1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
|
--
-- (C) 2021 - ntop.org
--
local dirs = ntop.getDirs()
package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
require "lua_utils"
local json = require "dkjson"
sendHTTPContentTypeHeader('text/html')
local mode = _GET["ebpf_data"] or "processes"
local host = _GET["host"]
local username = _GET["username"]
local uid = _GET["uid"]
local pageinfo = {
["sortColumn"] = "column_bytes",
["maxHits"] = 15,
["a2zSortOrder"] = false,
["hostFilter"] = host,
["usernameFilter"] = username,
["detailsLevel"] = "high", -- to obtain processes information
}
local flows_stats = interface.getFlowsInfo(host, pageinfo)
local res = {}
if not flows_stats then
res[#res + 1] = {label = "Other", value = 1}
-- print('[ { "label": "Other", "value": 1 } ]') -- No flows found
else
flows_stats = flows_stats["flows"]
local tot = 0
local aggregation = {}
for _, f in pairs(flows_stats or {}) do
local key
-- Prepare aggregation parameter
if mode == "processes" then
if f["client_process"] and f["client_process"]["user_name"] == username then
key = f["client_process"]["name"]
elseif f["server_process"] and f["server_process"]["user_name"] == username then
key = f["server_process"]["name"]
end
elseif mode == "applications" then
key = f["proto.ndpi"]
elseif mode == "breeds" then
key = f["proto.ndpi_breed"]
elseif mode == "categories" then
key = f["proto.ndpi_cat"]
end
-- Do aggregation
if key then
if aggregation[key] == nil then aggregation[key] = 0 end
local v = f["cli2srv.bytes"] + f["srv2cli.bytes"]
aggregation[key] = aggregation[key] + v
tot = tot + v
end
end
-- Print up to this number of entries
local max_num_entries = 10
-- Print entries whose value >= 5% of the total
local threshold = (tot * 5) / 100
local num = 0
local accumulate = 0
for key, value in pairsByValues(aggregation, rev) do
if value < threshold and num > 0 then
break
end
res[#res + 1] = {label = key, value = value}
accumulate = accumulate + value
num = num + 1
if num >= max_num_entries then
break
end
end
-- In case there is some leftover do print it as "Other"
if accumulate < tot then
res[#res + 1] = {label = "Other", value = (tot - accumulate)}
end
end
print(json.encode(res))
|