byrsapty
510ca37e48
- Two flood-detection alerts (per-source message volume, calibrated live against real traffic) grouped by gl2_remote_ip - Session correlation: accelppp_interface fallback tagging plus radius_session_id/calling_station_id/radius_username extraction, so a subscriber's full session lifecycle is searchable by one key - Replace the single combined dashboard with three focused ones (Overview & Alerts, Network Equipment, Servers & Sessions) - Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable install script and templates - Add a Forgejo Actions workflow (manual trigger) that re-runs install-graylog.sh on a self-hosted runner living in the container, automating the deploy step this project has done by hand all along Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
1.1 KiB
JSON
21 lines
1.1 KiB
JSON
{
|
|
"title": "WARNING: abnormal syslog volume from network equipment",
|
|
"description": "A single switch/OLT/router is sending far more syslog messages than normal - often a symptom of interface flapping, an ARP/MAC-move loop, or a spanning-tree issue. Threshold calibrated live on 2026-07-22 against real network equipment traffic: the observed device was steadily sending ~30-60 msgs/5min (~360/hour) under normal conditions, so the threshold gives roughly 10x headroom above that baseline.",
|
|
"priority": 2,
|
|
"alert": true,
|
|
"config": {
|
|
"type": "aggregation-v1",
|
|
"query": "*",
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"group_by": ["gl2_remote_ip"],
|
|
"series": [{"type": "count", "id": "count-", "field": null}],
|
|
"conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 500.0}}},
|
|
"search_within_ms": 300000,
|
|
"execute_every_ms": 300000,
|
|
"event_limit": 50
|
|
},
|
|
"field_spec": {},
|
|
"key_spec": [],
|
|
"notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
|
|
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
|
|
}
|