rsigma_runtime/
metrics.rs

1/// Abstraction for runtime metrics so the runtime crate does not depend on
2/// `prometheus` directly. The CLI (or any other consumer) provides a concrete
3/// implementation backed by Prometheus, OpenTelemetry, or whatever it prefers.
4pub trait MetricsHook: Send + Sync {
5    /// A JSON line failed to parse.
6    fn on_parse_error(&self);
7    /// `count` events were successfully evaluated.
8    fn on_events_processed(&self, count: u64);
9    /// `count` detection rule matches were produced.
10    fn on_detection_matches(&self, count: u64);
11    /// `count` correlation rule matches were produced.
12    fn on_correlation_matches(&self, count: u64);
13    /// Observe per-event processing latency in seconds.
14    fn observe_processing_latency(&self, seconds: f64);
15    /// The input queue depth changed by `delta` (positive = enqueue, negative = dequeue).
16    fn on_input_queue_depth_change(&self, delta: i64);
17    /// Back-pressure event: a source tried to send but the channel was full.
18    fn on_back_pressure(&self);
19    /// Observe the batch size used for a single engine lock acquisition.
20    fn observe_batch_size(&self, size: u64);
21    /// The output queue depth changed by `delta`.
22    fn on_output_queue_depth_change(&self, delta: i64);
23    /// Observe end-to-end pipeline latency (dequeue → sink) in seconds.
24    fn observe_pipeline_latency(&self, seconds: f64);
25    /// Report current correlation state entry count.
26    fn set_correlation_state_entries(&self, count: u64);
27
28    /// A single detection rule matched. Labels enable per-rule Prometheus counters.
29    fn on_detection_match_detail(&self, _rule_title: &str, _level: &str) {}
30    /// A single correlation rule matched. Labels enable per-rule Prometheus counters.
31    fn on_correlation_match_detail(
32        &self,
33        _rule_title: &str,
34        _level: &str,
35        _correlation_type: &str,
36    ) {
37    }
38}
39
40/// No-op implementation for use when metrics are disabled (e.g., `rsigma run`).
41pub struct NoopMetrics;
42
43impl MetricsHook for NoopMetrics {
44    fn on_parse_error(&self) {}
45    fn on_events_processed(&self, _count: u64) {}
46    fn on_detection_matches(&self, _count: u64) {}
47    fn on_correlation_matches(&self, _count: u64) {}
48    fn observe_processing_latency(&self, _seconds: f64) {}
49    fn on_input_queue_depth_change(&self, _delta: i64) {}
50    fn on_back_pressure(&self) {}
51    fn observe_batch_size(&self, _size: u64) {}
52    fn on_output_queue_depth_change(&self, _delta: i64) {}
53    fn observe_pipeline_latency(&self, _seconds: f64) {}
54    fn set_correlation_state_entries(&self, _count: u64) {}
55}
rsigma_runtime/metrics.rs

rsigma_runtime/
metrics.rs
