gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc4 wit rust

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-16 15:34:53 +02:00
parent e5d344622e
commit 40474cdc59
29 changed files with 2692 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
grafana/README.md
+11 -2
View File
@@ -8,8 +8,8 @@ already available in-memory counters and the last Suricata EVE stats snapshot.
A scrape does not query SQLite, Redis, RouterOS, the Suricata control socket,
or analytics endpoints.
The dashboard also uses monotonic TZSP traffic counters exported directly from
the in-memory flow tracker:
The dashboard also uses monotonic TZSP traffic counters exported from the Rust
receiver's 1 Hz telemetry bridge:
```text
mikrosuricata_traffic_bytes_total{direction="total|inbound|outbound|internal|external"}
@@ -21,6 +21,11 @@ bits/s. The top of the dashboard therefore shows current total, inbound and
outbound throughput, packet rate, capture drops, a large throughput chart and
traffic volume by direction for the selected time range.
Rust receive-path quality is exported separately. In particular,
`mikrosuricata_tzsp_receiver_kernel_udp_drops_total` is the Linux UDP socket
drop counter and should stay at zero during high-rate capture tests. The
dashboard includes it in **Sensor loss & decode errors**.
`/metrics` is protected by an IP/CIDR ACL configured through environment variables.
The default allows loopback only:
@@ -73,3 +78,7 @@ scrape_configs:
Import `mikrosuricata-prometheus.json` in Grafana and select the Prometheus
datasource from the dashboard variable. Rate, percentage and ratio panels are
calculated in PromQL, not by MikroSuricata.
## Rust TZSP data-plane health (0.11.0+)
The receiver now exports both kernel and userspace back-pressure signals. In addition to `mikrosuricata_tzsp_receiver_kernel_udp_drops_total`, watch `mikrosuricata_tzsp_receiver_queue_dropped_datagrams_total`, `mikrosuricata_tzsp_receiver_queue_depth_batches`, `mikrosuricata_tzsp_receiver_queue_capacity_batches` and `mikrosuricata_tzsp_receiver_capture_efficiency_pct`. A small RouterOS kernel socket buffer is expected; loss should be judged by the drop counters, not by buffer size alone.
grafana/mikrosuricata-prometheus.json
+26 -15
View File
@@ -648,7 +648,7 @@
{
"id": 25,
"type": "bargauge",
"title": "Traffic mix \u00b7 selected range",
"title": "Traffic mix · selected range",
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
@@ -873,8 +873,8 @@
{
"id": 26,
"type": "stat",
"title": "Active flows",
"description": "Currently tracked live L3/L4 flows.",
"title": "TZSP RX buffer",
"description": "Actual Linux UDP receive buffer allocated to the Rust TZSP receiver.",
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
@@ -887,7 +887,7 @@
},
"fieldConfig": {
"defaults": {
"unit": "short",
"unit": "bytes",
"thresholds": {
"mode": "absolute",
"steps": [
@@ -926,7 +926,7 @@
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
"expr": "max(mikrosuricata_tzsp_receiver_rcvbuf_bytes{instance=~\"$instance\"})",
"legendFormat": "",
"range": true,
"refId": "A"
@@ -1322,7 +1322,7 @@
"id": 8,
"type": "timeseries",
"title": "Sensor loss & decode errors",
"description": "Rates that should stay near zero: kernel drops, injection errors, TZSP decode errors and Suricata alert queue overflow.",
"description": "Rates that should stay near zero: Rust UDP socket drops, Suricata kernel drops, TAP injection errors, TZSP decode errors and alert queue overflow.",
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
@@ -1438,6 +1438,17 @@
"legendFormat": "Alert queue overflow",
"range": true,
"refId": "D"
},
{
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "sum(rate(mikrosuricata_tzsp_receiver_kernel_udp_drops_total{instance=~\"$instance\"}[$__rate_interval]))",
"legendFormat": "TZSP UDP drops",
"range": true,
"refId": "E"
}
]
},
@@ -2048,8 +2059,8 @@
{
"id": 14,
"type": "timeseries",
"title": "Live sessions",
"description": "",
"title": "Rust dataplane packet path",
"description": "Inspected packet rate versus kernel UDP loss and userspace queue loss in the Rust TZSP data-plane.",
"datasource": {
"type": "prometheus",
"uid": "${datasource}"
@@ -2062,7 +2073,7 @@
},
"fieldConfig": {
"defaults": {
"unit": "short",
"unit": "pps",
"custom": {
"drawStyle": "line",
"lineInterpolation": "smooth",
@@ -2128,8 +2139,8 @@
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
"legendFormat": "Active flows",
"expr": "sum(rate(mikrosuricata_traffic_packets_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
"legendFormat": "Inspected packets/s",
"range": true,
"refId": "A"
},
@@ -2139,8 +2150,8 @@
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "max(mikrosuricata_event_bus_subscribers{instance=~\"$instance\"})",
"legendFormat": "WebSocket subscribers",
"expr": "sum(rate(mikrosuricata_tzsp_receiver_kernel_udp_drops_total{instance=~\"$instance\"}[$__rate_interval]))",
"legendFormat": "Kernel UDP drops/s",
"range": true,
"refId": "B"
},
@@ -2150,8 +2161,8 @@
"uid": "${datasource}"
},
"editorMode": "code",
"expr": "sum(rate(mikrosuricata_flow_tracker_evicted_flows_total{instance=~\"$instance\"}[$__rate_interval]))",
"legendFormat": "Evictions/s",
"expr": "sum(rate(mikrosuricata_tzsp_receiver_queue_dropped_datagrams_total{instance=~\"$instance\"}[$__rate_interval]))",
"legendFormat": "Userspace queue drops/s",
"range": true,
"refId": "C"
}