gatekeeper
gatekeeper copied to clipboard
User friendliness: improve the logged information of dumped flows
A log entry with information on a dumped flow looks like this:
GK/6 2024-12-13 18:45:57 ERR Flow (src: 111.111.111.111, dst: 222.222.222.222) at index 10998: [state: GK_BPF (3), flow_hash_value: 0x3a4ad6e1, expire_at: 0x16984504d9c543, program_index=100, cookie=1a55f823e6971600, 000c000099000000, 98fe2f0000000000, 0064020000000000, 30d0251822981600, 90d308bf01000000, 0100000000000000, 0000000000000000, grantor_ip: 222.222.222.111]
This log entry can be improved as follows:
- The field
expire_atshould show the remaining time using the units seconds, minutes, hours, days, and weeks. Larger time units such as months and years should be avoided because they do not have fixed sizes; for example, a month can be 28, 29, 30, or 31 days long. Expired flows should show the fieldexpire_atas "EXPIRED - The field
program_indexshould include the name of the BPF. - The log entry should include
rte_rdtsc()to help one read the cookie since BPFs often usectx->now.