byrsapty
510ca37e48
- Two flood-detection alerts (per-source message volume, calibrated live against real traffic) grouped by gl2_remote_ip - Session correlation: accelppp_interface fallback tagging plus radius_session_id/calling_station_id/radius_username extraction, so a subscriber's full session lifecycle is searchable by one key - Replace the single combined dashboard with three focused ones (Overview & Alerts, Network Equipment, Servers & Sessions) - Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable install script and templates - Add a Forgejo Actions workflow (manual trigger) that re-runs install-graylog.sh on a self-hosted runner living in the container, automating the deploy step this project has done by hand all along Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
1.2 KiB
JSON
21 lines
1.2 KiB
JSON
{
|
|
"title": "WARNING: abnormal message volume from one server",
|
|
"description": "A single server is sending far more syslog messages than its established baseline - possible log loop, misconfiguration, or a genuine incident generating excessive events. Left unchecked this can fill the retention window's disk budget early. Threshold calibrated live on 2026-07-22 against real accel-ppp/RADIUS traffic: the one active NAS server was steadily sending ~4,600-4,800 msgs/10min (~278k/hour) under totally normal load, so the threshold is set to roughly 3x that baseline.",
|
|
"priority": 2,
|
|
"alert": true,
|
|
"config": {
|
|
"type": "aggregation-v1",
|
|
"query": "*",
|
|
"streams": ["__SERVERS_STREAM_ID__"],
|
|
"group_by": ["gl2_remote_ip"],
|
|
"series": [{"type": "count", "id": "count-", "field": null}],
|
|
"conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 150000.0}}},
|
|
"search_within_ms": 600000,
|
|
"execute_every_ms": 600000,
|
|
"event_limit": 50
|
|
},
|
|
"field_spec": {},
|
|
"key_spec": [],
|
|
"notification_settings": {"grace_period_ms": 1800000, "backlog_size": 5},
|
|
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
|
|
}
|