influxdata / influxdata/telegraf
inputs.nftables: Use nft --terse to avoid dumping set elements
- Dominant language
- Go
- Stars
- 17.8k
- Forks
- 5.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 161
Description
### Use Case
Dumping sets can be expensive. nft allows avoiding that using `--terse`.
### Expected behavior
* Use `--terse` if `include = [...]` does not include `"sets"`.
* nftables master [now provides set element counts](https://git.netfilter.org/nftables/commit/?id=c429340e41b9b32fda214a7a658ae58bc9bfb3d2), so `"sets"` can be monitored even with `--terse`. An option is provided to do so.
### Actual behavior
Sets are always dumped, even when not needed. For large contended sets this can take minutes to hours(!) for a single invocation.
### Additional info
_No response_
Contributor guide
Research direction
Start by locating the inputs.nftables implementation and its handling of the include option, then inspect the existing plugin tests. Verify the nft invocation uses --terse when sets are excluded, while preserving set monitoring through the provided option; add or update tests for both modes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100