feat: reduce agent payload size with flow truncation and increase nginx body size limit to 16MB

Reduce agent flow_limit from 2000 to 1500, truncate log_excerpt from 500 to 180 characters in firewall log parsing, increase firewall_log_lines_from_files limit from default to max(limit*2, 1000), add compact_agent_payload to truncate flows array to 50 entries with flow_count/flows_truncated metadata, update agent_heartbeat to store compacted payload instead of full dump, add agentFlowCount helper to
This commit is contained in:
2026-07-10 08:42:48 +02:00
parent 07cd534254
commit 0f4734c85c
4 changed files with 28 additions and 7 deletions
+4 -4
View File
@@ -18,7 +18,7 @@ from pathlib import Path
from typing import Any
VERSION = "0.2.2"
VERSION = "0.2.3"
VM_INTERFACE_RE = re.compile(r"(?:tap|fwbr|fwln|fwpr)(\d+)")
VM_INTERFACE_DETAIL_RE = re.compile(r"(?:tap|fwbr|fwln|fwpr)(\d+)i(\d+)")
LOG_FIELD_RE = re.compile(r"\b([A-Z]+)=([^\s]+)")
@@ -358,7 +358,7 @@ def parse_firewall_log_line(line: str) -> dict[str, Any] | None:
"state": decision,
"decision": decision,
"collector": "firewall-log",
"log_excerpt": line[-500:],
"log_excerpt": line[-180:],
}
@@ -386,7 +386,7 @@ def collect_firewall_log_flows(since_minutes: int = 5, limit: int = 500) -> tupl
log_lines.extend(output.splitlines())
else:
diagnostics["errors"].append(output or "journalctl returned no firewall log output")
file_lines, file_errors = firewall_log_lines_from_files()
file_lines, file_errors = firewall_log_lines_from_files(max(limit * 2, 1000))
log_lines.extend(file_lines)
diagnostics["file_errors"] = file_errors
diagnostics["lines_scanned"] = len(log_lines)
@@ -500,7 +500,7 @@ def collect_firewall() -> dict[str, Any]:
def collect_payload(config: dict[str, Any]) -> dict[str, Any]:
uptime = read_text("/proc/uptime")
interfaces = collect_interfaces()
flow_limit = int(config.get("flow_limit", 2000))
flow_limit = int(config.get("flow_limit", 1500))
packet_flows: list[dict[str, Any]] = []
packet_diagnostics: dict[str, Any] | None = None
firewall_log_flows: list[dict[str, Any]] = []