Table of Contents
thrift-tools is a library and a set of tools to introspect Apache Thrift traffic.
You can install thrift-tools via pip:
$ pip install thrift-tools
Or run it from source (if you have the dependencies installed, see below):
$ git clone ...
$ cd thrift-tools
$ sudo FROM_SOURCE=1 bin/thrift-tool --iface=eth0 --port 9091 dump --show-all --pretty
...
$ FROM_SOURCE=1 bin/thrift-tool --port 9090 \
--pcap-file thrift_tools/tests/resources/calc-service-binary.pcap \
dump --show-all --pretty --color \
--idl-file=thrift_tools/tests/resources/tutorial.thrift
thrift-tool can be used in interactive mode to analyze live thrift messages:
$ sudo thrift-tool --iface eth0 --port 9091 dump --show-all --pretty
[00:39:42:850848] 10.1.8.7:49858 -> 10.1.2.20:3636: method=dosomething, type=call, seqid=1120
header: ()
fields: [ ( 'struct',
1,
[ ('string', 1, 'something to do'),
('i32', 3, 0),
( 'struct',
9,
[ ('i32', 3, 2),
('i32', 14, 0),
('i32', 16, 0),
('i32', 18, 25)])])]
------>[00:39:42:856204] 10.1.2.20:3636 -> 10.1.8.7:49858: method=dosomething, type=reply, seqid=1120
header: ()
fields: [ ( 'struct',
0,
[ ('string', 1, 'did something'),
('string', 2, 'did something else'),
('string', 3, 'did some other thing'),
('string', 4, 'did the last thing'),
('i32', 6, 3),
('i32', 7, 11),
('i32', 8, 0),
('i32', 9, 0),
('list', 10, [0]),
...
Alternatively, offline pcap files may be introspected:
$ sudo thrift-tool --port 9091 --pcap-file /path/to/myservice.pcap dump ...
Note that you still need to set the right port.
If you are using Finagle, try something like:
$ sudo thrift-tool --iface eth0 --port 9091 dump --show-all --pretty --finagle-thrift ...
JSON output is available for easy filtering & querying via jq. For instance, you can enumerate all the IPs calling the method 'search' via:
$ sudo thrift-tool --port 3030 dump --unpaired --json | jq 'select(.method == "search" and .type == "call") | .src' "10.1.18.5:48534" "10.1.60.2:52008" "10.1.10.27:49856" "10.1.23.24:48116" "10.1.26.7:60462" "10.1.11.10:41895" "10.1.15.13:35285" "10.1.7.17:39759" "10.1.1.19:35481" ...
Gathering per method latency stats is available via the stats
command:
$ sudo thrift-tool --port 6666 stats --count 100 method count avg min max p90 p95 p99 p999 -------- ------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- search2 61 0.00860996 0.00636292 0.0188479 0.010778 0.015192 0.0174422 0.0187074 doc 39 0.00134846 0.00099802 0.00274897 0.00177183 0.00199242 0.00256242 0.00273031 287 unmatched calls
You can also specify .thrift file for nicer output:
$ sudo thrift-tool --port 9091 dump --show-all --pretty --color --idl-file /path/to/myidl.thrift ...
To list all the available options:
$ thrift-tool --help
Note that for servers with high throughput (i.e.: > couple Ks packets per second), it might be hard for thrift-tools to keep up because start of message detection is a bit expensive (and you can only go so fast with Python). For these cases, you are better off saving a pcap file (i.e.: via tcpdump) and then post-processing it, i.e.:
$ tcpdump -nn -t port 3030 -w dump.pcap $ sudo thrift-tool --port 3030 --pcap-file dump.pcap stats --count 40000 method count avg min max p90 p95 p99 p999 -------- ------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- resize 40000 0.00850996 0.00336091 0.0101364 0.008071 0.009132 0.009890 0.01005665
To use thrift-tools from another (Python) application, you can import it via:
from thrift_tools.message_sniffer import MessageSnifferOptions, MessageSniffer
options = MessageSnifferOptions(
iface='eth0',
port='3636',
ip=None, # include msgs from all IPs
pcap_file=None, # don't read from a pcap file, live sniff
protocol=None, # auto detect protocol
finagle_thrift=False, # apache thrift (not twitter's finagle)
read_values=True, # read the values of each msg/struct
max_queued=20000, # decent sized queue
max_message_size=2000, # 2k messages to keep mem usage frugal
debug=False # don't print parsing errors, etc
)
def printer(timestamp, src, dst, msg):
print '%s %s %s %s' % (timestamp, src, dst, msg)
message_sniffer = MessageSniffer(options, printer)
# loop forever
message_sniffer.join()
Of if you want to use a pcap file:
options = MessageSnifferOptions(
iface='eth0',
port='3636',
ip=None,
pcap_file="/tmp/myservice.pcap",
protocol=None,
finagle_thrift=False,
read_values=True,
max_queued=20000,
max_message_size=2000,
debug=False
)
...
If you want to filter messages for specific IPs:
options = MessageSnifferOptions(
iface='eth0',
port='3636',
ip=['172.16.24.3', '172.16.24.4'], # ignores everyone else
pcap_file="/tmp/myservice.pcap",
protocol=None,
finagle_thrift=False,
read_values=True,
max_queued=20000,
max_message_size=2000,
debug=False
)
...
See examples/ for more ways to use this library!
To run the tests:
$ python setup.py nosetests