From e334e677e0a5707ce84cfe7f04a2c01b66e1381a Mon Sep 17 00:00:00 2001 From: iris Date: Fri, 30 Oct 2026 16:15:19 +0100 Subject: [PATCH] egress dashboard: match squid's result codes by prefix "TCP_" alone is a word filter for the token TCP_, which no result code is, so the overview and refused tabs read zero. "TCP_"* matches TCP_TUNNEL and the rest. The module-eval case now fails on the bare form. --- .../swarm-grafana/dashboards/egress.json | 30 +++++++++---------- nix/module-eval/grafana.nix | 7 +++++ 2 files changed, 22 insertions(+), 15 deletions(-) diff --git a/nix/host-modules/swarm-grafana/dashboards/egress.json b/nix/host-modules/swarm-grafana/dashboards/egress.json index 3e859975..b4a95281 100644 --- a/nix/host-modules/swarm-grafana/dashboards/egress.json +++ b/nix/host-modules/swarm-grafana/dashboards/egress.json @@ -61,7 +61,7 @@ "refId": "agent", "type": "fieldValue", "field": "agent", - "query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\"", + "query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\"", "limit": 200 } }, @@ -117,7 +117,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count() as requests", "queryType": "stats" } }, @@ -191,7 +191,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents", "queryType": "stats" } }, @@ -265,7 +265,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", "queryType": "stats" } }, @@ -339,7 +339,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges", "queryType": "stats" } }, @@ -413,7 +413,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes", "queryType": "stats" } }, @@ -561,7 +561,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests", "queryType": "statsRange", "legendFormat": "{{status}}" } @@ -635,7 +635,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15", "queryType": "stats", "legendFormat": "{{agent}}" } @@ -711,7 +711,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15", "queryType": "stats", "legendFormat": "{{agent}}" } @@ -787,7 +787,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25", "queryType": "stats" } }, @@ -865,7 +865,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", "queryType": "stats" } }, @@ -939,7 +939,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents", "queryType": "stats" } }, @@ -1013,7 +1013,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc", "queryType": "stats" } }, @@ -1090,7 +1090,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests", "queryType": "statsRange", "legendFormat": "{{agent}}" } @@ -1164,7 +1164,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\" !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403", "queryType": "instant" } }, diff --git a/nix/module-eval/grafana.nix b/nix/module-eval/grafana.nix index 38606dc9..617ffad7 100644 --- a/nix/module-eval/grafana.nix +++ b/nix/module-eval/grafana.nix @@ -488,6 +488,13 @@ let && lib.length (lib.filter (e: lib.hasInfix access e) exprs) == 14 && agentVar != null && lib.hasInfix access agentVar.spec.query.spec.query + # `"TCP_"` alone is a word filter for the token TCP_, which no result + # code is (TCP_TUNNEL, TCP_MISS, ...): every panel reads zero. The prefix + # form `"TCP_"*` is the one that matches them. + && lib.all (e: !(lib.hasInfix "\"TCP_\" " e)) (exprs ++ [ agentVar.spec.query.spec.query ]) + && lib.all (e: lib.hasInfix "\"TCP_\"*" e) ( + lib.filter (e: lib.hasInfix access e) (exprs ++ [ agentVar.spec.query.spec.query ]) + ) && lib.hasInfix "logformat would_deny would_deny user=%[un method=%rm host=%>rd port=%>rP result=" squid && lib.hasInfix "access_log syslog:daemon.info squid !manager" squid; }