diff --git a/HOW-TO-GET-SPAN-LIKE-DATA.md b/HOW-TO-GET-SPAN-LIKE-DATA.md index 8e0ce30..1a7fc2a 100644 --- a/HOW-TO-GET-SPAN-LIKE-DATA.md +++ b/HOW-TO-GET-SPAN-LIKE-DATA.md @@ -77,8 +77,8 @@ - `tap_side != system span`时,每条`flow`的`_id`最多只有一来一回两条, 大于等于两条 - `vtap_id`, `tap_port`, `tap_port_type`, `l7_protocol`, `request_id`, `tap_side`, `flow_id`不同 - `request`的`start_time`大于`response`的`start_time` -- 系统Span的`flow`满足以下条件才合并 - - 应用协议为DNS,request_flow的type==session +- 非DNS协议的系统Span的`flow`满足以下条件才合并 + - request_flow的type==session - response_flow的type==response - request_flow的cap_seq_1+1==response_flow的cap_seq_1 - 合并字段,被合并的`flow`会将`原始flow`中缺少的字段补充进去 diff --git a/README.md b/README.md index 050b75f..4086d7b 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,6 @@ So, here is to convert the existing Flow Log Event into Span-like data, that is: - Sort the merged data and build Span-like data that conforms to the call stack. ## Others -For details, please refer to [here](https://github.com/deepflowio/deepflow-app/blob/feature-edit-desc/HOW-TO-GET-SPAN-LIKE-DATA.md) +For details, please refer to [here](https://github.com/deepflowio/deepflow-app/blob/main/HOW-TO-GET-SPAN-LIKE-DATA.md) diff --git a/app/app/application/l7_flow_tracing.py b/app/app/application/l7_flow_tracing.py index c1f9499..6f73b47 100644 --- a/app/app/application/l7_flow_tracing.py +++ b/app/app/application/l7_flow_tracing.py @@ -1293,13 +1293,12 @@ def merge_flow(flows: list, flow: dict) -> bool: equal = False if request_flow['tap_side'] in [ TAP_SIDE_SERVER_PROCESS, TAP_SIDE_CLIENT_PROCESS - ]: + ] and request_flow['l7_protocol'] == L7_PROTOCOL_DNS: # 应用span syscall_cap_seq判断合并 - if request_flow['l7_protocol'] != L7_PROTOCOL_DNS or request_flow[ - 'syscall_cap_seq_1'] + 1 != response_flow[ - 'syscall_cap_seq_1'] or not ( - request_flow['type'] == L7_FLOW_TYPE_SESSION and - response_flow['type'] == L7_FLOW_TYPE_RESPONSE): + if request_flow['syscall_cap_seq_1'] + 1 != response_flow[ + 'syscall_cap_seq_1'] or not ( + request_flow['type'] == L7_FLOW_TYPE_SESSION + and response_flow['type'] == L7_FLOW_TYPE_RESPONSE): equal = False if equal: # 合并字段 # FIXME 确认要合并哪些字段