byrsapty
31258eee01
Analyzed a real 1GB accel-ppp log (2026-07-23): only 2,819 of its lines were error:/warn:, and one pattern - "can't determine router address" - repeated 2,746 times over ~4 hours for two specific subscriber interfaces before self-resolving, completely unalerted since no alert covered it. - New pipeline rules for 3 previously-unclassified real message types (radius:dm_coa session not found, mac change detected, dhcpv4 short packet) plus a text-based fallback pair (accelppp_unclassified_error/ warn) for anything not yet specifically classified - needed because Vector-shipped accel-ppp lines have no real syslog PRI header, so the numeric-severity generic_critical_severity rule never fires for this source. - New alert7: group by gl2_remote_ip + event_type, fires on >5 occurrences in 5 minutes - low enough to have caught the real incident within its first cycle, high enough to tolerate a single transient warning. - vector-accel-ppp-setup.md gained a "keep only error/warn" filter option (Step 2b), explicitly documented as a deliberate tradeoff: it also drops RADIUS accounting, so the Servers & Sessions dashboard and session correlation go empty for any server that applies it. Both the with-filter and without-filter full configs are included so the choice is per-server, not global. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
600 B
JSON
5 lines
600 B
JSON
{
|
|
"title": "accelppp_mac_change_detected",
|
|
"description": "accel-ppp: a subscriber's MAC address changed mid-session - found live in a real 1GB accel-ppp log sample (2026-07-23), format: 'warn: <interface>: mac change detected'. accelppp_interface is filled in by the accelppp_interface_tag fallback rule, not here.",
|
|
"source": "rule \"accelppp_mac_change_detected\"\nwhen\n contains(to_string($message.message), \"mac change detected\")\nthen\n set_field(\"vendor\", \"accel-ppp\");\n set_field(\"event_type\", \"mac_change_detected\");\n set_field(\"severity_tag\", \"warning\");\nend"
|
|
}
|