diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh index 0e66af12e..19be68280 100644 --- a/salt/telegraf/scripts/zeekcaptureloss.sh +++ b/salt/telegraf/scripts/zeekcaptureloss.sh @@ -1,7 +1,10 @@ #!/bin/bash +# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %} ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log if [ -f "$ZEEKLOG" ]; then LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}') - echo "zeekcaptureloss loss=$LOSS" -fi + TS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g') + TSNANO=$(echo "$(date -d "$TS" +"%s.%N") 1000000000 * p" | dc | awk -F. {'print $1'}) + echo "zeekcaptureloss loss=$LOSS $TSNANO" +fi \ No newline at end of file diff --git a/salt/telegraf/scripts/zeekloss.sh b/salt/telegraf/scripts/zeekloss.sh index 6fb0b27f8..579fdf9f2 100644 --- a/salt/telegraf/scripts/zeekloss.sh +++ b/salt/telegraf/scripts/zeekloss.sh @@ -1,4 +1,5 @@ #!/bin/bash +# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2) declare RESULT=($ZEEKLOG) CURRENTDROP=${RESULT[3]}