ops/logs
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: preserve log alert recovery events

Browse Source
This commit is contained in:
zxr
2026-07-21 21:21:47 +08:00
parent 0655afb5ab
commit eaca3d0ac8
3 changed files with 74 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
internal/ingest/engine.go
View File

@@ -267,11 +267,15 @@ func (e *Engine) HandleSyslog(addr *net.UDPAddr, payload []byte) {
if err != nil {
return 0, err
}
state := "firing"
if isRecoverySignal(parsed.Message, parsed.RawLine) {
state = "resolved"
}
body := AlertReceiveBody{
AlertName: matched.AlertName, Summary: summary, Description: summary,
SeverityCode: firstNonEmpty(matchDetails.SeverityCode, firstNonEmpty(matched.SeverityCode, sev)),
Value: parsed.Message, Labels: labels, Agent: "logs-syslog", PolicyID: matched.PolicyID,
State: "firing", SourceEventKey: logSourceEventKey(stored, "alert"), OccurredAt: occurredAt, RawData: rawBytes,
State: state, SourceEventKey: logSourceEventKey(stored, "alert"), OccurredAt: occurredAt, RawData: rawBytes,
}
return enqueueAlertWithDB(tx, stored.ID, body)
}); err != nil {
@@ -584,10 +588,18 @@ func (e *Engine) HandleTrap(addr *net.UDPAddr, pkt *gosnmp.SnmpPacket) {
if err != nil {
return 0, err
}
state := "firing"
dictText := ""
if dict != nil {
dictText = firstNonEmpty(dict.Name, dict.Title)
}
if isRecoverySignal(readable, dictText, matched.Name, matched.AlertName) {
state = "resolved"
}
body := AlertReceiveBody{
AlertName: firstNonEmpty(matched.AlertName, "SNMP Trap"), Summary: readable, Description: desc,
SeverityCode: firstNonEmpty(matched.SeverityCode, sev), Value: string(vbJSON), Labels: labels,
Agent: "logs-trap", PolicyID: matched.PolicyID, State: "firing",
Agent: "logs-trap", PolicyID: matched.PolicyID, State: state,
SourceEventKey: logSourceEventKey(stored, "alert"), OccurredAt: occurredAt, RawData: rawBytes,
}
return enqueueAlertWithDB(tx, stored.ID, body)
@@ -681,6 +693,21 @@ func firstNonEmpty(a, b string) string {
return b
}
func isRecoverySignal(values ...string) bool {
for _, value := range values {
text := strings.ToLower(strings.TrimSpace(value))
if text == "" {
continue
}
for _, marker := range []string{"恢复", "recovered", "recovery", "ifup", "link up", "port up", "interface up", "normal"} {
if strings.Contains(text, marker) {
return true
}
}
}
return false
}
func (e *Engine) resolveResource(sourceIP, hostname string) (resourceRef, string) {
e.mu.RLock()
ipMap := e.resourceByIP