From 84f285fe8eb3b8945660ce3596984c61e5919147 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 24 Mar 2024 08:17:31 -0400 Subject: [PATCH] test/memcap: Validate memcap pressure values Issue: 6398 This test validates that the memcap pressure stats are no longer in the global namespace. Old: - memcap_pressure - memcap_pressure_max New: - memcap.pressure - memcap.pressure_max --- tests/memcap-pressure/README.md | 8 ++++++++ tests/memcap-pressure/test.rules | 1 + tests/memcap-pressure/test.yaml | 16 ++++++++++++++++ 3 files changed, 25 insertions(+) create mode 100644 tests/memcap-pressure/README.md create mode 100644 tests/memcap-pressure/test.rules create mode 100644 tests/memcap-pressure/test.yaml diff --git a/tests/memcap-pressure/README.md b/tests/memcap-pressure/README.md new file mode 100644 index 000000000..72c138948 --- /dev/null +++ b/tests/memcap-pressure/README.md @@ -0,0 +1,8 @@ +# Test + +Validate that `memcap.pressure` and `memcap.pressure_max` exist. + +# Pcap + +Pcap is the result of a curl to www.testmyids.com, later extracted with +Wireshark to keep the ``http`` packets only. diff --git a/tests/memcap-pressure/test.rules b/tests/memcap-pressure/test.rules new file mode 100644 index 000000000..3b7d12406 --- /dev/null +++ b/tests/memcap-pressure/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"HTTP traffic"; sid:001; rev:1;) diff --git a/tests/memcap-pressure/test.yaml b/tests/memcap-pressure/test.yaml new file mode 100644 index 000000000..6db1213ff --- /dev/null +++ b/tests/memcap-pressure/test.yaml @@ -0,0 +1,16 @@ +requires: + min-version: 8 +pcap: ../alert-testmyids-midstream5/input.pcap + +args: +- --set stream.midstream=true + +checks: + - filter: + count: 1 + match: + event_type: stats + has-key: stats.memcap.pressure_max + has-key: stats.memcap.pressure + not-has-key: stats.memcap_pressure_max + not-has-key: stats.memcap_pressure -- 2.47.2