callgraph/capture-connections.lua

79 lines
1.8 KiB
Lua

description = "description";
short_description = "desc";
category = "Net";
args = {}
require "common"
local fields = {}
function on_init()
local mapping = {
isread = "evt.is_io_read",
buflen = "evt.buflen",
--proc = "proc.name",
--pid = "proc.pid",
--tid = "thread.tid",
--container = "container.name",
sip = "fd.sip",
sport = "fd.sport",
cip = "fd.cip",
cport = "fd.cport",
evt_type = "evt.type",
proto = "fd.l4proto",
lip = "fd.lip",
}
for k,v in pairs(mapping) do
fields[k] = chisel.request_field(v)
end
--key_fields = {fields.container, fields.proc, fields.pid, fields.tid, fields.proto, fields.sip, fields.sport, fields.cip, fields.cport}
key_fields = {fields.proto, fields.sip, fields.sport, fields.cip, fields.cport}
sysdig.set_snaplen(0)
chisel.set_filter("evt.is_io=true and fd.rip exists and container.name!=host")
return true
end
local stats = {}
-- localize function to save scope lookups
local table_concat = table.concat
local evt_field = evt.field
local ipairs = ipairs
function on_event()
-- only capture connections of servers
local fields = fields
local sip = evt_field(fields.sip)
if not (evt_field(fields.lip) == sip or evt_field(fields.rip) == sip) then
return true
end
local t = { }
for k,v in ipairs(key_fields) do
t[k] = tostring(evt_field(v))
end
if evt.field(fields.isread) then
t[#t+1] = "rx"
else
t[#t+1] = "tx"
end
local key = table_concat(t, "\t")
stats[key] = (stats[key] or 0) + (evt_field(fields.buflen) or 0)
return true
end
function on_capture_start()
hostname = sysdig.get_machine_info().hostname
return true
end
function on_capture_end()
for k, v in pairs(stats) do
io.write(k, "\t", v, "\n")
end
end