byrsapty
7c0738d68e
alert8: any-match critical hardware/power alarms (dying_gasp, ONU config/HAL/info failures, PSU/memory/ASIC faults, cold start) - same fire-on-every-occurrence philosophy as alert4_juniper_chassis_alarm. alert9: repeated-warning threshold on severity_tag:warning, grouped by device+event_type, >5 in 5min - same philosophy as alert7_accelppp_repeated_error_warn (a single occurrence can be transient; repetition means a real problem). Covers signal degradation, low optical power, BGP/LACP flapping, DDoS/SNMP violations, etc. Deliberately excludes purely informational event_types (logins, config_saved, ONU registration, alarm-cleared/recovery events) to avoid noise. Not yet verified live - same caveat as the rule27-84 commit, the test container is still unreachable.
21 lines
1.2 KiB
JSON
21 lines
1.2 KiB
JSON
{
|
|
"title": "WARNING: repeated network equipment warning from one device",
|
|
"description": "Same 'single occurrence can be transient, repetition means a real problem' philosophy as alert7_accelppp_repeated_error_warn, applied to the new Network Equipment rules (rule27-84): repeated ONU signal-loss/offline, optical low power, BGP session resets, LACP timeouts, link flapping, DDoS violations, SNMP auth violations, etc. from the same device. Threshold matches alert7 (>5 in 5 minutes). Built from the user's log-signature report; not yet confirmed against real device output.",
|
|
"priority": 2,
|
|
"alert": true,
|
|
"config": {
|
|
"type": "aggregation-v1",
|
|
"query": "severity_tag:warning",
|
|
"streams": ["__NETWORK_STREAM_ID__"],
|
|
"group_by": ["gl2_remote_ip", "event_type"],
|
|
"series": [{"type": "count", "id": "count-", "field": null}],
|
|
"conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 5.0}}},
|
|
"search_within_ms": 300000,
|
|
"execute_every_ms": 300000,
|
|
"event_limit": 50
|
|
},
|
|
"field_spec": {},
|
|
"key_spec": [],
|
|
"notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
|
|
"notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
|
|
}
|