influxdata / influxdata/telegraf

inputs.nftables: Use nft --terse to avoid dumping set elements

Open
#19,502 0 comments 0 reactions 0 assignees View on GitHub
feature request
Dominant language
Go
Stars
17.8k
Forks
5.8k
Avg merge
1d 20h
Merged PRs (30d)
161

Description

### Use Case

Dumping sets can be expensive. nft allows avoiding that using `--terse`.

### Expected behavior

* Use `--terse` if `include = [...]` does not include `"sets"`.
* nftables master [now provides set element counts](https://git.netfilter.org/nftables/commit/?id=c429340e41b9b32fda214a7a658ae58bc9bfb3d2), so `"sets"` can be monitored even with `--terse`. An option is provided to do so.

### Actual behavior

Sets are always dumped, even when not needed. For large contended sets this can take minutes to hours(!) for a single invocation.

### Additional info

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the inputs.nftables implementation and its handling of the include option, then inspect the existing plugin tests. Verify the nft invocation uses --terse when sets are excluded, while preserving set monitoring through the provided option; add or update tests for both modes.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.