report.c

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

    printf("\tUnmatched response\n");

  if (state & NS_RR_TRUNC)
    printf("\tRR truncated\n");

  if (bad)
    return;

  if (state & NS_RRS_FOLLOW)
    {
      char *cp = nfp->rrbuf;
      //nsbuf(np);

      if (state & NS_NONPRINT)
	printf("\tRR contains non-prints\n");

      while (*cp)
	{
	  switch (*cp++)
	    {
	    case RR_NONE:
	      break;
	    case RR_NOT_INET:
	      printf("\tRR class ");
	      printf("%s", tok2str(class2str, "(Class %d)", *((unsigned short *)cp)));
	      cp +=2;
	      printf("\n");
	      break;
	    case RR_OTHER_TYPE:
	      printf("\tRR type ");
	      printf("%s", tok2str(type2str, "(Type %d)", *((unsigned short *)cp)));
	      cp +=2;
	      printf("\n");
	      break;
	    case RR_IPADDR:
	      printf("\t");
	      cp += printf("%s", cp) + 1;
	      printf("  ->  %s\n", intoa(*((unsigned int *)cp)));
	      cp += 4;
	      break;
	    case RR_CNAME:
	      printf("\t");
	      cp += printf("%s", cp) + 1;
	      printf("  ->  ");
	      cp += printf("%s", cp) + 1;
	      printf ("\n");
	      break;
	    case RR_REQ:
	      printf("\t(");
	      cp += printf("%s", cp) + 1;
	      printf(")\n");
	      break;
	    default:
	      fprintf(stderr, "report_ns - unknown rr type %x\n", *(cp - 1));
	      exit (1);
	      break;
	    }
	}
    }
	  

  

  return;
}

/*****************************************************************************/

/*
 * Report icmp record 
 */

void 
report_icmp(struct icmp_rec *ip, int indx)
{
  REP(stdout, " #%u %s ICMP ", indx, us_clock_ts_string(ip->tm));
  REP(stdout, "%s %s\n", icmp_type_string(ip->type), 
      icmp_code_string(ip->code));
  REP(stdout, "%s:%d <> ", get_hname((char *)&ip->src_addr), 
      ntohs(ip->src_port));
  REP(stdout, "%s:%d\n", get_hname((char *)&ip->dst_addr), 
      ntohs(ip->dst_port));

  return;
}

/*****************************************************************************/

/*
 *  Report nic fail/drop record
 */

void 
report_nic_fail(net_device_stats_t *rec, int indx)
{
  REP(stdout, " #%u XXX %s nic %s fail\n", indx, ts_string(&rec->ts), 
      rec->if_name);
  if (rec->rx_errors)
    REP(stdout, "\t%u rx errors\n", rec->rx_errors);
  if (rec->rx_dropped)
    REP(stdout, "\t%u rx drops\n", rec->rx_dropped);
  if (rec->rx_length)
    REP(stdout, "\t%u rx length errors\n", rec->rx_length);
  if (rec->rx_over)
    REP(stdout, "\t%u rx over runs\n", rec->rx_over);
  if (rec->rx_crc)
    REP(stdout, "\t%u rx crc errors\n", rec->rx_crc);
  if (rec->rx_frame)
    REP(stdout, "\t%u rx frame errors\n", rec->rx_frame);
  if (rec->rx_fifo)
    REP(stdout, "\t%u rx fifo errors\n", rec->rx_fifo);
  if (rec->rx_missed)
    REP(stdout, "\t%u rx missed\n", rec->rx_missed);

  REP(stdout, "\n");
  

  return;
}

/*****************************************************************************/

/*
 *  Report sk_buff alloc fail record
 */

void 
report_buf_alloc_fail(sk_buff_alloc_fail_rec_t *rec, int indx)
{
  REP(stdout, " #%u XXX %s sk_buff %d alloc fails\n\n", indx, ts_string(&rec->ts), 
      rec->nfails);

  return;
}

/*****************************************************************************/

/* 
 * Report accounting period report 
 */

void 
report_period_report(period_report_t *prep, int indx, counters_t *ctrs, int why)
{
  
  if (why == REC_WIRE_PERIOD_REPORT)
    REP(stdout, "Wire driven:-\n");
  REP(stdout, " #%u %s\n", indx, time_string(&prep->ts));
  if (prep->buf_alloc_fails)
    REP(stdout, " XXX %u sk_buff alloc fails XXX\n", prep->buf_alloc_fails);
  if (prep->nic_errs)
    REP(stdout, " XXX %d nic fails XXX\n", prep->nic_errs);
  REP(stdout, " recvd: tous %uin-%uout=%u : frus %uin-%uout=%u\n",
      prep->tous_in, prep->tous_out, prep->tous_in - prep->tous_out,
      prep->frus_in, prep->frus_out, prep->frus_in - prep->frus_out);
  REP(stdout, " WIRE %.3f Mbs, %d pkts\n", prep->wire_mbs, prep->wire_pkts);
  REP(stdout, " TCP: %.3f Mbs, %d pkts ", prep->tcp_mbs, prep->tcp_pkts);
  REP(stdout, " UDP: %.3f Mbs, %d pkts ", prep->udp_mbs, prep->udp_pkts);
  REP(stdout, " HTTP: %.3f Mbs, %d pkts\n", prep->http_mbs, prep->http_pkts);
  REP(stdout, " Holding %u buffers lag %u us\n", prep->buff_held, 
	  prep->lag);
  REP(stdout, " Max fetch interval %u\n", prep->max_fetch_interval);
  REP(stdout, " Parsed %u bytes HTML\n", prep->html_parsed);
  REP(stdout, " report - %3.0f%% (%u) of cycle (%u records %u total)\n",  
      ((float)prep->rep_bytes_written*100)/ctrs->fh.rep_fsz,
      prep->rep_bytes_written,
      prep->nrecords, 
      prep->nrecords_tot + prep->nrecords);
  REP(stdout, " dump - %3.0f%% (%u) of cycle\n",  
      ((float)prep->dump_bytes_written*100)/ctrs->fh.dump_fsz, 
      prep->dump_bytes_written);
  REP(stdout, " dumped %u rep %u dump\n", prep->repblks_dumped*WRITE_BLKSZ,
	  prep->dumpblks_dumped*WRITE_BLKSZ);
  REP(stdout, " Timeouts: flow: tcp: %u  seq: to %u tf %u tq %u ta %u udp: %u\n", 
      prep->tcp_to, prep->tcp_seq_to, prep->tcp_seq_to_forced, 
      prep->tcp_seq_to_q, prep->tcp_seq_to_ack, 
      prep->udp_to);
  REP(stdout, " Save rate %.4f MBs\n", prep->save_mBs);
  REP(stdout, " Maximum inter arrival time (sched) %u us\n", 
      prep->max_int_get);
  REP(stdout, " Minimum forced TCP sequence timeout %u ms\n",
      prep->min_tcp_seq_tp_f);
  REP(stdout, " Running time %s\n", us_clock_ts_string(prep->running_time));
  REP(stdout, "\n");

  return;
}

/*****************************************************************************/

/* 
 * Report rusage report 
 */

void 
report_rusage(np_rusage_t *ru, int indx, int show_stamp)
{
  long long udiff;
  long long usage, susage, wusage, wsusage;
  static struct timeval last_ts = {0l, 0L};
  static struct timeval last_ru_utime = {0L, 0L};
  static struct timeval last_ru_stime = {0L, 0L};
  static struct timeval w_last_ru_utime = {0L, 0L};
  static struct timeval w_last_ru_stime = {0L, 0L};
  double pct, spct, wpct, wspct;

  udiff = utvsub(&ru->ts, &last_ts);
  last_ts = ru->ts;

  usage = utvsub(&ru->ru.ru_utime, &last_ru_utime);
  last_ru_utime = ru->ru.ru_utime;

  susage = utvsub(&ru->ru.ru_stime, &last_ru_stime);
  last_ru_stime = ru->ru.ru_stime;

  wusage = utvsub(&ru->wru.ru_utime, &w_last_ru_utime);
  w_last_ru_utime = ru->wru.ru_utime;

  wsusage = utvsub(&ru->wru.ru_stime, &w_last_ru_stime);
  w_last_ru_stime = ru->wru.ru_stime;

  pct = (((double)usage)*100)/udiff;
  spct = (((double)susage)*100)/udiff;
  wpct = (((double)wusage)*100)/udiff;
  wspct = (((double)wsusage)*100)/udiff;

  if (show_stamp)
    REP(stdout, " #%u %s\n", indx, time_string(&ru->ts));
  REP(stdout, " Cycles: %.2fu + %.2fs = %.2f%% writer %.2fu + %.2fs = %.2f%%\n\n",
	  pct, spct, pct+spct, wpct, wspct, wpct+wspct);

  return;
}
  

/*****************************************************************************/

/* 
 * Report something interesting record 
 */

void
report_interesting(flow_inner_t *flowp, int way, char *s, int indx)
{
  REP(stdout, " #%u Interesting (%s)\n", indx, 
      way == SERVER ? "Server" : "Client");
  print_flow(stdout, flowp, way);
  printf ("%s\n\n", s);

  return;
}

void
report_inform(char *s, int indx)
{
  REP(stdout, " #%u Inform\n", indx);
  printf ("%s\n\n", s);

  return;
}
  

/*****************************************************************************/

/* 
 * Report stats from /proc 
 */

void
report_procstats(procstat_rec_t *prp, int ncpus, int hz, int pgsz, int indx)
{
  procstat_procrec_t *proc = &prp->proc;
  procstat_statrec_t *stat = &prp->stat;
  procstat_memrec_t *mem = &prp->mem;

  float per_sec, per_jiffies, per_time;
  float tot_cpu = (stat->utm + stat->stm + stat->itm);
  float chann_cpu = tot_cpu/ncpus;

  static int started = 0;
  static unsigned int  kb_per_page;
  static struct timeval last;
  

  if (!started)
    {
      started = 1;
      kb_per_page = pgsz / 1024;
      per_time = 0.0;
    }
  else 
    {
      per_time = utvsub(&(prp->ts), &last)/1000000.0;
    }

  per_jiffies = tot_cpu/ncpus;
  per_sec = per_jiffies/hz;
  
  last = *(&prp->ts);			/* struct */

  REP(stdout, " #%u %s per %.1fs (%.1fs)\n", indx, time_string(&prp->ts), 
      per_time, per_sec);

  REP(stdout, " SYSTEM\n");
  REP(stdout, " Mem: Free %u Buffer %u Cache %u Swapped %u kB\n", 
      mem->mfree>>10, mem->mbuff>>10, mem->memc>>10, mem->memswp>>10);
  REP(stdout, " CPU: usr %.0f%% sys %.0f%% idle %.0f%%\n", 
      stat->utm*100/tot_cpu, 
      stat->stm*100/tot_cpu, stat->itm*100/tot_cpu);
  REP(stdout, 
      " Swap pages: in %.0f/s out %.0f/s, IO blocks: in %.0f/s out %.0f/s\n", 
      stat->swin/per_sec, stat->swout/per_sec, 
      stat->bin/per_sec, stat->bout/per_sec);
  REP(stdout, " Interrupts: %.0f/s, Cswitches: %.0f/s\n", 
      stat->itot/per_sec, stat->csw/per_sec);

  REP(stdout, " NPROBE\n");
  //REP(stdout, " CPU%%: %.0f usr %.0f sys %.0f tot\n",
  //proc->utm/tot_cpu, proc->stm/tot_cpu, (proc->utm+proc->stm)/tot_cpu);
  REP(stdout, " CPU: usr %.0f (%.0f)%% sys %.0f (%.0f)%% tot %.0f (%.0f)%%\n",
      proc->utm*100/tot_cpu, proc->utm*100/per_jiffies, 
      proc->stm*100/tot_cpu, proc->stm*100/per_jiffies, 
      (proc->utm+proc->stm)*100/tot_cpu, 
      (proc->utm+proc->stm)*100/per_jiffies);
  REP(stdout, " Page faults: min %.0f/s maj %.0f/s , Swaps: %.0f/s\n",
      proc->minflt/per_sec, proc->majflt/per_sec, proc->nswap/per_sec);
  REP(stdout, " VM %ukB,  RSS %d pages\n", proc->vsz>>10, proc->rss);
  REP(stdout, " Mem pages: total %d rss %d\n mmapped %d text %d lib %d data %d dirty %d\n", 
	  proc->msz, proc->mrss, proc->mshare, 
	  proc->mtrs, proc->mlrs, proc->mdrs, proc->mdt);

  REP(stdout, "\n");    
  
  return;
}
  

/*****************************************************************************/

/* 
 * Report 'wrapper' record 
 */

void
report_wrapper(wrapper_record_t *wrapper, int indx)
{
  REP(stdout, " #%u WRAPPER record type %d\n", indx, wrapper->type);
  switch (wrapper->type)
    {
    case WRAPPER_TIME_CALLS:
      report_call_times(&wrapper->data.call_times, indx);
      break;
    }
  

  return;
}
  

/*****************************************************************************/

/* 
 * Report times record 
 */

void 
report_call_times(call_times_t *ct, int indx)
{
  REP(stdout, " #%u %s\n", indx, time_string(&ct->ts));
  REP(stdout, "\tIP %lldus usr, %lldus system\n", ct->ip.utm, ct->ip.stm);
  REP(stdout, "\tUDP %lldus usr, %lldus system\n", ct->udp.utm, ct->udp.stm);
  REP(stdout, "\tTCP %lldus usr, %lldus system\n", ct->tcp.utm, ct->tcp.stm);
  REP(stdout, "\tTCP in seq. %lldus usr, %lldus system\n", 
      ct->tcp_inseq.utm, ct->tcp_inseq.stm);
  REP(stdout, "\tTCP catchup %lldus usr, %lldus system\n", 
      ct->tcp_catchup.utm, ct->tcp_catchup.stm);
  REP(stdout, "\tTCP service %lldus usr, %lldus system\n", 
      ct->tcp_serv.utm, ct->tcp_serv.stm);
  REP(stdout, "\tHTTP %lldus usr, %lldus system\n", 
      ct->http.utm, ct->http.stm);
  REP(stdout, "\tHTML %lldus usr, %lldus system\n", 
      ct->html.utm, ct->html.stm);
  REP(stdout, "\n");
  
  return;
}

  

/*****************************************************************************/

#if !defined WREAD && !defined BIN_REPORT

void 
final_report(listhdr_t *htbl)
{
  int i, j;

  for (i = 0; i < N_HOST_BUCKETS; i++)
    {
      host_flow_t *hostlistp;
      L_WALK(hostlistp, &htbl[i], hlist, host_flow_t)
	{
	  tcp_conn_t *connlistp;
	  for (j = 0; j < N_CONN_BUCKETS; j++)
	    {
	      L_WALK(connlistp, &hostlistp->tcp_conns[j], hlist, tcp_conn_t)
		{
		  report_tcp_conn(connlistp, 0);
		}
	    }
	}
    }

#ifdef TCPDUMP_FED
  report_counters(&counters, TCPDUMP_COLL, o_infnm);
# else
  report_counters(&counters, NPROBE_COLL, NULL);
#endif

  return;
}

#endif /* ifndef WREAD && BIN_REPORT */

#ifdef REPORT

void 
report_tcp_close(tcp_conn_t *tconnp)
{

  report_tcp_conn(tconnp);

  return;
}
  
  
#endif /* ifdef REPORT */

#endif /* if defined FINAL_REPORT || defined REPORT || defined WREAD */



/*
 * end report.c 
 */