vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress dashboard: match squid's result codes by prefix

Browse source 
"TCP_" alone is a word filter for the token TCP_, which no result code is, so
the overview and refused tabs read zero. "TCP_"* matches TCP_TUNNEL and the
rest. The module-eval case now fails on the bare form.
This commit is contained in:
iris 2026-10-30 16:15:19 +01:00
commit e334e677e0
2 changed files with 22 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/host-modules/swarm-grafana/dashboards/egress.json
View file

@ -61,7 +61,7 @@
"refId": "agent",
"type": "fieldValue",
"field": "agent",
"query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\"",
"query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\"",
"limit": 200
}
},
@ -117,7 +117,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count() as requests",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count() as requests",
"queryType": "stats"
}
},
@ -191,7 +191,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents",
"queryType": "stats"
}
},
@ -265,7 +265,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
"queryType": "stats"
}
},
@ -339,7 +339,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges",
"queryType": "stats"
}
},
@ -413,7 +413,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes",
"queryType": "stats"
}
},
@ -561,7 +561,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests",
"queryType": "statsRange",
"legendFormat": "{{status}}"
}
@ -635,7 +635,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15",
"queryType": "stats",
"legendFormat": "{{agent}}"
}
@ -711,7 +711,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15",
"queryType": "stats",
"legendFormat": "{{agent}}"
}
@ -787,7 +787,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25",
"queryType": "stats"
}
},
@ -865,7 +865,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused",
"queryType": "stats"
}
},
@ -939,7 +939,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents",
"queryType": "stats"
}
},
@ -1013,7 +1013,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc",
"queryType": "stats"
}
},
@ -1090,7 +1090,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests",
"queryType": "statsRange",
"legendFormat": "{{agent}}"
}
@ -1164,7 +1164,7 @@
"name": "@logsDatasourceUid@"
},
"spec": {
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403",
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter status:403",
"queryType": "instant"
}
},

7
nix/module-eval/grafana.nix
View file

@ -488,6 +488,13 @@ let
&& lib.length (lib.filter (e: lib.hasInfix access e) exprs) == 14
&& agentVar != null
&& lib.hasInfix access agentVar.spec.query.spec.query
# `"TCP_"` alone is a word filter for the token TCP_, which no result
# code is (TCP_TUNNEL, TCP_MISS, ...): every panel reads zero. The prefix
# form `"TCP_"*` is the one that matches them.
&& lib.all (e: !(lib.hasInfix "\"TCP_\" " e)) (exprs ++ [ agentVar.spec.query.spec.query ])
&& lib.all (e: lib.hasInfix "\"TCP_\"*" e) (
lib.filter (e: lib.hasInfix access e) (exprs ++ [ agentVar.spec.query.spec.query ])
)
&& lib.hasInfix "logformat would_deny would_deny user=%[un method=%rm host=%>rd port=%>rP result=" squid
&& lib.hasInfix "access_log syslog:daemon.info squid !manager" squid;
}