Thread metrics not collected in NFQueue runmode

[rowecharles]

• Suricata version: v7.0.1
• Suricata runmode: nfqueue
• Suricata Exporter version: v0.3.0

After switching Suricata to NFQueue runmode the thread metrics are no longer collected. There are warnings in the logs such as:

2024/05/28 22:52:19 WARN: Unhandled thread: W-NFQ#0
2024/05/28 22:52:19 WARN: Unhandled thread: W-NFQ#1
2024/05/28 22:52:19 WARN: Unhandled thread: W-NFQ#2
2024/05/28 22:52:19 WARN: Unhandled thread: W-NFQ#3

The thread metrics are available from Suricata however the thread names have prefix W-NFQ#:

$ suricatasc -c dump-counters | jq
...
    "threads": {
      "W-NFQ#0": {
        "ips": {
          "accepted": 25624776,
          "blocked": 1457,
...

The exporter expects worker threads to have a prefix W# which is not the case when in nfqueue runmode:

suricata_exporter/main.go

Line 756 in 998e7d9

if strings.HasPrefix(threadName, "W#") {

[awelzel]

@rowecharles / @Neurozone - could you check if v0.4.0-rc1 works for you? I've also added the ips section as individual packet counter metrics. Would be good to get some feedback if this works for you now (possibly attaching a dump-counters.json output with your expectations if not). Thanks!

[Neurozone]

Will check tomorrow :)

[rowecharles]

@awelzel , I've validated on our setup and confirmed that all the thread metrics are now getting collected including the new IP packet counter metrics.

Thanks a lot for the fix and all the work on the project!

[awelzel]

Thanks, I've pushed 0.4.0 now.

[Neurozone]

I also confirm that I don't have theses warnings anymore with version 0.4.
But I have other warnings. I will open another issue for that