Skip to content
This repository was archived by the owner on Oct 26, 2023. It is now read-only.

Commit 222d5fb

Browse files
committed
Init
0 parents  commit 222d5fb

32 files changed

+4421
-0
lines changed

.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
node_modules/
2+
test_results/
3+
dist/
4+
.nyc_output/
5+
.tern-project
6+
*.js

app.ts

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
2+
import { readFileSync } from "fs";
3+
import { RuleRunner } from './lib/ruleRunner'
4+
import * as yargs from 'yargs';
5+
import { safeLoad } from "js-yaml";
6+
import { Configuration } from './lib/configuration';
7+
import { ConsoleLogger } from "./lib/models/logging/consoleLogger";
8+
import { setupNumeralExtensions } from "./lib/numeralExtensions";
9+
10+
let argv = yargs
11+
.env("EA")
12+
.command('test', "Test a rule. Don't schedule it to run, run it right now!")
13+
.option('rule', {
14+
alias: 'r',
15+
description: 'Which rule or directory of rules to run.',
16+
type: 'string',
17+
required: true
18+
})
19+
.option('elasticsearchHost', {
20+
alias: 'H',
21+
description: 'The elasticsearch host to connect to.',
22+
type: 'string',
23+
required: true
24+
})
25+
.option('elasticsearchPort', {
26+
alias: 'p',
27+
description: 'The elasticsearch port to connect to.',
28+
type: 'number',
29+
default: 9200
30+
})
31+
.option('dryrun', {
32+
alias: 'd',
33+
description: 'Whether or not to actually send out alerts.',
34+
type: 'boolean'
35+
})
36+
.option('outputFile', {
37+
alias: 'o',
38+
description: 'For dryruns, where to send the body of alerts to.',
39+
type: 'string'
40+
})
41+
.option('logLevel', {
42+
alias: 'l',
43+
description: 'The log level to filter by.',
44+
type: 'string',
45+
default: 'Info',
46+
choices: ['Verbose', 'Info', 'Warning', 'Error']
47+
})
48+
.config('config', 'Path to a yaml config file.', (configPath: string) =>
49+
{
50+
return safeLoad(readFileSync(configPath, 'utf-8'));
51+
})
52+
.help()
53+
.alias('help', 'h')
54+
.argv;
55+
56+
setupNumeralExtensions();
57+
58+
let config = new Configuration(argv, __dirname);
59+
let logger = new ConsoleLogger(config.LogLevelFilter);
60+
let runner = new RuleRunner(logger, config);
61+
62+
if (argv._.includes('test'))
63+
{
64+
runner.runTest(config);
65+
}
66+
else
67+
{
68+
runner.run(config);
69+
}
70+
71+
process.on('SIGINT', async () => { runner.stop(); process.exit(0); });
72+
process.on('SIGTERM', async () => { runner.stop(); process.exit(0); });

dockerfile

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM node:alpine
2+
3+
ARG npm_package_name
4+
5+
RUN apk add --update git
6+
7+
# Create app directory
8+
WORKDIR /opt/${npm_package_name}/
9+
10+
# Setup package
11+
COPY package*.json ./
12+
13+
# Install app dependencies
14+
RUN apk add --no-cache --virtual .gyp \
15+
python \
16+
make \
17+
g++ \
18+
&& npm install --production\
19+
&& apk del .gyp
20+
21+
# Bundle app source
22+
COPY ./dist/ ./dist/
23+
24+
CMD [ "npm", "start" ]

examples/config.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
elasticsearchHost: elasticsearch.lan
2+
logLevel: Verbose
3+
smtp:
4+
host: smtp.gmail.com
5+
port: 465
6+
secure: true
7+
user: testUser@gmail.com
8+
pass: testpass
9+

examples/rules/highCpuRule.yaml

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
name: High Cpu Utilization Alert
2+
3+
indexPattern: metricbeat-*
4+
5+
request:
6+
aggs:
7+
hosts:
8+
terms:
9+
field: agent.hostname
10+
aggs:
11+
avg_cpu:
12+
avg:
13+
field: system.cpu.total.norm.pct
14+
last_event:
15+
top_hits:
16+
size: 1
17+
avg_cpu_filter:
18+
bucket_selector:
19+
buckets_path:
20+
avgCpu: avg_cpu
21+
script: params.avgCpu > 0.9 # Alert when average for a host is > 90%
22+
query:
23+
bool:
24+
filter:
25+
- match_all: {}
26+
- match_phrase:
27+
metricset.name: cpu
28+
- match_phrase:
29+
event.module: system
30+
- range:
31+
"@timestamp":
32+
format: strict_date_optional_time
33+
gte: now-15m
34+
lte: now
35+
36+
interval: "*/5 * * * *"
37+
delay: 60000 # Still run every 5 minutes, but shifted by 1 minute
38+
39+
waitBeforeReAlert:
40+
duration:
41+
minutes: 14
42+
43+
alertTrigger:
44+
type: threshold
45+
aggregation: count
46+
operator: gt
47+
value: 0
48+
rowPath: aggregations.hosts.buckets
49+
50+
alert:
51+
type: tiered
52+
53+
restartAfterLast: true
54+
55+
tiers:
56+
# Tier 1
57+
- type: email
58+
59+
to:
60+
- user@gmail.com
61+
from: auto@domain.com
62+
63+
title: 'High Cpu Utilization Alert Tier 1'
64+
65+
summary: 'The following servers have an average cpu utilization above 90% in the last 15 minutes.'
66+
67+
links:
68+
- link: http://elasticsearch.lan:5601/app/infra#/infrastructure
69+
text: Jump to Kibana
70+
71+
tables:
72+
- summary: 'Results:'
73+
rowPath: aggregations.hosts.buckets
74+
columns:
75+
- name: Host
76+
valuePath: key
77+
- name: Total Percent Utilized
78+
valuePath: avg_cpu.value
79+
type: number
80+
format: 0.00%
81+
- name: Cpu Count
82+
valuePath: last_event.hits.hits[0]._source.system.cpu.cores
83+
type: number
84+
85+
# Tier 2
86+
- type: email
87+
88+
to:
89+
- group@gmail.com
90+
from: auto@domain.com
91+
92+
title: 'High Cpu Utilization Alert Tier 2'
93+
94+
summary: 'The following servers have an average cpu utilization above 90% in the last 30 minutes.'
95+
96+
links:
97+
- link: http://elasticsearch.lan:5601/app/infra#/infrastructure
98+
text: Jump to Kibana
99+
100+
tables:
101+
- summary: 'Results:'
102+
rowPath: aggregations.hosts.buckets
103+
columns:
104+
- name: Host
105+
valuePath: key
106+
- name: Total Percent Utilized
107+
valuePath: avg_cpu.value
108+
type: number
109+
format: 0.00%
110+
- name: Cpu Count
111+
valuePath: last_event.hits.hits[0]._source.system.cpu.cores
112+
type: number

examples/rules/highMemoryRule.yaml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: High Memory Usage Alert
2+
3+
indexPattern: metricbeat-*
4+
5+
request:
6+
aggs:
7+
hosts:
8+
terms:
9+
field: agent.hostname
10+
aggs:
11+
avg_memory:
12+
avg:
13+
field: system.memory.actual.used.pct
14+
last_event:
15+
top_hits:
16+
size: 1
17+
avg_memory_filter:
18+
bucket_selector:
19+
buckets_path:
20+
avgMemory: avg_memory
21+
script: params.avgMemory > 0.85 # Alert when average for a host is > 85%
22+
query:
23+
bool:
24+
filter:
25+
- match_all: {}
26+
- match_phrase:
27+
metricset.name: memory
28+
- match_phrase:
29+
event.module: system
30+
- range:
31+
"@timestamp":
32+
format: strict_date_optional_time
33+
gte: now-15m
34+
lte: now
35+
36+
interval: "*/5 * * * *"
37+
38+
waitBeforeReAlert:
39+
duration:
40+
minutes: 14
41+
42+
alertTrigger:
43+
type: threshold
44+
aggregation: count
45+
operator: gt
46+
value: 0
47+
rowPath: aggregations.hosts.buckets
48+
49+
alert:
50+
type: email
51+
52+
to:
53+
- user@gmail.com
54+
from: auto@domain.com
55+
56+
title: 'High Memory Usage Alert'
57+
58+
summary: 'The following servers have an average memory usage above 85% in the last 15 minutes.'
59+
60+
links:
61+
- link: http://elasticsearch.lan:5601/app/infra#/infrastructure
62+
text: Jump to Kibana
63+
64+
tables:
65+
- summary: 'Results:'
66+
rowPath: aggregations.hosts.buckets
67+
columns:
68+
- name: Host
69+
valuePath: key
70+
- name: Total Percent in Use
71+
valuePath: avg_memory.value
72+
type: number
73+
format: 0.00%
74+
- name: Bytes in Use
75+
valuePath: last_event.hits.hits[0]._source.system.memory.actual.used.bytes
76+
type: number
77+
format: 0.00 b
78+
- name: Total Bytes
79+
valuePath: last_event.hits.hits[0]._source.system.memory.total
80+
type: number
81+
format: 0.00 b

0 commit comments

Comments
 (0)