Struct libgather::Gather [] [src]

pub struct Gather { /* fields omitted */ }

A data structure that tracs multiple active flows.

This keeps the currently active flows, cuts them into slices and gathers information passed to it, updating the flows as it goes.

It produces two results. First, every time a slice is closed, the slice is returned (and is left for the caller to take care of). The other is a stream of events happening on the flows to allow other parts of the program to react to them.

Methods

impl Gather
[src]

Creates a new gather component.

The component is empty (there are no flows active at the moment).

It makes little sense to have multiple gather components, but it is not enforced in any way.

Params

  • logger: Where the gatherer shall log.
  • event_sink: A channel where the gatherer should put events generated by updates and some other things. The receiver end can be freely closed, the gatherer simply ignores all errors when sending there.

Updates a flow.

This applies the passed update to a flow. If the flow is not found, it creates a fresh new one.

First, the keys are used to find the flow. If no key matches, a new flow is created.

Then, all the keys that are not yet known are also linked to the flow (either found by other key or just created).

All the tags passed in the update are added to the flow. If the tag is already present, the old one is replaced.

If the statistics are present in the update, they are also applied.

Params

  • update: The description of update to apply.

Panics

It is considered a contract violation if a key is used by multiple flows that are live at the same time. If such condition is discovered, it panics.

Also, if an update with Key::InternalHandle and some other key is passed in, it may panic.

TODO

Consider what happens when a flow is reported as terminated, we still hold it for a while and the ID is reused. This is likely something that can happen (eg. the tupple gets reused, or conntrack ID is reused).

Closes a slice.

This slices all the active flows and produces flow slices for them.

It also does some other book keeping, like timing out old flows and dropping them.

Pushes a cork through the event channel.

Sometimes the caller needs to know when all existing events passed through the channel and were processed. To mark such place, a cork may be used. This method pushes such cork through the event channel.

Trait Implementations

impl ComputeQuery for Gather
[src]

Performs a query of the existing flows. Read more