byrsapty
7c0738d68e
alert8: any-match critical hardware/power alarms (dying_gasp, ONU config/HAL/info failures, PSU/memory/ASIC faults, cold start) - same fire-on-every-occurrence philosophy as alert4_juniper_chassis_alarm. alert9: repeated-warning threshold on severity_tag:warning, grouped by device+event_type, >5 in 5min - same philosophy as alert7_accelppp_repeated_error_warn (a single occurrence can be transient; repetition means a real problem). Covers signal degradation, low optical power, BGP/LACP flapping, DDoS/SNMP violations, etc. Deliberately excludes purely informational event_types (logins, config_saved, ONU registration, alarm-cleared/recovery events) to avoid noise. Not yet verified live - same caveat as the rule27-84 commit, the test container is still unreachable.
21 lines
1.3 KiB
JSON
21 lines
1.3 KiB
JSON
{
|
|
"title": "CRITICAL: network equipment hardware/power alarm",
|
|
"description": "Any-match critical alarm from the new BDCOM EPON/GPON, ZTE, Juniper, or D-Link rules (rule27-84): ONU dying gasp/power loss, ONU config/HAL driver failure, PSU failure, memory parity error, ASIC/PFE error, or a switch cold start. Same 'fires on every occurrence, no threshold' philosophy as alert4_juniper_chassis_alarm - these are hardware-level failures, not transient noise. Built from the user's log-signature report; not yet confirmed against real device output (see rules/rule27-84 descriptions).",
|
|
"priority": 3,
|
|
"alert": true,
|
|
"config": {
|
|
"type": "aggregation-v1",
|
|
"query": "event_type:dying_gasp OR event_type:onu_config_error OR event_type:hal_driver_error OR event_type:onu_info_failed OR event_type:psu_failure OR event_type:memory_parity_error OR event_type:asic_error OR event_type:system_reboot",
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"group_by": [],
|
|
"series": [],
|
|
"conditions": {"expression": null},
|
|
"search_within_ms": 60000,
|
|
"execute_every_ms": 60000,
|
|
"event_limit": 100
|
|
},
|
|
"field_spec": {},
|
|
"key_spec": [],
|
|
"notification_settings": {"grace_period_ms": 600000, "backlog_size": 5},
|
|
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
|
|
}
|