emanuele-f
0be2da4f57
Cleanup remaining references to RTT
2020-04-20 12:21:39 +02:00
Simone Mainardi
1eb02b2c2b
Unifies alert_id and alert_key
2020-04-15 14:29:03 +02:00
Simone Mainardi
e487427aab
Refactors alert_utils and enterprise_alert_utils
...
Addresses #3720
Alerts Refactor: alert_utils as module
Alerts Refactor: notify_ntopng_start and notify_ntopng_stop
Alerts Refactor: processAlertNotifications
Alerts Refactor: checkStoreAlertsFromC
Alerts Refactor: formatAlertNotification
Alerts Refactor: notification_timestamp_rev
Alerts Refactor: formatAlertMessage
Alerts Refactor: getConfigsetAlertLink
Alerts Refactor: alertNotificationActionToLabel
Alerts Refactor: flushAlertsData
Alerts Refactor: disableAlertsGeneration
Alerts Refactor: newAlertsWorkingStatus and other
Alerts Refactor: drawAlerts
Alerts Refactor: drawAlertTables
Alerts Refactor: printAlertTables
Alerts Refactor: checkDeleteStoredAlerts
Alerts Refactor: getUnpagedAlertOptions
Alerts Refactor: getTabParameters
Alerts Refactor: getAlerts
Alerts Refactor: getNumAlerts
Alerts Refactor: performAlertsQuery
Alerts Refactor: sec2granularity
Alerts Refactor: granularity2id
Alerts Refactor: granularity2sec
Alerts Refactor: alertEngineLabel
Alerts Refactor: alertEngine
Alerts Refactor: alertEngineRaw
Alerts Refactor: alertTypeDescription
Alerts Refactor: alertType
Alerts Refactor: alertTypeLabel
Alerts Refactor: alertTypeRaw
Alerts Refactor: alertSeverity
Alerts Refactor: alertSeverityLabel
Alerts Refactor: alertSeverityRaw
Alerts Refactor: get_make_room_keys
Alerts Refactor: enterprise_alert_utils
2020-04-10 14:03:20 +02:00
emanuele-f
02c36d4140
Replace calls to getResolvedAddress with host2name
2020-03-31 11:52:50 +02:00
emanuele-f
983fea5701
Fix bad SNMP interface formatter
...
Fixes #3659
2020-03-27 17:40:51 +01:00
Simone Mainardi
3144bc8bdf
Renames alert_config to user_script_config
2020-03-26 14:51:53 +01:00
emanuele-f
1862b684ed
Fix for alerts_api doc generation
...
Do not document local functions!
2020-03-26 09:39:31 +01:00
Simone Mainardi
755b6f1e47
Adds subtype to collapse macIpAssociationChangeType alerts
2020-02-25 18:49:05 +01:00
Simone Mainardi
9383dfd2b1
Adds subtype to collapse ipOutsideDHCPRangeType alerts
2020-02-25 18:39:32 +01:00
Simone Mainardi
4ed8cfecc3
Implements merge of multiple identical alerts
...
Implements #3430
2020-02-25 18:14:28 +01:00
Simone Mainardi
55d5912729
Moves unused slow_stats_update alert to attic
2020-02-21 14:14:01 +01:00
Simone Mainardi
bd46b7268e
Implements system alerts for not executed activities
2020-02-21 14:00:06 +01:00
emanuele-f
8edee160ed
Add missing alert type
2020-02-20 17:09:38 +01:00
emanuele-f
96299661b3
Implement periodic activities status monitor
2020-02-20 16:59:11 +01:00
Simone Mainardi
0e64fd94d6
Implements deadlines for periodic and user scripts
2020-02-18 18:44:41 +01:00
emanuele-f
aca088ea13
Add hyperlink to jump to the alert configuration
...
Closes #2936
2020-01-17 19:11:15 +01:00
Luca Deri
170bc60f19
Updated (C)
2020-01-08 23:52:51 +01:00
emanuele-f
6ba9052e3b
Add debug trace
2020-01-02 14:59:21 +01:00
emanuele-f
4621a8f409
Reload the periodic scripts when the configuration changes
2019-12-31 19:31:03 +01:00
Alfredo Cardigliano
5a17736801
Remove double json encode
2019-12-27 11:25:28 +01:00
emanuele-f
26c80529aa
Add example plugin with documentation
2019-12-17 16:23:15 +01:00
emanuele-f
c95473d659
Add snmpDevice hook and improve SNMP user scripts API
...
Closes #3097
2019-12-16 15:30:15 +01:00
emanuele-f
f998b7fafd
Fix automatic alert release skipping some alerts
2019-12-10 09:27:01 +01:00
emanuele-f
a3432e00e8
Implement ntopng plugins
...
Plugins are a convenient way to group together related lua scripts.
Their primary use case is to group user scripts and their alert/status
definition.
The builtin ntopng user scripts and definitions are now
packed into plugins directories. In future, we will support loading of
user created plugins.
Plugins are loaded at startup into some runtime directories and then
used. Other changes provided by this commit include:
- Add sample flow logger plugin
- Initial support for system user scripts
- Rename edge to threshold
- Migrate system probes to user scripts/plugins
- Migrate scripts to more explicit alerts_api.checkThresholdAlert api
2019-12-10 09:25:57 +01:00
Simone Mainardi
188ec66c25
Implements scriptable SNMP devices alerts
2019-11-22 18:00:31 +01:00
emanuele-f
2df9b34201
Add flow user scripts drops alert
2019-11-19 17:37:58 +01:00
emanuele-f
b2d804c123
Fix bugs in existing alert detection with default values
...
Using alerts with default values caused the already_triggered function to miss the existing alert, which
was automatically released. Moreover, the alerts_api.releaseEntityAlerts passed a nil cur_alerts,
breaking releaseEntityAlerts.
2019-11-19 17:37:31 +01:00
emanuele-f
df0556cb87
Optimize flow alerts generation
...
This provides a ~10x speedup by performing the JSON serialization work in C
(and thus avoiding Lua->C overhead). This also implements two in-memory alerts
queues (one for sqlite and one for the notifications) in order to reduce Redis load.
Alerts queue are now global instead of per-interface as there is only 1 dequeing thread.
2019-11-14 11:54:13 +01:00
emanuele-f
a57049f3dc
Fix invalid cli2srv.packets field
2019-11-11 15:51:32 +01:00
emanuele-f
d9fd30b9e6
Reduce redis load due to queue rating algorithmn
2019-11-11 10:49:08 +01:00
emanuele-f
23e427e361
Reduce llen number of calls for alerts queue rating
2019-11-08 11:51:49 +01:00
emanuele-f
af1dc8a05e
Limit alerts insertions if the queues are full
2019-11-08 11:26:49 +01:00
Alfredo Cardigliano
cb2f37529e
Reworked storeFlowAlert (using Lua table instead of many params now)
2019-11-06 10:02:15 +01:00
Alfredo Cardigliano
acdab024da
Enqueueing flow alerts to be stored/notified from Lua, removed DB select to notiy alert (using the alert object directly)
2019-11-05 15:53:10 +01:00
emanuele-f
54140b6f1a
Migrate alertable disabled alerts preference to lua
...
This avoids performing multiple hget on redis, thus increasing performance
2019-11-05 14:59:38 +01:00
emanuele-f
a96a90b65f
Optimize disabled alerts bitmap redis access
2019-11-05 12:29:08 +01:00
Alfredo Cardigliano
280213e148
Enqueueing alerts as soon as they are detected, instead of using 2-steps ( #3038 )
2019-11-05 11:04:44 +01:00
emanuele-f
675adcf90e
Migrate hosts disabled flow status preference to lua
...
By loading all the preferences at once in flow.lua setup() the
redis load is reduced and design is simpler.
2019-11-04 16:50:26 +01:00
Alfredo Cardigliano
d10dfc7762
Deferred flow alerts insertion through a redis queue. Removed alerts DB select when printing flow details.
2019-10-31 12:53:23 +01:00
Alfredo Cardigliano
96ef3c05e7
New alert when the number of idle entries in the hash tabel exceeds a configured threshold (implements #3005 )
2019-10-25 14:29:37 +02:00
Alfredo Cardigliano
afbb34e262
TCP SYN Scan detection (implements #2963 )
2019-10-24 15:35:26 +02:00
emanuele-f
10aa5542f8
Rework alertEntity functions to avoid modules circular dependencies
...
Fixes #2975
2019-10-23 13:01:57 +02:00
Simone Mainardi
1ec35c3042
Fixes and cleanup of disabled alerts
2019-10-22 10:33:42 +02:00
Simone Mainardi
5b3f34b72a
Fixes flapping of engaged alerts
2019-10-21 17:41:50 +02:00
Simone Mainardi
43d0b89bd9
Prevens tons of unnecessary calls to alerts_api.trigger()
2019-10-17 18:54:13 +02:00
emanuele-f
873b96c20a
Split alert types definitions in multiple files
2019-10-16 12:04:07 +02:00
emanuele-f
7bd6feb622
Rename check_module -> user_script
2019-10-10 18:14:53 +02:00
emanuele-f
ffd3b4c1ee
Users scripts api changes and initial documentation
2019-10-09 15:12:28 +02:00
emanuele-f
ede9a7940a
Generalize periodic and flows callbacks
...
Now periodic callbacks are properly called even when alerts are disabled
The granularity filter and check_function has been replaced with a more generic hooks list
2019-10-07 19:05:43 +02:00
emanuele-f
bee1efdded
Move callbacks scripts into separate tab
2019-10-04 10:48:13 +02:00
