Collect statistics on current traffic with Bro

Question

I want to collect statistics on traffic every 10 seconds and the only tool that I found is connection_state_remove event,

event connection_state_remove(c: connection)
{
        SumStats::observe( "traffic", [$str="all"] [$num=c$orig$num_bytes_ip] );
}

how to deal with those connections that did not removed by the end of this period. How to get statistics from them?

Answer 1

The events you're processing are independent of the time interval at which the SumStats framework reports statistics. First, you need to define what exactly are the statistics you care about — for example, you may want to count the number of connections for which Bro completes processing in a given time interval. Second, you need to define the time interval (in your case, 10 seconds) and how to process the statistical observations in the SumStats framework. This latter part is missing in your snippet: you're only making an observation but not telling the framework what to do with it.

The examples in the SumStats documentation are very close to what you're looking for.