byrsapty
31258eee01
Analyzed a real 1GB accel-ppp log (2026-07-23): only 2,819 of its lines were error:/warn:, and one pattern - "can't determine router address" - repeated 2,746 times over ~4 hours for two specific subscriber interfaces before self-resolving, completely unalerted since no alert covered it. - New pipeline rules for 3 previously-unclassified real message types (radius:dm_coa session not found, mac change detected, dhcpv4 short packet) plus a text-based fallback pair (accelppp_unclassified_error/ warn) for anything not yet specifically classified - needed because Vector-shipped accel-ppp lines have no real syslog PRI header, so the numeric-severity generic_critical_severity rule never fires for this source. - New alert7: group by gl2_remote_ip + event_type, fires on >5 occurrences in 5 minutes - low enough to have caught the real incident within its first cycle, high enough to tolerate a single transient warning. - vector-accel-ppp-setup.md gained a "keep only error/warn" filter option (Step 2b), explicitly documented as a deliberate tradeoff: it also drops RADIUS accounting, so the Servers & Sessions dashboard and session correlation go empty for any server that applies it. Both the with-filter and without-filter full configs are included so the choice is per-server, not global. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
702 B
JSON
5 lines
702 B
JSON
{
|
|
"title": "accelppp_unclassified_error",
|
|
"description": "accel-ppp: fallback for any 'error:' line that no specific rule already classified - same catch-all philosophy as generic_critical_severity, but text-based (Vector-shipped accel-ppp lines have no real syslog PRI header, so the numeric severity field is always -1/unparseable and generic_critical_severity never fires for this source).",
|
|
"source": "rule \"accelppp_unclassified_error\"\nwhen\n !has_field(\"event_type\") && contains(to_string($message.message), \"error:\")\nthen\n set_field(\"vendor\", \"accel-ppp\");\n set_field(\"event_type\", \"accelppp_unclassified_error\");\n set_field(\"severity_tag\", \"critical\");\nend"
|
|
}
|