Documentation
¶
Index ¶
- Constants
- func DayKey(prefix, envUUID, nodeUUID string, day time.Time) string
- func EnvDayKey(prefix, envUUID string, day time.Time) string
- func ErrorRankKey(prefix, envUUID string, day time.Time) string
- type EnvSeries
- type Event
- type EventType
- type NodeErrorCount
- type NodeTileSeries
- type RedisStore
- func (s *RedisStore) IncrementMany(ctx context.Context, events []Event) error
- func (s *RedisStore) ReadEnvSeries(ctx context.Context, envUUID string, end time.Time, days int) (EnvSeries, error)
- func (s *RedisStore) ReadSeries(ctx context.Context, envUUID string, nodeUUIDs []string, end time.Time, ...) (map[string]NodeTileSeries, error)
- func (s *RedisStore) TopErrorNodes(ctx context.Context, envUUID string, end time.Time, days, limit int) ([]NodeErrorCount, error)
Constants ¶
const ( DefaultPrefix = "nodeact:v1" DefaultRetentionDays = 7 BucketSeconds = 3600 BucketsPerDay = 24 // EventTypeCount sizes the per-day blob. New event types MUST be // appended to the end of the EventType list: bitOffset is linear in the // type index, so appending leaves every existing counter at the same // offset and only grows the blob. decodeDay is bounds-safe, so blobs // written before a new type existed simply decode it as zero — which is // why adding one needs no key-prefix bump and loses no history. EventTypeCount = 7 )
Default rollup settings and bucket layout.
Variables ¶
This section is empty.
Functions ¶
func ErrorRankKey ¶ added in v0.5.7
ErrorRankKey returns the Redis key for one environment's UTC day sorted set of per-node error counts.
The hourly blobs are keyed per node, so answering "which nodes are erroring" from them alone would mean reading every node in the environment. This sorted set is the index for that question: ZINCRBY on write, ZREVRANGE on read, so the cost of the dashboard drill-down scales with the number of *erroring* nodes rather than the size of the fleet.
Types ¶
type EnvSeries ¶
type EnvSeries = NodeTileSeries
EnvSeries is a dense activity series ready for environment-level graphs.
type EventType ¶
type EventType uint8
EventType identifies the activity counter family stored in a bucket.
const ( EventEnroll EventType = iota EventConfig EventStatus EventResult EventQueryRead EventQueryWrite // EventStatusError counts status logs the node reported at osquery's // ERROR severity. It is a subset of EventStatus, not a sibling: the // same log increments both, so it is deliberately left out of the // Total series to avoid counting one log twice. EventStatusError )
Supported activity event types.
type NodeErrorCount ¶ added in v0.5.7
NodeErrorCount is one node's error tally over the requested window.
type NodeTileSeries ¶
type NodeTileSeries struct {
Start time.Time `json:"start"`
BucketSeconds int `json:"bucket_seconds"`
Enroll []uint16 `json:"enroll"`
Config []uint16 `json:"config"`
Status []uint16 `json:"status"`
Result []uint16 `json:"result"`
QueryRead []uint16 `json:"query_read"`
QueryWrite []uint16 `json:"query_write"`
StatusError []uint16 `json:"status_error"`
Total []uint16 `json:"total"`
}
NodeTileSeries is a dense activity series ready for node tile rendering.
type RedisStore ¶
type RedisStore struct {
// contains filtered or unexported fields
}
RedisStore manages node activity rollups stored as compact Redis day blobs.
func NewRedisStore ¶
func NewRedisStore(client *redis.Client, prefix string, retentionDays int, expireAfter time.Duration) *RedisStore
NewRedisStore builds a Redis-backed rollup store for per-node activity tiles.
func (*RedisStore) IncrementMany ¶
func (s *RedisStore) IncrementMany(ctx context.Context, events []Event) error
IncrementMany batches activity events into hourly counters per UTC day.
func (*RedisStore) ReadEnvSeries ¶
func (s *RedisStore) ReadEnvSeries(ctx context.Context, envUUID string, end time.Time, days int) (EnvSeries, error)
ReadEnvSeries returns a dense environment activity series for the requested day window.
func (*RedisStore) ReadSeries ¶
func (s *RedisStore) ReadSeries(ctx context.Context, envUUID string, nodeUUIDs []string, end time.Time, days int) (map[string]NodeTileSeries, error)
ReadSeries returns dense node activity series for the requested day window.
func (*RedisStore) TopErrorNodes ¶ added in v0.5.7
func (s *RedisStore) TopErrorNodes(ctx context.Context, envUUID string, end time.Time, days, limit int) ([]NodeErrorCount, error)
TopErrorNodes returns the nodes with the most ERROR-severity status logs in the requested window, worst first, capped at limit.
The window is expressed in whole UTC days because that is how the counters are bucketed; a 24h view spans at most two of them. Each day's ranking is read in full and merged here — bounded by the number of nodes that actually errored, which is the small number in any fleet worth alerting on.
Source Files