mirror of
https://github.com/Velocidex/velociraptor.git
synced 2026-10-12 02:09:59 +00:00
Mike Cohen
72ea73f616
The queue manager is used to pass messages between parts of Velociraptor. Previously, the queue name corresponded with the artifact name that defines the queue. However, this allowed messages intended to client monitoring to be passed to server monitoring artifacts under some conditions. This refactor changes the queue name to also contain the artifact type. This change better keeps track of messages and which queues they are sent to. Additionally, the journal manager now records two records in each monitoring row: 1. The _Source records who authorized the row. 2. The _From records who actually sent the row in the first place. ACL decisions are now made based on the _Source only making it more consistent to determine if a row can be sent on a particular queue.
51 lines
1.0 KiB
Go
51 lines
1.0 KiB
Go
package utils
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/Velocidex/ttlcache/v2"
|
|
)
|
|
|
|
type logCacheEntry struct {
|
|
last_time time.Time
|
|
}
|
|
|
|
type DeduplicatedLogger struct {
|
|
lru *ttlcache.Cache // map[string]logCacheEntry
|
|
dedup_time time.Duration
|
|
}
|
|
|
|
func (self *DeduplicatedLogger) Log(
|
|
log_func func(message string, args ...interface{}),
|
|
message string, args ...interface{}) {
|
|
|
|
// Do we need to dedup it?
|
|
now := GetTime().Now()
|
|
log_cache_entry_any, err := self.lru.Get(message)
|
|
if err == nil {
|
|
log_cache_entry, ok := log_cache_entry_any.(*logCacheEntry)
|
|
if ok && log_cache_entry.last_time.After(now.Add(-self.dedup_time)) {
|
|
return
|
|
}
|
|
}
|
|
|
|
log_cache_entry := &logCacheEntry{
|
|
last_time: now,
|
|
}
|
|
self.lru.Set(message, log_cache_entry)
|
|
|
|
log_func(message, args...)
|
|
}
|
|
|
|
func NewDeduplicatedLogger(dedup_time time.Duration) (
|
|
res *DeduplicatedLogger, closer func() error) {
|
|
res = &DeduplicatedLogger{
|
|
lru: ttlcache.NewCache(),
|
|
dedup_time: dedup_time,
|
|
}
|
|
|
|
res.lru.SetTTL(time.Hour)
|
|
res.lru.SetCacheSizeLimit(100)
|
|
return res, res.lru.Close
|
|
}
|