Comments (2)
cameronkerrnz
commented on June 23, 2024
We would need to introduce another callback handler to notify the export modules of such an event.
This should be easy to do, the only careful bit being the naming. I'll call these 'notification' handlers, and make them type-safe. I suppose there would be scope for something more printf-like (or mlogf-like)... but that could be a more general handler; it needed at all; and since that is not clear, I won't bother with that at this time.
I'll call the handlers with the 'export_notify_no_template_for_set', and it will take the template ID (ie. setid in ipfix_parse_msg).
Possibly such a handler might try and do something with the data to prevent against data-loss, so we should pass in sufficient information to enable it to do so. Comparing with the export_drecord handler,
If we look at some code from ipfix_parse_msg, we see
else if ( setid >255 )
{
/** get template
*/
ipfixt_node_t *t;
if ( (t=_get_ipfixt( s->templates, setid )) ==NULL ) {
mlogf( 0, "[%s] no template for %d, skip data set\n",
func, setid );
nread += setlen;
err_flag = 1;
}
else {
for ( e=g_exporter; e!=NULL; e=e->next ) {
if ( e->elem->export_dset )
(void) e->elem->export_dset( t, buf+nread, setlen,
e->elem->data );
}
/** read data records
*/
for ( offset=nread, bytesleft=setlen; bytesleft>4; ) {
if ( ipfix_decode_datarecord( t, buf+offset, bytesleft,
&bytes, &data ) <0 ) {
mlogf( 0, "[%s] set%d: decode record failed: %s\n",
func, i+1, strerror(errno) );
goto errend;
}
(void) ipfix_export_datarecord( s, t, &data, input );
bytesleft -= bytes;
offset += bytes;
}
if ( bytesleft ) {
mlogf( 3, "[%s] set%d: skip %d bytes padding\n",
func, i+1, bytesleft );
}
nread += setlen;
}
}
So remembering that this callback would imply that a set or records is ignored, then we need to model this somewhat on export_dset, and not export_drecord. Below are the declarations for the export_dset callback, and the callback we are creating.
int (*export_dset)(ipfixt_node_t*,const uint8_t*,size_t,void*);
int (*export_notify_no_template_for_set)(int setid,ipfixs_node_t*,const uint8_t*,size_t,void*);
The ipfixs_note_t* argument is valid only when the template is found, so we don't need that. The uint8_t* and size_t will be the undecoded set contents (ie. setlen bytes from buf+nread (same as export_dset) and the final is the arg argument as commonly found in the callbacks. In short, it becomes the same as export_dset, except we substitute the unusable ipfix_node_t* argument for the template ID number. Adding the ipfixs_node_t* argument allows us to include the identity (IP) of the exporter.
from libipfix.
cameronkerrnz
commented on June 23, 2024
Example message that is currently emitted. Note that it also has the exporter's IP, to help answer the obvious question "which machines am I missing templates for?"
{ "ipfix_collector_notice":"no_template_for_set", "ipfix_template_id":"258", "ipfix_exporter_ip":"10.1.1.1", "summary":"no template for 258, skip data set", "set_bytes":""00 13 73 ... 00 01 00 01 00 01 00""}
from libipfix.
Related Issues (20)
- Allow --jsonfile to be given '-' as an argument to mean stdout
- Listen for SIGHUP to reopen JSON datafile (for log rotation) HOT 1
- Create deployment documentation for integrating this with Elasticsearch etc. HOT 1
- Create an RPM for this package
- Log IP address of device sending the messages HOT 2
- Write a sample init script (for RHEL6) HOT 1
- Be able to specify custom static attributes to add to each message.
- Be able to run the collector as a deamon HOT 1
- DB table ipfix_messages is still being added to per-message with JSON output HOT 3
- Completely divorce the JSON emitter from MySQL, making a separate collector
- Create a mapping to give templates a useful name
- Report template flush events via JSON
- Create a mechanism to persist template definitions based on a whitelist. HOT 5
- Omit JSON attributes if value is an empty string HOT 5
- Emit a timestamp for each log message; don't rely on others. HOT 3
- ipfix_print_newmsg outputs faulty timestamp
- Make inclusion of dropped bytes for missing-template nofitications a command-line option HOT 1
- Send JSON output to stdout rather than to a file HOT 2
- "record2: msg too short" for Netscaler Appflow record 258 (Netscaler version 11 onwards?) HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from libipfix.