Here are some initial ideas for HTTP request and counter structures.
The http_request structure would be exported for sampled HTTP requests
along with an extended socket structure as described in:
http://www.sflow.org/sflow_host.txt
Using sFlow to monitor HTTP is a scalable way to monitor the
performance of large web server clusters or load balancers where
request rates are high and conventional logging solutions generate too
much data or impose excessive overhead. The combination of HTTP and
Memcached sFlow would provide good coverage of the key protocols in a
web 2.0 data center:
http://blog.sflow.com/2010/09/memcached.html
Comments?
----------
enum http_method {
OTHER = 0;
OPTIONS = 1;
GET = 2;
HEAD = 3;
POST = 4;
PUT = 5;
DELETE = 6;
TRACE = 7;
CONNECT = 8;
}
/* HTTP request */
/* opaque = flow_data; enterprise = 0; format = 2201 */
struct http_request {
http_method method; /* method */
string<255> uri; /* URI exactly as it came from the client
*/
string<32> host; /* Host value from request header */
string<255> referer; /* Referer value from request header */
string<64> useragent; /* User-Agent value from request header */
string<32> authuser; /* RFC 1413 identity of user*/
unsigned int bytes; /* content-length of document transferred
*/
unsigned int uS; /* duration of the operation
(microseconds) */
int status; /* HTTP status code */
}
/* HTTP counters */
/* opaque = counter_data; enterprise = 0; format = 2201 */
struct http_counters {
int method_option_count;
int method_get_count;
int method_head_count;
int method_post_count;
int method_put_count;
int method_delete_count;
int method_trace_count;
int methd_connect_count;
int method_other_count;
int status_1XX_count;
int status_2XX_count;
int status_3XX_count;
int status_4XX_count;
int status_5XX_count;
int status_other_count;
}