_read",
    buflen    = "evt.buflen",
    --proc      = "proc.name",
    --pid       = "proc.pid",
    --tid       = "thread.tid",
    --container = "container.name",
    sip       = "fd.sip",
    sport     = "fd.sport",
    cip       = "fd.cip",
    cport     = "fd.cport",
    evt_type  = "evt.type",
    proto     = "fd.l4proto",
    lip       = "fd.lip",
  }
  for k,v in pairs(mapping) do
    fields[k] = chisel.request_field(v)
  end
  --key_fields = {fields.container, fields.proc, fields.pid, fields.tid, fields.proto, fields.sip, fields.sport, fields.cip, fields.cport}
  key_fields = {fields.proto, fields.sip, fields.sport, fields.cip, fields.cport}

  sysdig.set_snaplen(0)
  chisel.set_filter("evt.is_io=true and fd.rip exists and container.name!=host")
  return true
end

local stats = {}
-- localize function to save scope lookups
local table_concat = table.concat
local evt_field = evt.field
local ipairs = ipairs

function on_event()
  -- only capture connections of servers
  local fields = fields
  local sip = evt_field(fields.sip)

  if not (evt_field(fields.lip) == sip or evt_field(fields.rip) == sip) then
    return true
  end

  local t = { }
  for k,v in ipairs(key_fields) do
    t[k] = tostring(evt_field(v))
  end

  if evt.field(fields.isread) then
    t[#t+1] = "rx"
  else
    t[#t+1] = "tx"
  end
  local key = table_concat(t, "\t")

  stats[key] = (stats[key] or 0) + (evt_field(fields.buflen) or 0)

  return true
end

function on_capture_start()
  hostname = sysdig.get_machine_info().hostname
  return true
end

function on_capture_end()
  for k, v in pairs(stats) do
    io.write(k, "\t", v, "\n")
  end
end