zeek
zeek copied to clipboard
Provide network-time-independent Telemetry sync hook
Currently, the existing Telemetry::sync
hook is called using Zeek-script schedule
, which is based on network time:
https://github.com/zeek/zeek/blob/b22ec065680a43c6a484416a807f4c3d6a5d9304/scripts/base/frameworks/telemetry/main.zeek#L496
Network time is driven by packet timestamps. If Zeek is overloaded in live mode, packets might not be processed in real-time and network time "slows-down" compared to actual wall-clock. As a consequence metrics might not be updated at the desired frequency. This is particularly bad for metrics that are intended to diagnose overload situations (e.g. packet lag).
A proposed solution by @awelzel is to introduce a hook in the new Telemetry framework that is called when Prometheus scrapes metrics. So how about adding a Telemetry::scrape
hook?