zotac/graylog-deploy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add alerts for the new BDCOM/ZTE/Juniper/D-Link event types (rule27-84)

Browse source 
alert8: any-match critical hardware/power alarms (dying_gasp, ONU
config/HAL/info failures, PSU/memory/ASIC faults, cold start) - same
fire-on-every-occurrence philosophy as alert4_juniper_chassis_alarm.

alert9: repeated-warning threshold on severity_tag:warning, grouped by
device+event_type, >5 in 5min - same philosophy as
alert7_accelppp_repeated_error_warn (a single occurrence can be
transient; repetition means a real problem). Covers signal degradation,
low optical power, BGP/LACP flapping, DDoS/SNMP violations, etc.

Deliberately excludes purely informational event_types (logins,
config_saved, ONU registration, alarm-cleared/recovery events) to avoid
noise.

Not yet verified live - same caveat as the rule27-84 commit, the test
container is still unreachable.
This commit is contained in:
byrsapty 2026-07-29 16:54:53 +03:00
parent 98359c7ca3
commit 7c0738d68e
2 changed files with 42 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
alerts/alert8_network_hardware_alarm.json Normal file
View file

@ -0,0 +1,21 @@
{
"title": "CRITICAL: network equipment hardware/power alarm",
"description": "Any-match critical alarm from the new BDCOM EPON/GPON, ZTE, Juniper, or D-Link rules (rule27-84): ONU dying gasp/power loss, ONU config/HAL driver failure, PSU failure, memory parity error, ASIC/PFE error, or a switch cold start. Same 'fires on every occurrence, no threshold' philosophy as alert4_juniper_chassis_alarm - these are hardware-level failures, not transient noise. Built from the user's log-signature report; not yet confirmed against real device output (see rules/rule27-84 descriptions).",
"priority": 3,
"alert": true,
"config": {
"type": "aggregation-v1",
"query": "event_type:dying_gasp OR event_type:onu_config_error OR event_type:hal_driver_error OR event_type:onu_info_failed OR event_type:psu_failure OR event_type:memory_parity_error OR event_type:asic_error OR event_type:system_reboot",
"streams": ["__NETWORK_STREAM_ID__"],
"group_by": [],
"series": [],
"conditions": {"expression": null},
"search_within_ms": 60000,
"execute_every_ms": 60000,
"event_limit": 100
},
"field_spec": {},
"key_spec": [],
"notification_settings": {"grace_period_ms": 600000, "backlog_size": 5},
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}

21
alerts/alert9_network_repeated_warning.json Normal file
View file

@ -0,0 +1,21 @@
{
"title": "WARNING: repeated network equipment warning from one device",
"description": "Same 'single occurrence can be transient, repetition means a real problem' philosophy as alert7_accelppp_repeated_error_warn, applied to the new Network Equipment rules (rule27-84): repeated ONU signal-loss/offline, optical low power, BGP session resets, LACP timeouts, link flapping, DDoS violations, SNMP auth violations, etc. from the same device. Threshold matches alert7 (>5 in 5 minutes). Built from the user's log-signature report; not yet confirmed against real device output.",
"priority": 2,
"alert": true,
"config": {
"type": "aggregation-v1",
"query": "severity_tag:warning",
"streams": ["__NETWORK_STREAM_ID__"],
"group_by": ["gl2_remote_ip", "event_type"],
"series": [{"type": "count", "id": "count-", "field": null}],
"conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 5.0}}},
"search_within_ms": 300000,
"execute_every_ms": 300000,
"event_limit": 50
},
"field_spec": {},
"key_spec": [],
"notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}