Struct libgather::Gather
[−]
[src]
pub struct Gather { /* fields omitted */ }A data structure that tracs multiple active flows.
This keeps the currently active flows, cuts them into slices and gathers information passed to it, updating the flows as it goes.
It produces two results. First, every time a slice is closed, the slice is returned (and is left for the caller to take care of). The other is a stream of events happening on the flows to allow other parts of the program to react to them.
Methods
impl Gather[src]
fn new(logger: Logger, event_sink: UnboundedSender<Event>) -> Self
Creates a new gather component.
The component is empty (there are no flows active at the moment).
It makes little sense to have multiple gather components, but it is not enforced in any way.
Params
logger: Where the gatherer shall log.event_sink: A channel where the gatherer should put events generated by updates and some other things. The receiver end can be freely closed, the gatherer simply ignores all errors when sending there.
fn update(&mut self, update: Update)
Updates a flow.
This applies the passed update to a flow. If the flow is not found, it creates a fresh new one.
First, the keys are used to find the flow. If no key matches, a new flow is created.
Then, all the keys that are not yet known are also linked to the flow (either found by other key or just created).
All the tags passed in the update are added to the flow. If the tag is already present, the old one is replaced.
If the statistics are present in the update, they are also applied.
Params
- update: The description of update to apply.
Panics
It is considered a contract violation if a key is used by multiple flows that are live at the same time. If such condition is discovered, it panics.
Also, if an update with Key::InternalHandle and some other key is passed in, it may
panic.
TODO
Consider what happens when a flow is reported as terminated, we still hold it for a while and the ID is reused. This is likely something that can happen (eg. the tupple gets reused, or conntrack ID is reused).
fn close_slice(&mut self) -> TimeSlice
Closes a slice.
This slices all the active flows and produces flow slices for them.
It also does some other book keeping, like timing out old flows and dropping them.
fn push_cork(&self, cork: Cork)
Pushes a cork through the event channel.
Sometimes the caller needs to know when all existing events passed through the channel and were processed. To mark such place, a cork may be used. This method pushes such cork through the event channel.