Skip to content

schema: add descriptions for flow stats counters - v2#13753

Closed
jufajardini wants to merge 2 commits into
OISF:masterfrom
jufajardini:doc-7794-flow-schema/v2
Closed

schema: add descriptions for flow stats counters - v2#13753
jufajardini wants to merge 2 commits into
OISF:masterfrom
jufajardini:doc-7794-flow-schema/v2

Conversation

@jufajardini

Copy link
Copy Markdown
Contributor

Task #7794

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/7794

Previous PR #13712

Describe changes:

  • better word the code comment about flow_spare_sync_incomplete (and related stats counter)
  • reword stats counters descriptions for flow.end

@jufajardini jufajardini added the typo/doc update No code change : only doc or typo fixes label Aug 26, 2025
@jufajardini jufajardini requested review from a team and victorjulien as code owners August 26, 2025 20:07
@jufajardini jufajardini marked this pull request as draft August 26, 2025 20:08
@jufajardini

Copy link
Copy Markdown
Contributor Author

There were more comments that I had not seen.

@jufajardini jufajardini force-pushed the doc-7794-flow-schema/v2 branch from 7d02de7 to 14a55df Compare August 26, 2025 21:32
Where those weren't like that, yet.
@jufajardini jufajardini force-pushed the doc-7794-flow-schema/v2 branch from 14a55df to 93aaa26 Compare August 26, 2025 21:35
@jufajardini jufajardini marked this pull request as ready for review August 26, 2025 21:36
@jufajardini

Copy link
Copy Markdown
Contributor Author

There were more comments that I had not seen.

Hopefully all where addressed, now.

@codecov

codecov Bot commented Aug 26, 2025

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.73%. Comparing base (49629f7) to head (93aaa26).

Additional details and impacted files
@@             Coverage Diff             @@
##           master   #13753       +/-   ##
===========================================
+ Coverage   77.16%   83.73%    +6.56%     
===========================================
  Files         945     1011       +66     
  Lines      172228   275066   +102838     
===========================================
+ Hits       132906   230319    +97413     
- Misses      39322    44747     +5425     
Flag Coverage Δ
fuzzcorpus 62.94% <ø> (+<0.01%) ⬆️
livemode 19.00% <ø> (+<0.01%) ⬆️
pcap 44.69% <ø> (+0.01%) ⬆️
suricata-verify 65.09% <ø> (+0.02%) ⬆️
unittests 59.18% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa

Copy link
Copy Markdown

Information: QA ran without warnings.

Pipeline = 27232

@victorjulien victorjulien left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see inline

Comment thread etc/schema.json
"flows_evicted_pkt_inject": {
"type": "integer"
"type": "integer",
"description": "Number of pseudo packets injected into evicted flows to complete flows processing. If for any flow this can be between 0-2, this is the total for all flows"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the packets are not injected into flows, but into the worker threads

Comment thread etc/schema.json
"closed": {
"type": "integer"
"type": "integer",
"description": "Number of flows closed at the time of flow end"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"flows in a closed state" - it's about the state. Same for established and new

Comment thread etc/schema.json
},
"flow_bypassed": {
"type": "object",
"description": "",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was this empty desc intentional?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I thought I had removed all of these, apologies...

Comment thread etc/schema.json
"spare_sync_avg": {
"type": "integer"
"type": "integer",
"description": "Flows fetched from the global pool is always fetched in blocks of 100. Sometimes, this number is lesser. Counter of the average length of master flow pool/spare queue"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there are explanations in here that don't belong here?

"Average number of flows a thread could fetch from the master flow pool/spare queue"

The explanation here is more a doc entry?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's very tempting to make these more doc like 🤐 I'll reword to be more descriptive and succinct.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or... easier, just use the suggestion.

Comment thread etc/schema.json
"spare_sync_empty": {
"type": "integer"
"type": "integer",
"description": "Number of spare queues that were empty when trying to fetch a flow"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Number of times the master spare pool was empty when requesting flows from it."

So this is essentially a thread sync failure due to running out of resources.

Comment thread etc/schema.json
"spare_sync_incomplete": {
"type": "integer"
"type": "integer",
"description": "Number of spare flow queues that are incomplete (fetched with less than 100 flows in sync)"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its not queues that are incomplete, but syncs. We got fewer flows than expected

Comment thread etc/schema.json
},
"mgr": {
"type": "object",
"description": "Flow manager thread stats counters",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are these per thread?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They are tracked per thread, but default output is all threads merged. If per thread logging is enabled, it can be logged per thread. Probably best to drop the thread here.

@jufajardini

Copy link
Copy Markdown
Contributor Author

Followed by #13758

@jufajardini jufajardini deleted the doc-7794-flow-schema/v2 branch September 9, 2025 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

typo/doc update No code change : only doc or typo fixes

Development

Successfully merging this pull request may close these issues.

4 participants