zeek icon indicating copy to clipboard operation
zeek copied to clipboard

Provide network-time-independent Telemetry sync hook

Open J-Gras opened this issue 5 months ago • 0 comments

Currently, the existing Telemetry::sync hook is called using Zeek-script schedule, which is based on network time:

https://github.com/zeek/zeek/blob/b22ec065680a43c6a484416a807f4c3d6a5d9304/scripts/base/frameworks/telemetry/main.zeek#L496

Network time is driven by packet timestamps. If Zeek is overloaded in live mode, packets might not be processed in real-time and network time "slows-down" compared to actual wall-clock. As a consequence metrics might not be updated at the desired frequency. This is particularly bad for metrics that are intended to diagnose overload situations (e.g. packet lag).

A proposed solution by @awelzel is to introduce a hook in the new Telemetry framework that is called when Prometheus scrapes metrics. So how about adding a Telemetry::scrape hook?

J-Gras avatar Sep 20 '24 09:09 J-Gras