Remove appsec distribution metrics (#5534)

Author: uurien

packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -55,18 +55,6 @@ function trackRaspMetrics (store, metrics, raspRule) {
 
   appsecMetrics.count('rasp.rule.eval', tags).inc(1)
 
-  if (metrics.duration) {
-    appsecMetrics.distribution('rasp.rule.duration', tags).track(metrics.duration)
-
-    const raspDuration = telemetryMetrics.raspDuration
-    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
-  }
-
-  if (metrics.durationExt) {
-    const raspDurationExt = telemetryMetrics.raspDurationExt
-    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
-  }
-
   if (metrics.errorCode) {
     const errorTags = { ...tags, waf_error: metrics.errorCode }
 

packages/dd-trace/src/appsec/telemetry/waf.js

@@ -33,21 +33,9 @@ function addWafRequestMetrics (store, { duration, durationExt, wafTimeout, error
   }
 }
 
-function trackWafDurations ({ duration, durationExt }, versionsTags) {
-  if (duration) {
-    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
-  }
-
-  if (durationExt) {
-    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
-  }
-}
-
 function trackWafMetrics (store, metrics) {
   const versionsTags = getVersionsTags(metrics.wafVersion, metrics.rulesVersion)
 
-  trackWafDurations(metrics, versionsTags)
-
   const metricTags = getOrCreateMetricTags(store, versionsTags)
 
   if (metrics.blockFailed) {
@@ -134,24 +122,6 @@ function incrementWafRequests (store) {
 function incrementTruncatedMetrics (metrics, truncationReason) {
   const truncationTags = { truncation_reason: truncationReason }
   appsecMetrics.count('waf.input_truncated', truncationTags).inc(1)
-
-  if (metrics?.maxTruncatedString) {
-    appsecMetrics.distribution('waf.truncated_value_size', {
-      truncation_reason: TRUNCATION_FLAGS.STRING
-    }).track(metrics.maxTruncatedString)
-  }
-
-  if (metrics?.maxTruncatedContainerSize) {
-    appsecMetrics.distribution('waf.truncated_value_size', {
-      truncation_reason: TRUNCATION_FLAGS.CONTAINER_SIZE
-    }).track(metrics.maxTruncatedContainerSize)
-  }
-
-  if (metrics?.maxTruncatedContainerDepth) {
-    appsecMetrics.distribution('waf.truncated_value_size', {
-      truncation_reason: TRUNCATION_FLAGS.CONTAINER_DEPTH
-    }).track(metrics.maxTruncatedContainerDepth)
-  }
 }
 
 function getTruncationReason ({ maxTruncatedString, maxTruncatedContainerSize, maxTruncatedContainerDepth }) {

packages/dd-trace/test/appsec/telemetry/rasp.spec.js

@@ -9,7 +9,7 @@ describe('Appsec Rasp Telemetry metrics', () => {
   const wafVersion = '0.0.1'
   const rulesVersion = '0.0.2'
 
-  let count, inc, req, distribution, track
+  let count, inc, req
 
   beforeEach(() => {
     req = {}
@@ -19,13 +19,7 @@ describe('Appsec Rasp Telemetry metrics', () => {
       inc
     })
 
-    track = sinon.spy()
-    distribution = sinon.stub(appsecNamespace, 'distribution').returns({
-      track
-    })
-
     appsecNamespace.metrics.clear()
-    appsecNamespace.distributions.clear()
   })
 
   afterEach(sinon.restore)
@@ -84,62 +78,6 @@ describe('Appsec Rasp Telemetry metrics', () => {
         expect(inc).to.have.been.calledTwice
       })
 
-      it('should track rasp.duration and rasp.rule.duration metrics', () => {
-        appsecTelemetry.updateRaspRequestsMetricTags({
-          duration: 42,
-          wafVersion: '1.0.0',
-          rulesVersion: '2.0.0'
-        }, req, { type: 'rule-type' })
-
-        expect(distribution).to.have.been.calledWith('rasp.rule.duration', {
-          rule_type: 'rule-type',
-          waf_version: '1.0.0',
-          event_rules_version: '2.0.0'
-        })
-        expect(track.firstCall).to.have.been.calledWith(42)
-
-        expect(distribution).to.have.been.calledWith('rasp.duration', {
-          waf_version: '1.0.0',
-          event_rules_version: '2.0.0'
-        })
-        expect(track.secondCall).to.have.been.calledWith(42)
-
-        track.resetHistory()
-
-        appsecTelemetry.updateRaspRequestsMetricTags({
-          duration: 35,
-          wafVersion: '1.0.0',
-          rulesVersion: '2.0.0'
-        }, req, { type: 'rule-type' })
-
-        expect(distribution).to.have.been.calledWith('rasp.rule.duration', {
-          rule_type: 'rule-type',
-          waf_version: '1.0.0',
-          event_rules_version: '2.0.0'
-        })
-        expect(track.firstCall).to.have.been.calledWith(35)
-
-        expect(distribution).to.have.been.calledWith('rasp.duration', {
-          waf_version: '1.0.0',
-          event_rules_version: '2.0.0'
-        })
-        expect(track.secondCall).to.have.been.calledWith(77)
-      })
-
-      it('should track rasp.duration_ext', () => {
-        appsecTelemetry.updateRaspRequestsMetricTags({
-          durationExt: 42,
-          wafVersion: '1.0.0',
-          rulesVersion: '2.0.0'
-        }, req, { type: 'rule-type' })
-
-        expect(distribution).to.have.been.calledWith('rasp.duration_ext', {
-          waf_version: '1.0.0',
-          event_rules_version: '2.0.0'
-        })
-        expect(track).to.have.been.calledWith(42)
-      })
-
       it('should track rasp.error', () => {
         appsecTelemetry.updateRaspRequestsMetricTags({
           errorCode: -127,

packages/dd-trace/test/appsec/telemetry/waf.spec.js

@@ -147,25 +147,6 @@ describe('Appsec Waf Telemetry metrics', () => {
         })
       })
 
-      it('should call trackWafDurations', () => {
-        appsecTelemetry.updateWafRequestsMetricTags({
-          duration: 42,
-          durationExt: 52,
-          ...metrics
-        }, req)
-
-        expect(distribution).to.have.been.calledTwice
-
-        const tag = {
-          waf_version: wafVersion,
-          event_rules_version: rulesVersion
-        }
-        expect(distribution.firstCall.args).to.be.deep.eq(['waf.duration', tag])
-        expect(distribution.secondCall.args).to.be.deep.eq(['waf.duration_ext', tag])
-
-        expect(track).to.have.been.calledTwice
-      })
-
       it('should sum waf.duration metrics', () => {
         appsecTelemetry.updateWafRequestsMetricTags({
           duration: 42,
@@ -365,9 +346,6 @@ describe('Appsec Waf Telemetry metrics', () => {
 
         expect(count).to.have.been.calledWith('waf.input_truncated', { truncation_reason: 1 })
         expect(inc).to.have.been.calledWith(1)
-
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 1 })
-        expect(track).to.have.been.calledWith(5000)
       })
 
       it('should report truncated container size metrics', () => {
@@ -376,9 +354,6 @@ describe('Appsec Waf Telemetry metrics', () => {
 
         expect(count).to.have.been.calledWith('waf.input_truncated', { truncation_reason: 2 })
         expect(inc).to.have.been.calledWith(1)
-
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 2 })
-        expect(track).to.have.been.calledWith(300)
       })
 
       it('should report truncated container depth metrics', () => {
@@ -387,9 +362,6 @@ describe('Appsec Waf Telemetry metrics', () => {
 
         expect(count).to.have.been.calledWith('waf.input_truncated', { truncation_reason: 4 })
         expect(inc).to.have.been.calledWith(1)
-
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 4 })
-        expect(track).to.have.been.calledWith(20)
       })
 
       it('should combine truncation reasons when multiple truncations occur', () => {
@@ -401,9 +373,6 @@ describe('Appsec Waf Telemetry metrics', () => {
         expect(result).to.have.property('input_truncated', true)
 
         expect(count).to.have.been.calledWith('waf.input_truncated', { truncation_reason: 7 })
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 1 })
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 2 })
-        expect(distribution).to.have.been.calledWith('waf.truncated_value_size', { truncation_reason: 4 })
       })
 
       it('should not report truncation metrics when no truncation occurs', () => {

packages/dd-trace/test/appsec/waf-metrics.integration.spec.js

@@ -174,7 +174,6 @@ describe('WAF Metrics', () => {
 
     it('should report truncation metrics', async () => {
       let appsecTelemetryMetricsReceived = false
-      let appsecTelemetryDistributionsReceived = false
 
       const complexPayload = createComplexPayload()
       await axios.post('/', { complexPayload })
@@ -204,29 +203,8 @@ describe('WAF Metrics', () => {
         }
       }, 30_000, 'generate-metrics', 2)
 
-      const checkTelemetryDistributions = agent.assertTelemetryReceived(({ payload }) => {
-        const namespace = payload.payload.namespace
-
-        if (namespace === 'appsec') {
-          appsecTelemetryDistributionsReceived = true
-          const series = payload.payload.series
-          const wafDuration = series.find(s => s.metric === 'waf.duration')
-          const wafDurationExt = series.find(s => s.metric === 'waf.duration_ext')
-          const wafTuncated = series.filter(s => s.metric === 'waf.truncated_value_size')
-
-          assert.exists(wafDuration, 'waf duration serie should exist')
-          assert.exists(wafDurationExt, 'waf duration ext serie should exist')
-
-          assert.equal(wafTuncated.length, 3)
-          assert.include(wafTuncated[0].tags, 'truncation_reason:1')
-          assert.include(wafTuncated[1].tags, 'truncation_reason:2')
-          assert.include(wafTuncated[2].tags, 'truncation_reason:4')
-        }
-      }, 30_000, 'distributions', 1)
-
-      return Promise.all([checkMessages, checkTelemetryMetrics, checkTelemetryDistributions]).then(() => {
+      return Promise.all([checkMessages, checkTelemetryMetrics]).then(() => {
         assert.equal(appsecTelemetryMetricsReceived, true)
-        assert.equal(appsecTelemetryDistributionsReceived, true)
 
         return true
       })