byrsapty
31258eee01
Analyzed a real 1GB accel-ppp log (2026-07-23): only 2,819 of its lines were error:/warn:, and one pattern - "can't determine router address" - repeated 2,746 times over ~4 hours for two specific subscriber interfaces before self-resolving, completely unalerted since no alert covered it. - New pipeline rules for 3 previously-unclassified real message types (radius:dm_coa session not found, mac change detected, dhcpv4 short packet) plus a text-based fallback pair (accelppp_unclassified_error/ warn) for anything not yet specifically classified - needed because Vector-shipped accel-ppp lines have no real syslog PRI header, so the numeric-severity generic_critical_severity rule never fires for this source. - New alert7: group by gl2_remote_ip + event_type, fires on >5 occurrences in 5 minutes - low enough to have caught the real incident within its first cycle, high enough to tolerate a single transient warning. - vector-accel-ppp-setup.md gained a "keep only error/warn" filter option (Step 2b), explicitly documented as a deliberate tradeoff: it also drops RADIUS accounting, so the Servers & Sessions dashboard and session correlation go empty for any server that applies it. Both the with-filter and without-filter full configs are included so the choice is per-server, not global. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
587 B
JSON
5 lines
587 B
JSON
{
|
|
"title": "accelppp_dhcpv4_short_packet",
|
|
"description": "accel-ppp: malformed/truncated DHCPv4 packet received - found live in a real 1GB accel-ppp log sample (2026-07-23), format: 'warn: dhcpv4: short packet received' (no interface in the text itself, unlike most other accel-ppp warnings)",
|
|
"source": "rule \"accelppp_dhcpv4_short_packet\"\nwhen\n contains(to_string($message.message), \"dhcpv4: short packet received\")\nthen\n set_field(\"vendor\", \"accel-ppp\");\n set_field(\"event_type\", \"dhcpv4_short_packet\");\n set_field(\"severity_tag\", \"warning\");\nend"
|
|
}
|