feat: reduce agent payload size with flow truncation and increase nginx body size limit to 16MB
Reduce agent flow_limit from 2000 to 1500, truncate log_excerpt from 500 to 180 characters in firewall log parsing, increase firewall_log_lines_from_files limit from default to max(limit*2, 1000), add compact_agent_payload to truncate flows array to 50 entries with flow_count/flows_truncated metadata, update agent_heartbeat to store compacted payload instead of full dump, add agentFlowCount helper to
This commit is contained in:
@@ -18,7 +18,7 @@ from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
|
||||
VERSION = "0.2.2"
|
||||
VERSION = "0.2.3"
|
||||
VM_INTERFACE_RE = re.compile(r"(?:tap|fwbr|fwln|fwpr)(\d+)")
|
||||
VM_INTERFACE_DETAIL_RE = re.compile(r"(?:tap|fwbr|fwln|fwpr)(\d+)i(\d+)")
|
||||
LOG_FIELD_RE = re.compile(r"\b([A-Z]+)=([^\s]+)")
|
||||
@@ -358,7 +358,7 @@ def parse_firewall_log_line(line: str) -> dict[str, Any] | None:
|
||||
"state": decision,
|
||||
"decision": decision,
|
||||
"collector": "firewall-log",
|
||||
"log_excerpt": line[-500:],
|
||||
"log_excerpt": line[-180:],
|
||||
}
|
||||
|
||||
|
||||
@@ -386,7 +386,7 @@ def collect_firewall_log_flows(since_minutes: int = 5, limit: int = 500) -> tupl
|
||||
log_lines.extend(output.splitlines())
|
||||
else:
|
||||
diagnostics["errors"].append(output or "journalctl returned no firewall log output")
|
||||
file_lines, file_errors = firewall_log_lines_from_files()
|
||||
file_lines, file_errors = firewall_log_lines_from_files(max(limit * 2, 1000))
|
||||
log_lines.extend(file_lines)
|
||||
diagnostics["file_errors"] = file_errors
|
||||
diagnostics["lines_scanned"] = len(log_lines)
|
||||
@@ -500,7 +500,7 @@ def collect_firewall() -> dict[str, Any]:
|
||||
def collect_payload(config: dict[str, Any]) -> dict[str, Any]:
|
||||
uptime = read_text("/proc/uptime")
|
||||
interfaces = collect_interfaces()
|
||||
flow_limit = int(config.get("flow_limit", 2000))
|
||||
flow_limit = int(config.get("flow_limit", 1500))
|
||||
packet_flows: list[dict[str, Any]] = []
|
||||
packet_diagnostics: dict[str, Any] | None = None
|
||||
firewall_log_flows: list[dict[str, Any]] = []
|
||||
|
||||
Reference in New Issue
Block a user