FW: [java-identity-provider COMMIT] in /trunk: idp-authn-api/pom.xml idp-authn-api/src/main/java/net/shibboleth/idp/authn...
Cantor, Scott
cantor.2 at osu.edu
Tue Sep 20 15:06:24 EDT 2016
This commit is some code I can easily roll back that demonstrates the work to instrument the password validators with success and failure counters. It includes some of the features we talked about Friday:
- the instrumented code calls a method we implement to obtain the Counter, not a Metrics API directly
- the code I supplied returns either a real Counter or a DisabledCounter conditionally based on logging category
- the metric is reported only if the logging category allows it
- the logging category can change at runtime, turning the metric on and off
I'm going to spend some time reviewing the metrics-agent link Brent provided. I do think that link notes something I freely recognize: instrumenting the code is nasty work and very bloated.
My take-away from the work I did is that it's pretty easy to get this conditional instrumentation to idea to work, but I'm not sure how valuable it is in practice. Things like counters are so cheap to handle, and there's so much overhead in doing these logging checks that I'm not sure there's a point to it. I can guarantee we're paying more cycles doing this then it costs to increment a counter and store a long.
If this metrics-agent idea is workable, perhaps the best choice is a hybrid strategy. I don't think it would be very practical to track a lot of semantically interesting counters or gauges with an outside agent. It was tricky to even maintain the authentication counter correctly because of the different kinds of error paths.
But if I were to want to add a timer around particular actions, I suspect that would get very ugly fast, but might be pretty easy to do with an agent. On the other hand, I'm not sure the agent could do it conditionally, and timings are certainly something you might want to do conditionally.
Maybe the approaches can be combined somehow, though I would guess that might require modifying the agent code.
-- Scott
More information about the dev
mailing list