gatekeeper icon indicating copy to clipboard operation
gatekeeper copied to clipboard

User friendliness: improve the logged information of dumped flows

Open AltraMayor opened this issue 1 year ago • 0 comments

A log entry with information on a dumped flow looks like this:

GK/6 2024-12-13 18:45:57 ERR Flow (src: 111.111.111.111, dst: 222.222.222.222) at index 10998: [state: GK_BPF (3), flow_hash_value: 0x3a4ad6e1, expire_at: 0x16984504d9c543, program_index=100, cookie=1a55f823e6971600, 000c000099000000, 98fe2f0000000000, 0064020000000000, 30d0251822981600, 90d308bf01000000, 0100000000000000, 0000000000000000, grantor_ip: 222.222.222.111]

This log entry can be improved as follows:

  1. The field expire_at should show the remaining time using the units seconds, minutes, hours, days, and weeks. Larger time units such as months and years should be avoided because they do not have fixed sizes; for example, a month can be 28, 29, 30, or 31 days long. Expired flows should show the field expire_at as "EXPIRED
  2. The field program_index should include the name of the BPF.
  3. The log entry should include rte_rdtsc() to help one read the cookie since BPFs often use ctx->now.

AltraMayor avatar Dec 19 '24 21:12 AltraMayor