Skip to content

Commit 5487e52

Browse files
mickemmickem
committed
real time filters: added silent period to prevent filters from firing multiple events
1 parent 740a64d commit 5487e52

File tree

9 files changed

+128
-44
lines changed

9 files changed

+128
-44
lines changed

‎docs/docs/reference/check/CheckLogFile.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,7 @@ This is a section of objects. This means that you will create objects below this
311311
| perf config | | PERF CONFIG |
312312
| read entire file | | read entire file |
313313
| severity | | SEVERITY |
314+
| silent period | false | Silent period |
314315
| source id | | SOURCE ID |
315316
| target | | DESTINATION |
316317
| target id | | TARGET ID |
@@ -341,6 +342,7 @@ maximum age=5m
341342
#perf config=...
342343
#read entire file=...
343344
#severity=...
345+
silent period=false
344346
#source id=...
345347
#target=...
346348
#target id=...

‎docs/docs/reference/windows/CheckDisk.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,7 @@ L cli WARNING: WARNING: 0/1 files (AsChkDev.txt: 328)
353353
L cli Performance data: 'count'=1;0;0
354354
```
355355

356-
### Check file sizes
356+
#### Check file sizes
357357

358358
```
359359
check_files path=c:/windows pattern=*.txt "detail-syntax=%(filename): %(size)" "warn=size>20k" max-depth=1

‎docs/docs/reference/windows/CheckEventLog.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -812,6 +812,7 @@ This is a section of objects. This means that you will create objects below this
812812
| ok syntax | | SYNTAX |
813813
| perf config | | PERF CONFIG |
814814
| severity | | SEVERITY |
815+
| silent period | false | Silent period |
815816
| source id | | SOURCE ID |
816817
| target | | DESTINATION |
817818
| target id | | TARGET ID |
@@ -840,6 +841,7 @@ maximum age=5m
840841
#ok syntax=...
841842
#perf config=...
842843
#severity=...
844+
silent period=false
843845
#source id=...
844846
#target=...
845847
#target id=...

‎docs/docs/reference/windows/CheckSystem.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2441,6 +2441,7 @@ This is a section of objects. This means that you will create objects below this
24412441
| ok syntax | | SYNTAX |
24422442
| perf config | | PERF CONFIG |
24432443
| severity | | SEVERITY |
2444+
| silent period | false | Silent period |
24442445
| source id | | SOURCE ID |
24452446
| target | | DESTINATION |
24462447
| target id | | TARGET ID |
@@ -2469,6 +2470,7 @@ maximum age=5m
24692470
#ok syntax=...
24702471
#perf config=...
24712472
#severity=...
2473+
silent period=false
24722474
#source id=...
24732475
#target=...
24742476
#target id=...
@@ -2510,6 +2512,7 @@ This is a section of objects. This means that you will create objects below this
25102512
| ok syntax | | SYNTAX |
25112513
| perf config | | PERF CONFIG |
25122514
| severity | | SEVERITY |
2515+
| silent period | false | Silent period |
25132516
| source id | | SOURCE ID |
25142517
| target | | DESTINATION |
25152518
| target id | | TARGET ID |
@@ -2536,6 +2539,7 @@ maximum age=5m
25362539
#ok syntax=...
25372540
#perf config=...
25382541
#severity=...
2542+
silent period=false
25392543
#source id=...
25402544
#target=...
25412545
#target id=...
@@ -2576,6 +2580,7 @@ This is a section of objects. This means that you will create objects below this
25762580
| ok syntax | | SYNTAX |
25772581
| perf config | | PERF CONFIG |
25782582
| severity | | SEVERITY |
2583+
| silent period | false | Silent period |
25792584
| source id | | SOURCE ID |
25802585
| target | | DESTINATION |
25812586
| target id | | TARGET ID |
@@ -2602,6 +2607,7 @@ maximum age=5m
26022607
#ok syntax=...
26032608
#perf config=...
26042609
#severity=...
2610+
silent period=false
26052611
#source id=...
26062612
#target=...
26072613
#target id=...
@@ -2643,6 +2649,7 @@ This is a section of objects. This means that you will create objects below this
26432649
| perf config | | PERF CONFIG |
26442650
| process | | PROCESS |
26452651
| severity | | SEVERITY |
2652+
| silent period | false | Silent period |
26462653
| source id | | SOURCE ID |
26472654
| target | | DESTINATION |
26482655
| target id | | TARGET ID |
@@ -2669,6 +2676,7 @@ maximum age=5m
26692676
#perf config=...
26702677
#process=...
26712678
#severity=...
2679+
silent period=false
26722680
#source id=...
26732681
#target=...
26742682
#target id=...

‎docs/samples/CheckDisk_check_files_samples.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ L cli WARNING: WARNING: 0/1 files (AsChkDev.txt: 328)
2626
L cli Performance data: 'count'=1;0;0
2727
```
2828

29-
### Check file sizes
29+
#### Check file sizes
3030

3131
```
3232
check_files path=c:/windows pattern=*.txt "detail-syntax=%(filename): %(size)" "warn=size>20k" max-depth=1

‎include/nscapi/nscapi_settings_filter.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ namespace nscapi {
5757
("maximum age", sh::string_fun_key(boost::bind(&filter_object::set_max_age, this, _1), "5m"),
5858
"MAGIMUM AGE", "How long before reporting \"ok\".\nIf this is set to \"false\" no periodic ok messages will be reported only errors.")
5959

60+
("silent period", sh::string_fun_key(boost::bind(&filter_object::set_silent_period, this, _1), "false"),
61+
"Silent period", "How long before a new alert is reported after an alert is reported. In other words whenever an alert is fired and a notification is sent the same notification will not be sent again until this period has ended.\nIf this is set to \"false\" no periodic ok messages will be reported only errors.")
62+
6063
("empty message", sh::string_key(&timeout_msg, "eventlog found no records"),
6164
"EMPTY MESSAGE", "The message to display if nothing matches the filter (generally considered the ok state).", !is_default)
6265

‎include/nscapi/nscapi_settings_filter.hpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ namespace nscapi {
4747
NSCAPI::nagiosReturn severity;
4848
std::string command;
4949
boost::optional<boost::posix_time::time_duration> max_age;
50+
boost::optional<boost::posix_time::time_duration> silent_period;
5051
std::string target_id;
5152
std::string source_id;
5253
std::string timeout_msg;
@@ -76,6 +77,7 @@ namespace nscapi {
7677
, severity(other.severity)
7778
, command(other.command)
7879
, max_age(other.max_age)
80+
, silent_period(other.silent_period)
7981
, target_id(other.target_id)
8082
, source_id(other.source_id)
8183
, timeout_msg(other.timeout_msg)
@@ -114,6 +116,10 @@ namespace nscapi {
114116
if (age != "none" && age != "infinite" && age != "false" && age != "off")
115117
max_age = parse_time(age);
116118
}
119+
void set_silent_period(std::string age) {
120+
if (age != "none" && age != "infinite" && age != "false" && age != "off")
121+
silent_period = parse_time(age);
122+
}
117123

118124
void read_object(nscapi::settings_helper::path_extension &path, const bool is_default);
119125
void apply_parent(const filter_object &parent);

‎include/parsers/filter/realtime_helper.hpp‎

Lines changed: 94 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -47,25 +47,92 @@ namespace parsers {
4747
typedef typename runtime_data::transient_data_type transient_data_type;
4848
typedef boost::optional<boost::posix_time::time_duration> op_duration;
4949
struct container {
50+
private:
5051
std::string alias;
52+
std::string event_name;
5153
std::string target;
5254
std::string target_id;
5355
std::string source_id;
56+
public:
5457
std::string command;
5558
std::string timeout_msg;
5659
NSCAPI::nagiosReturn severity;
57-
runtime_data data;
58-
filter_type filter;
5960
boost::optional<boost::posix_time::time_duration> max_age;
61+
boost::optional<boost::posix_time::time_duration> silent_period;
62+
63+
// should be private...
64+
filter_type filter;
65+
66+
private:
6067
boost::posix_time::ptime next_ok_;
68+
boost::posix_time::ptime next_alert_;
69+
public:
6170
bool debug;
6271
bool escape_html;
63-
std::string event_name;
64-
container() : debug(false), escape_html(false) {}
72+
runtime_data data;
73+
74+
container(std::string alias, std::string event_name, runtime_data data) : alias(alias), event_name(event_name), command(alias), debug(false), escape_html(false), data(data) {}
75+
76+
void set_target(std::string new_target, std::string new_target_id, std::string new_source_id) {
77+
target = new_target;
78+
target_id = new_target_id;
79+
source_id = new_source_id;
80+
}
81+
bool is_event() const {
82+
return target == "event";
83+
}
84+
bool is_events() const {
85+
return target == "events";
86+
}
87+
88+
std::string get_event_name() const {
89+
return event_name;
90+
}
91+
std::string get_alias() const {
92+
return alias;
93+
}
94+
std::string get_target() const {
95+
return target;
96+
}
97+
std::string get_target_id() const {
98+
return target_id;
99+
}
100+
std::string get_source_id() const {
101+
return source_id;
102+
}
103+
104+
bool build_filters(nscapi::settings_filters::filter_object config, std::string &error) {
105+
std::string message;
106+
if (!filter.build_syntax(config.debug, config.syntax_top, config.syntax_detail, config.perf_data, config.perf_config, config.syntax_ok, config.syntax_empty, message)) {
107+
error = "Failed to build strings " + alias + ": " + message;
108+
return false;
109+
}
110+
if (!filter.build_engines(config.debug, config.filter_string, config.filter_ok, config.filter_warn, config.filter_crit)) {
111+
error = "Failed to build filters: " + alias;
112+
return false;
113+
}
114+
115+
if (!filter.validate(message)) {
116+
error = "Failed to validate filter for " + alias + ": " + message;
117+
return false;
118+
}
119+
return true;
120+
}
121+
122+
bool is_silent(const boost::posix_time::ptime &now) {
123+
if (!silent_period) {
124+
return false;
125+
}
126+
return now < next_alert_;
127+
}
65128

66-
void touch(const boost::posix_time::ptime &now) {
129+
void touch(const boost::posix_time::ptime &now, bool alert) {
67130
if (max_age)
68131
next_ok_ = now + (*max_age);
132+
if (alert && silent_period)
133+
next_alert_ = now + (*silent_period);
134+
else if (silent_period)
135+
next_alert_ = now;
69136
data.touch(now);
70137
}
71138

@@ -90,37 +157,23 @@ namespace parsers {
90157
std::list<container_type> items;
91158

92159
bool add_item(const boost::shared_ptr<config_object> object, const runtime_data &source_data, const std::string event_name) {
93-
container_type item(new container);
94-
item->event_name = event_name;
95-
item->alias = object->get_alias();
96-
item->data = source_data;
97-
item->target = object->filter.target;
98-
item->target_id = object->filter.target_id;
99-
item->source_id = object->filter.source_id;
100-
item->command = item->alias;
160+
container_type item(new container(object->get_alias(), event_name, source_data));
161+
item->set_target(object->filter.target, object->filter.target_id, object->filter.source_id);
101162
item->timeout_msg = object->filter.timeout_msg;
102163
item->severity = object->filter.severity;
103164
item->max_age = object->filter.max_age;
165+
item->silent_period = object->filter.silent_period;
104166
item->debug = object->filter.debug;
105167
item->escape_html = object->filter.escape_html;
106168
if (!object->filter.command.empty())
107169
item->command = object->filter.command;
108170
std::string message;
109171

110-
if (!item->filter.build_syntax(object->filter.debug, object->filter.syntax_top, object->filter.syntax_detail, object->filter.perf_data, object->filter.perf_config, object->filter.syntax_ok, object->filter.syntax_empty, message)) {
111-
NSC_LOG_ERROR("Failed to build strings " + object->get_alias() + ": " + message);
112-
return false;
113-
}
114-
if (!item->filter.build_engines(object->filter.debug, object->filter.filter_string, object->filter.filter_ok, object->filter.filter_warn, object->filter.filter_crit)) {
115-
NSC_LOG_ERROR("Failed to build filters: " + object->get_alias());
172+
if (!item->build_filters(object->filter, message)) {
173+
NSC_LOG_ERROR(message);
116174
return false;
117175
}
118176

119-
std::string error;
120-
if (!item->filter.validate(error)) {
121-
NSC_LOG_ERROR("Failed to validate filter for " + object->get_alias() + ": " + error);
122-
return false;
123-
}
124177
item->data.boot();
125178
items.push_back(item);
126179
return true;
@@ -129,14 +182,14 @@ namespace parsers {
129182
void process_timeout(const container_type item) {
130183
std::string response;
131184
nscapi::core_helper ch(core, plugin_id);
132-
if (!ch.submit_simple_message(item->target, item->source_id, item->target_id, item->command, NSCAPI::query_return_codes::returnOK, item->timeout_msg, "", response)) {
185+
if (!ch.submit_simple_message(item->get_target(), item->get_source_id(), item->get_target_id(), item->command, NSCAPI::query_return_codes::returnOK, item->timeout_msg, "", response)) {
133186
NSC_LOG_ERROR("Failed to submit result: " + response);
134187
}
135188
}
136189

137-
bool process_item(container_type item, transient_data_type data) {
190+
bool process_item(container_type item, transient_data_type data, bool is_silent) {
138191
std::string response;
139-
if (item->target == "events" || item->target == "event") {
192+
if (item->is_events() || item->is_event()) {
140193
item->filter.fetch_hash(true);
141194
}
142195
item->filter.start_match();
@@ -148,22 +201,27 @@ namespace parsers {
148201
return false;
149202
}
150203

204+
if (is_silent) {
205+
NSC_TRACE_MSG("Eventlog filter is silenced " + item->get_alias());
206+
return true;
207+
}
208+
151209
nscapi::core_helper ch(core, plugin_id);
152-
if (item->target == "event") {
210+
if (item->is_event()) {
153211
typedef std::list<std::map<std::string, std::string> > list_type;
154212
typedef std::map<std::string, std::string> hash_type;
155213

156214
list_type keys = item->filter.records_;
157215
BOOST_FOREACH(hash_type &bundle, keys) {
158-
if (!ch.emit_event(item->event_name, item->alias, bundle, response)) {
216+
if (!ch.emit_event(item->get_event_name(), item->get_alias(), bundle, response)) {
159217
NSC_LOG_ERROR("Failed to submit '" + response);
160218
}
161219
}
162220
return true;
163221
}
164-
if (item->target == "events") {
222+
if (item->is_events()) {
165223
std::list<std::map<std::string, std::string> > keys = item->filter.records_;
166-
if (!ch.emit_event(item->event_name, item->alias, keys, response)) {
224+
if (!ch.emit_event(item->get_event_name(), item->get_alias(), keys, response)) {
167225
NSC_LOG_ERROR("Failed to submit '" + response);
168226
}
169227
return true;
@@ -172,7 +230,7 @@ namespace parsers {
172230
std::string message = item->filter.get_message();
173231
if (message.empty())
174232
message = "Nothing matched";
175-
if (!ch.submit_simple_message(item->target, item->source_id, item->target_id, item->command, item->filter.summary.returnCode, message, "", response)) {
233+
if (!ch.submit_simple_message(item->get_target(), item->get_source_id(), item->get_target_id(), item->command, item->filter.summary.returnCode, message, "", response)) {
176234
NSC_LOG_ERROR("Failed to submit '" + message);
177235
}
178236
return true;
@@ -181,7 +239,7 @@ namespace parsers {
181239
void touch_all() {
182240
boost::posix_time::ptime current_time = boost::posix_time::second_clock::local_time();
183241
BOOST_FOREACH(container_type item, items) {
184-
item->touch(current_time);
242+
item->touch(current_time, false);
185243
}
186244
}
187245

@@ -197,9 +255,9 @@ namespace parsers {
197255
BOOST_FOREACH(container_type item, items) {
198256
if (item->data.has_changed(data)) {
199257
has_changed = true;
200-
if (process_item(item, data)) {
258+
if (process_item(item, data, item->is_silent(current_time))) {
201259
has_matched = true;
202-
item->touch(current_time);
260+
item->touch(current_time, true);
203261
}
204262
}
205263
}
@@ -224,7 +282,7 @@ namespace parsers {
224282
BOOST_FOREACH(container_type item, items) {
225283
if (item->has_timedout(current_time)) {
226284
process_timeout(item);
227-
item->touch(current_time);
285+
item->touch(current_time, false);
228286
}
229287
}
230288
} catch (...) {

0 commit comments

Comments
 (0)