0
Я стараюсь видеть максимальную емкость EPS для Drools CEP. Я использую 8-ядерный процессор с тактовой частотой 2,6 ГГц с 16 ГБ оперативной памяти. Я тестирую только 200 EPS с 2 правилами. Drools начинается хорошо, но позже (в течение 5-15 минут) он запускается или начинает НЕ ОГНЯ Я проверил с fireAllRules и fireUntilHalt.Drools 6.5 Конечные проблемы стабильности и производительности CEP (Fusion)
Мой Тест Код:
package com.anet.correlation;
public class TestRealCase {
public static void main(String[] args) {
Main.initTest();
RulesRegistery.starttime = System.currentTimeMillis();
if (RuleRunTimeRegistery.isFireuntilHalt) {
Thread t = new Thread(new FT());
t.start();
}
int i = 0;
if (Main.ruleEngine != null) {
while (true) {
GeneralCorrelationObject ao1 = new GeneralCorrelationObject();
ao1.setLOGTYPE("Firewalls");
ao1.setSourceMachine("1.2.3.4" + (i % 500));
ao1.setDestinationPort(i);
Main.ruleEngine.evaluate(ao1);
i++;
if (i % RulesRegistery.EPS == 0)
try {
Thread.sleep(1000);
} catch (InterruptedException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
}
}
Мой DRL Файл
import com.anet.correlation.*;
import java.util.*;
import com.anet.ntLog.collector.*;
import com.anet.alarm.*;
import com.anet.util.*;
import com.anet.correlation.operators.*;
import com.anet.correlation.utils.*;
declare GeneralCorrelationObject
@role(event)
@expires(1200s)
end
rule "Port Scan_Port Scan_16"
salience 0
no-loop
when
$map1: Map()
from accumulate(
generalcorrelationobject1:GeneralCorrelationObject(LOGTYPE=='Firewalls') over window:time(1m)
,init(Map m = new HashMap();Hashtable ht= new Hashtable();),
action(
if(generalcorrelationobject1.getSourceMachine()==null)
{
return;
}
String key="SourceMachine="+generalcorrelationobject1.getSourceMachine();
List list = (List)m.get(key);
if(list == null)
list = new ArrayList();
Object val1=generalcorrelationobject1.getDestinationPort();
String value1;
if (val1 instanceof Integer)
value1=val1+"";
else
value1=(String)val1;
String not_key=value1;
if (ht.containsKey(key)){
Hashtable ht_hash=(Hashtable)ht.get(key);
Object ht_val=ht_hash.get(not_key);
String ht_value;
if (ht_val instanceof Integer)
ht_value=ht_val+"";
else
ht_value=(String)ht_val;
if (!not_key.equalsIgnoreCase(ht_value)){
ht_hash.put(not_key, not_key);
ht.put(key, ht_hash);
list.add(generalcorrelationobject1);
}
}
else{
Hashtable ht_hash=new Hashtable();
ht_hash.put(not_key, not_key);
ht.put(key, ht_hash);
list.add(generalcorrelationobject1);
}
m.put(key,list);),
result(m)
)
then
/*
if ((new CheckListSize()).check($map1,10)){
System.out.println("Done");
}
*/
Iterator s = $map1.keySet().iterator();
while (s.hasNext()) {
String key = (String) s.next();
List list = (List) $map1.get(key);
System.out.println(key+" : "+list.size());
}
end
rule "Port eee Scan_161"
salience 100
no-loop
when
ee:GeneralCorrelationObject()
then
if (RulesRegistery.numberofsingleruleexecution % RulesRegistery.printEPS == 0) {
System.out.println(ee.getSourceMachine());
}
RulesRegistery.numberofsingleruleexecution++;
end
RuleEngine Код
package com.anet.correlation;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.util.Date;
import org.kie.api.KieBase;
import org.kie.api.KieBaseConfiguration;
import org.kie.api.KieServices;
import org.kie.api.builder.KieBuilder;
import org.kie.api.builder.KieFileSystem;
import org.kie.api.builder.Message;
import org.kie.api.builder.ReleaseId;
import org.kie.api.conf.EventProcessingOption;
import org.kie.api.runtime.KieContainer;
import org.kie.api.runtime.KieSession;
import org.kie.api.runtime.KieSessionConfiguration;
import org.kie.internal.builder.conf.RuleEngineOption;
import org.kie.internal.KnowledgeBase;
import org.kie.internal.KnowledgeBaseFactory;
import org.kie.internal.builder.KnowledgeBuilder;
import org.kie.internal.builder.KnowledgeBuilderFactory;
import org.kie.internal.io.ResourceFactory;
import org.kie.api.io.ResourceType;
public final class RulesEngine {
KieSession ksession;
KieBuilder kbuilder;
public static String header = null;
public RulesEngine(boolean b) {
KieServices ks = KieServices.Factory.get();
KieFileSystem kfs = ks.newKieFileSystem();
kfs.write("src/main/resources/bench.drl", getRule());
this.kbuilder = ks.newKieBuilder(kfs);
this.kbuilder.buildAll();
if (this.kbuilder.getResults().hasMessages(new Message.Level[] { Message.Level.ERROR })) {
throw new IllegalArgumentException(this.kbuilder.getResults().toString());
}
ReleaseId relId = this.kbuilder.getKieModule().getReleaseId();
KieContainer kcontainer = ks.newKieContainer(relId);
KieBaseConfiguration kbconf = ks.newKieBaseConfiguration();
kbconf.setOption(EventProcessingOption.STREAM);
kbconf.setOption(RuleEngineOption.PHREAK);
// kbconf.setOption(RuleEngineOption.RETEOO);
System.out.println("KB " + kbconf.getProperty("drools.ruleEngine"));
KieBase kbase = kcontainer.newKieBase(kbconf);
KieSessionConfiguration ksconf = ks.newKieSessionConfiguration();
this.ksession = kbase.newKieSession(ksconf, null);
}
String readFile(String fileName) throws IOException {
BufferedReader br = new BufferedReader(new FileReader(fileName));
try {
StringBuilder sb = new StringBuilder();
String line = br.readLine();
while (line != null) {
sb.append(line);
sb.append("\n");
line = br.readLine();
}
String rule = (sb.toString());
System.out.println("New Final");
System.out.println(rule);
return rule;
} finally {
br.close();
}
}
public String getRule() {
try {
return readFile(".." + File.separator + "rules" + File.separator + "all.drl");
} catch (IOException e) {
e.printStackTrace();
}
return null;
}
public void evaluate(GeneralCorrelationObject message) {
if (message == null) {
System.out.println("message null ");
return;
}
if (ksession == null) {
System.out.println("ksession null ");
return;
}
try {
Long n = System.currentTimeMillis();
if (RulesRegistery.numberofrules % RulesRegistery.printEPS == 0) {
System.out.println("Inserting Objects " + RulesRegistery.numberofrules + " EPS : "
+ (RulesRegistery.numberofrules/((n - RulesRegistery.starttime)/1000)) + " : Total time "
+ ((n - RulesRegistery.starttime)/(1000 * 60)) + " : " + new Date());
}
ksession.insert(message);
if (RulesRegistery.numberofrules % RulesRegistery.printEPS == 0) {
System.out.println("Inserted Objects " + RulesRegistery.numberofrules + " EPS : "
+ (RulesRegistery.numberofrules/((n - RulesRegistery.starttime)/1000)) + " : Total time "
+ ((n - RulesRegistery.starttime)/(1000 * 60)) + " : " + new Date());
}
if (!RuleRunTimeRegistery.isFireuntilHalt) {
if (RulesRegistery.numberofrules % RulesRegistery.printEPS == 0) {
System.out.println("Running Rules " + RulesRegistery.numberofrules + " EPS : "
+ (RulesRegistery.numberofrules/((n - RulesRegistery.starttime)/1000))
+ " : Total time " + ((n - RulesRegistery.starttime)/(1000 * 60)) + " : "
+ new Date());
}
ksession.fireAllRules();
if (RulesRegistery.numberofrules % RulesRegistery.printEPS == 0) {
System.out.println("Runned Rules " + RulesRegistery.numberofrules + " EPS : "
+ (RulesRegistery.numberofrules/((n - RulesRegistery.starttime)/1000))
+ " : Total time " + ((n - RulesRegistery.starttime)/(1000 * 60)) + " : "
+ new Date());
}
}
RulesRegistery.numberofrules++;
RuleRunTimeRegistery.lasttiem = n;
} catch (Exception ee) {
ee.printStackTrace();
}
}
}