1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define DEBUG false // STOPSHIP if true
18 #include "Log.h"
19
20 #include "CountMetricProducer.h"
21 #include "guardrail/StatsdStats.h"
22 #include "stats_util.h"
23 #include "stats_log_util.h"
24
25 #include <limits.h>
26 #include <stdlib.h>
27
28 using android::util::FIELD_COUNT_REPEATED;
29 using android::util::FIELD_TYPE_BOOL;
30 using android::util::FIELD_TYPE_FLOAT;
31 using android::util::FIELD_TYPE_INT32;
32 using android::util::FIELD_TYPE_INT64;
33 using android::util::FIELD_TYPE_MESSAGE;
34 using android::util::FIELD_TYPE_STRING;
35 using android::util::ProtoOutputStream;
36 using std::map;
37 using std::string;
38 using std::unordered_map;
39 using std::vector;
40
41 namespace android {
42 namespace os {
43 namespace statsd {
44
45 // for StatsLogReport
46 const int FIELD_ID_ID = 1;
47 const int FIELD_ID_COUNT_METRICS = 5;
48 const int FIELD_ID_TIME_BASE = 9;
49 const int FIELD_ID_BUCKET_SIZE = 10;
50 const int FIELD_ID_DIMENSION_PATH_IN_WHAT = 11;
51 const int FIELD_ID_DIMENSION_PATH_IN_CONDITION = 12;
52 // for CountMetricDataWrapper
53 const int FIELD_ID_DATA = 1;
54 // for CountMetricData
55 const int FIELD_ID_DIMENSION_IN_WHAT = 1;
56 const int FIELD_ID_DIMENSION_IN_CONDITION = 2;
57 const int FIELD_ID_BUCKET_INFO = 3;
58 const int FIELD_ID_DIMENSION_LEAF_IN_WHAT = 4;
59 const int FIELD_ID_DIMENSION_LEAF_IN_CONDITION = 5;
60 // for CountBucketInfo
61 const int FIELD_ID_COUNT = 3;
62 const int FIELD_ID_BUCKET_NUM = 4;
63 const int FIELD_ID_START_BUCKET_ELAPSED_MILLIS = 5;
64 const int FIELD_ID_END_BUCKET_ELAPSED_MILLIS = 6;
65
CountMetricProducer(const ConfigKey & key,const CountMetric & metric,const int conditionIndex,const sp<ConditionWizard> & wizard,const int64_t startTimeNs)66 CountMetricProducer::CountMetricProducer(const ConfigKey& key, const CountMetric& metric,
67 const int conditionIndex,
68 const sp<ConditionWizard>& wizard,
69 const int64_t startTimeNs)
70 : MetricProducer(metric.id(), key, startTimeNs, conditionIndex, wizard) {
71 // TODO: evaluate initial conditions. and set mConditionMet.
72 if (metric.has_bucket()) {
73 mBucketSizeNs =
74 TimeUnitToBucketSizeInMillisGuardrailed(key.GetUid(), metric.bucket()) * 1000000;
75 } else {
76 mBucketSizeNs = LLONG_MAX;
77 }
78
79 if (metric.has_dimensions_in_what()) {
80 translateFieldMatcher(metric.dimensions_in_what(), &mDimensionsInWhat);
81 mContainANYPositionInDimensionsInWhat = HasPositionANY(metric.dimensions_in_what());
82 }
83
84 mSliceByPositionALL = HasPositionALL(metric.dimensions_in_what()) ||
85 HasPositionALL(metric.dimensions_in_condition());
86
87 if (metric.has_dimensions_in_condition()) {
88 translateFieldMatcher(metric.dimensions_in_condition(), &mDimensionsInCondition);
89 }
90
91 if (metric.links().size() > 0) {
92 for (const auto& link : metric.links()) {
93 Metric2Condition mc;
94 mc.conditionId = link.condition();
95 translateFieldMatcher(link.fields_in_what(), &mc.metricFields);
96 translateFieldMatcher(link.fields_in_condition(), &mc.conditionFields);
97 mMetric2ConditionLinks.push_back(mc);
98 }
99 mConditionSliced = true;
100 }
101
102 mConditionSliced = (metric.links().size() > 0) || (mDimensionsInCondition.size() > 0);
103
104 VLOG("metric %lld created. bucket size %lld start_time: %lld", (long long)metric.id(),
105 (long long)mBucketSizeNs, (long long)mTimeBaseNs);
106 }
107
~CountMetricProducer()108 CountMetricProducer::~CountMetricProducer() {
109 VLOG("~CountMetricProducer() called");
110 }
111
dumpStatesLocked(FILE * out,bool verbose) const112 void CountMetricProducer::dumpStatesLocked(FILE* out, bool verbose) const {
113 if (mCurrentSlicedCounter == nullptr ||
114 mCurrentSlicedCounter->size() == 0) {
115 return;
116 }
117
118 fprintf(out, "CountMetric %lld dimension size %lu\n", (long long)mMetricId,
119 (unsigned long)mCurrentSlicedCounter->size());
120 if (verbose) {
121 for (const auto& it : *mCurrentSlicedCounter) {
122 fprintf(out, "\t(what)%s\t(condition)%s %lld\n",
123 it.first.getDimensionKeyInWhat().toString().c_str(),
124 it.first.getDimensionKeyInCondition().toString().c_str(),
125 (unsigned long long)it.second);
126 }
127 }
128 }
129
onSlicedConditionMayChangeLocked(bool overallCondition,const int64_t eventTime)130 void CountMetricProducer::onSlicedConditionMayChangeLocked(bool overallCondition,
131 const int64_t eventTime) {
132 VLOG("Metric %lld onSlicedConditionMayChange", (long long)mMetricId);
133 }
134
135
clearPastBucketsLocked(const int64_t dumpTimeNs)136 void CountMetricProducer::clearPastBucketsLocked(const int64_t dumpTimeNs) {
137 flushIfNeededLocked(dumpTimeNs);
138 mPastBuckets.clear();
139 }
140
onDumpReportLocked(const int64_t dumpTimeNs,const bool include_current_partial_bucket,std::set<string> * str_set,ProtoOutputStream * protoOutput)141 void CountMetricProducer::onDumpReportLocked(const int64_t dumpTimeNs,
142 const bool include_current_partial_bucket,
143 std::set<string> *str_set,
144 ProtoOutputStream* protoOutput) {
145 if (include_current_partial_bucket) {
146 flushLocked(dumpTimeNs);
147 } else {
148 flushIfNeededLocked(dumpTimeNs);
149 }
150 if (mPastBuckets.empty()) {
151 return;
152 }
153 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_ID, (long long)mMetricId);
154 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_TIME_BASE, (long long)mTimeBaseNs);
155 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_BUCKET_SIZE, (long long)mBucketSizeNs);
156
157 // Fills the dimension path if not slicing by ALL.
158 if (!mSliceByPositionALL) {
159 if (!mDimensionsInWhat.empty()) {
160 uint64_t dimenPathToken = protoOutput->start(
161 FIELD_TYPE_MESSAGE | FIELD_ID_DIMENSION_PATH_IN_WHAT);
162 writeDimensionPathToProto(mDimensionsInWhat, protoOutput);
163 protoOutput->end(dimenPathToken);
164 }
165 if (!mDimensionsInCondition.empty()) {
166 uint64_t dimenPathToken = protoOutput->start(
167 FIELD_TYPE_MESSAGE | FIELD_ID_DIMENSION_PATH_IN_CONDITION);
168 writeDimensionPathToProto(mDimensionsInCondition, protoOutput);
169 protoOutput->end(dimenPathToken);
170 }
171
172 }
173
174 uint64_t protoToken = protoOutput->start(FIELD_TYPE_MESSAGE | FIELD_ID_COUNT_METRICS);
175
176 for (const auto& counter : mPastBuckets) {
177 const MetricDimensionKey& dimensionKey = counter.first;
178 VLOG(" dimension key %s", dimensionKey.toString().c_str());
179
180 uint64_t wrapperToken =
181 protoOutput->start(FIELD_TYPE_MESSAGE | FIELD_COUNT_REPEATED | FIELD_ID_DATA);
182
183 // First fill dimension.
184 if (mSliceByPositionALL) {
185 uint64_t dimensionToken = protoOutput->start(
186 FIELD_TYPE_MESSAGE | FIELD_ID_DIMENSION_IN_WHAT);
187 writeDimensionToProto(dimensionKey.getDimensionKeyInWhat(), str_set, protoOutput);
188 protoOutput->end(dimensionToken);
189
190 if (dimensionKey.hasDimensionKeyInCondition()) {
191 uint64_t dimensionInConditionToken = protoOutput->start(
192 FIELD_TYPE_MESSAGE | FIELD_ID_DIMENSION_IN_CONDITION);
193 writeDimensionToProto(dimensionKey.getDimensionKeyInCondition(),
194 str_set, protoOutput);
195 protoOutput->end(dimensionInConditionToken);
196 }
197 } else {
198 writeDimensionLeafNodesToProto(dimensionKey.getDimensionKeyInWhat(),
199 FIELD_ID_DIMENSION_LEAF_IN_WHAT, str_set, protoOutput);
200 if (dimensionKey.hasDimensionKeyInCondition()) {
201 writeDimensionLeafNodesToProto(dimensionKey.getDimensionKeyInCondition(),
202 FIELD_ID_DIMENSION_LEAF_IN_CONDITION,
203 str_set, protoOutput);
204 }
205 }
206 // Then fill bucket_info (CountBucketInfo).
207 for (const auto& bucket : counter.second) {
208 uint64_t bucketInfoToken = protoOutput->start(
209 FIELD_TYPE_MESSAGE | FIELD_COUNT_REPEATED | FIELD_ID_BUCKET_INFO);
210 // Partial bucket.
211 if (bucket.mBucketEndNs - bucket.mBucketStartNs != mBucketSizeNs) {
212 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_START_BUCKET_ELAPSED_MILLIS,
213 (long long)NanoToMillis(bucket.mBucketStartNs));
214 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_END_BUCKET_ELAPSED_MILLIS,
215 (long long)NanoToMillis(bucket.mBucketEndNs));
216 } else {
217 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_BUCKET_NUM,
218 (long long)(getBucketNumFromEndTimeNs(bucket.mBucketEndNs)));
219 }
220 protoOutput->write(FIELD_TYPE_INT64 | FIELD_ID_COUNT, (long long)bucket.mCount);
221 protoOutput->end(bucketInfoToken);
222 VLOG("\t bucket [%lld - %lld] count: %lld", (long long)bucket.mBucketStartNs,
223 (long long)bucket.mBucketEndNs, (long long)bucket.mCount);
224 }
225 protoOutput->end(wrapperToken);
226 }
227
228 protoOutput->end(protoToken);
229
230 mPastBuckets.clear();
231 }
232
dropDataLocked(const int64_t dropTimeNs)233 void CountMetricProducer::dropDataLocked(const int64_t dropTimeNs) {
234 flushIfNeededLocked(dropTimeNs);
235 mPastBuckets.clear();
236 }
237
onConditionChangedLocked(const bool conditionMet,const int64_t eventTime)238 void CountMetricProducer::onConditionChangedLocked(const bool conditionMet,
239 const int64_t eventTime) {
240 VLOG("Metric %lld onConditionChanged", (long long)mMetricId);
241 mCondition = conditionMet;
242 }
243
hitGuardRailLocked(const MetricDimensionKey & newKey)244 bool CountMetricProducer::hitGuardRailLocked(const MetricDimensionKey& newKey) {
245 if (mCurrentSlicedCounter->find(newKey) != mCurrentSlicedCounter->end()) {
246 return false;
247 }
248 // ===========GuardRail==============
249 // 1. Report the tuple count if the tuple count > soft limit
250 if (mCurrentSlicedCounter->size() > StatsdStats::kDimensionKeySizeSoftLimit - 1) {
251 size_t newTupleCount = mCurrentSlicedCounter->size() + 1;
252 StatsdStats::getInstance().noteMetricDimensionSize(mConfigKey, mMetricId, newTupleCount);
253 // 2. Don't add more tuples, we are above the allowed threshold. Drop the data.
254 if (newTupleCount > StatsdStats::kDimensionKeySizeHardLimit) {
255 ALOGE("CountMetric %lld dropping data for dimension key %s",
256 (long long)mMetricId, newKey.toString().c_str());
257 return true;
258 }
259 }
260
261 return false;
262 }
263
onMatchedLogEventInternalLocked(const size_t matcherIndex,const MetricDimensionKey & eventKey,const ConditionKey & conditionKey,bool condition,const LogEvent & event)264 void CountMetricProducer::onMatchedLogEventInternalLocked(
265 const size_t matcherIndex, const MetricDimensionKey& eventKey,
266 const ConditionKey& conditionKey, bool condition,
267 const LogEvent& event) {
268 int64_t eventTimeNs = event.GetElapsedTimestampNs();
269 flushIfNeededLocked(eventTimeNs);
270
271 if (condition == false) {
272 return;
273 }
274
275 auto it = mCurrentSlicedCounter->find(eventKey);
276 if (it == mCurrentSlicedCounter->end()) {
277 // ===========GuardRail==============
278 if (hitGuardRailLocked(eventKey)) {
279 return;
280 }
281 // create a counter for the new key
282 (*mCurrentSlicedCounter)[eventKey] = 1;
283 } else {
284 // increment the existing value
285 auto& count = it->second;
286 count++;
287 }
288 for (auto& tracker : mAnomalyTrackers) {
289 int64_t countWholeBucket = mCurrentSlicedCounter->find(eventKey)->second;
290 auto prev = mCurrentFullCounters->find(eventKey);
291 if (prev != mCurrentFullCounters->end()) {
292 countWholeBucket += prev->second;
293 }
294 tracker->detectAndDeclareAnomaly(eventTimeNs, mCurrentBucketNum, eventKey,
295 countWholeBucket);
296 }
297
298 VLOG("metric %lld %s->%lld", (long long)mMetricId, eventKey.toString().c_str(),
299 (long long)(*mCurrentSlicedCounter)[eventKey]);
300 }
301
302 // When a new matched event comes in, we check if event falls into the current
303 // bucket. If not, flush the old counter to past buckets and initialize the new bucket.
flushIfNeededLocked(const int64_t & eventTimeNs)304 void CountMetricProducer::flushIfNeededLocked(const int64_t& eventTimeNs) {
305 int64_t currentBucketEndTimeNs = getCurrentBucketEndTimeNs();
306 if (eventTimeNs < currentBucketEndTimeNs) {
307 return;
308 }
309
310 flushCurrentBucketLocked(eventTimeNs);
311 // Setup the bucket start time and number.
312 int64_t numBucketsForward = 1 + (eventTimeNs - currentBucketEndTimeNs) / mBucketSizeNs;
313 mCurrentBucketStartTimeNs = currentBucketEndTimeNs + (numBucketsForward - 1) * mBucketSizeNs;
314 mCurrentBucketNum += numBucketsForward;
315 VLOG("metric %lld: new bucket start time: %lld", (long long)mMetricId,
316 (long long)mCurrentBucketStartTimeNs);
317 }
318
flushCurrentBucketLocked(const int64_t & eventTimeNs)319 void CountMetricProducer::flushCurrentBucketLocked(const int64_t& eventTimeNs) {
320 int64_t fullBucketEndTimeNs = getCurrentBucketEndTimeNs();
321 CountBucket info;
322 info.mBucketStartNs = mCurrentBucketStartTimeNs;
323 if (eventTimeNs < fullBucketEndTimeNs) {
324 info.mBucketEndNs = eventTimeNs;
325 } else {
326 info.mBucketEndNs = fullBucketEndTimeNs;
327 }
328 for (const auto& counter : *mCurrentSlicedCounter) {
329 info.mCount = counter.second;
330 auto& bucketList = mPastBuckets[counter.first];
331 bucketList.push_back(info);
332 VLOG("metric %lld, dump key value: %s -> %lld", (long long)mMetricId,
333 counter.first.toString().c_str(),
334 (long long)counter.second);
335 }
336
337 // If we have finished a full bucket, then send this to anomaly tracker.
338 if (eventTimeNs > fullBucketEndTimeNs) {
339 // Accumulate partial buckets with current value and then send to anomaly tracker.
340 if (mCurrentFullCounters->size() > 0) {
341 for (const auto& keyValuePair : *mCurrentSlicedCounter) {
342 (*mCurrentFullCounters)[keyValuePair.first] += keyValuePair.second;
343 }
344 for (auto& tracker : mAnomalyTrackers) {
345 tracker->addPastBucket(mCurrentFullCounters, mCurrentBucketNum);
346 }
347 mCurrentFullCounters = std::make_shared<DimToValMap>();
348 } else {
349 // Skip aggregating the partial buckets since there's no previous partial bucket.
350 for (auto& tracker : mAnomalyTrackers) {
351 tracker->addPastBucket(mCurrentSlicedCounter, mCurrentBucketNum);
352 }
353 }
354 } else {
355 // Accumulate partial bucket.
356 for (const auto& keyValuePair : *mCurrentSlicedCounter) {
357 (*mCurrentFullCounters)[keyValuePair.first] += keyValuePair.second;
358 }
359 }
360
361 // Only resets the counters, but doesn't setup the times nor numbers.
362 // (Do not clear since the old one is still referenced in mAnomalyTrackers).
363 mCurrentSlicedCounter = std::make_shared<DimToValMap>();
364 }
365
366 // Rough estimate of CountMetricProducer buffer stored. This number will be
367 // greater than actual data size as it contains each dimension of
368 // CountMetricData is duplicated.
byteSizeLocked() const369 size_t CountMetricProducer::byteSizeLocked() const {
370 size_t totalSize = 0;
371 for (const auto& pair : mPastBuckets) {
372 totalSize += pair.second.size() * kBucketSize;
373 }
374 return totalSize;
375 }
376
377 } // namespace statsd
378 } // namespace os
379 } // namespace android
380