eagle-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (EAGLE-798) Add a new alert publisher to store alerts into hbase
Date Fri, 25 Nov 2016 07:44:58 GMT

    [ https://issues.apache.org/jira/browse/EAGLE-798?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15695126#comment-15695126
] 

ASF GitHub Bot commented on EAGLE-798:
--------------------------------------

Github user haoch commented on a diff in the pull request:

    https://github.com/apache/incubator-eagle/pull/683#discussion_r89574424
  
    --- Diff: eagle-core/eagle-alert-parent/eagle-alert-app/src/main/java/org/apache/eagle/alert/app/AlertEagleStorePlugin.java
---
    @@ -0,0 +1,93 @@
    +/*
    + * Licensed to the Apache Software Foundation (ASF) under one or more
    + * contributor license agreements.  See the NOTICE file distributed with
    + * this work for additional information regarding copyright ownership.
    + * The ASF licenses this file to You under the Apache License, Version 2.0
    + * (the "License"); you may not use this file except in compliance with
    + * the License.  You may obtain a copy of the License at
    + * <p/>
    + * http://www.apache.org/licenses/LICENSE-2.0
    + * <p/>
    + * Unless required by applicable law or agreed to in writing, software
    + * distributed under the License is distributed on an "AS IS" BASIS,
    + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    + * See the License for the specific language governing permissions and
    + * limitations under the License.
    + */
    +package org.apache.eagle.alert.app;
    +
    +import com.google.common.base.Preconditions;
    +import com.typesafe.config.Config;
    +import org.apache.eagle.alert.engine.coordinator.Publishment;
    +import org.apache.eagle.alert.engine.model.AlertStreamEvent;
    +import org.apache.eagle.alert.engine.publisher.impl.AbstractPublishPlugin;
    +import org.apache.eagle.alert.utils.AlertConstants;
    +import org.apache.eagle.metadata.model.AlertEntity;
    +import org.apache.eagle.service.client.IEagleServiceClient;
    +import org.apache.eagle.service.client.impl.EagleServiceClientImpl;
    +import org.slf4j.Logger;
    +import org.slf4j.LoggerFactory;
    +
    +import java.io.IOException;
    +import java.util.ArrayList;
    +import java.util.HashMap;
    +import java.util.List;
    +import java.util.Map;
    +
    +import static org.apache.eagle.alert.engine.model.AlertPublishEvent.*;
    +
    +public class AlertEagleStorePlugin extends AbstractPublishPlugin {
    +    private static final Logger LOG = LoggerFactory.getLogger(AlertEagleStorePlugin.class);
    +    private IEagleServiceClient client;
    +
    +    @Override
    +    public void init(Config config, Publishment publishment, Map conf) throws Exception
{
    +        super.init(config, publishment, conf);
    +        client = new EagleServiceClientImpl(config.getString("service.host"), config.getInt("service.port"),
    +                config.getString("service.username"), config.getString("service.password"));
    +    }
    +
    +    @Override
    +    public void close() {
    +        try {
    +            client.close();
    +        } catch (IOException e) {
    +            e.printStackTrace();
    --- End diff --
    
    Use `logger`


> Add a new alert publisher to store alerts into hbase
> ----------------------------------------------------
>
>                 Key: EAGLE-798
>                 URL: https://issues.apache.org/jira/browse/EAGLE-798
>             Project: Eagle
>          Issue Type: Improvement
>    Affects Versions: v0.5.0
>            Reporter: Zhao, Qingwen
>            Assignee: Zhao, Qingwen
>            Priority: Minor
>             Fix For: v0.5.0
>
>
> currently, eagle stores alerts with metadata into jdbc database, which has performance
risks under large volume of data
> POST  http://localhost:9090/rest/entities?serviceName=AlertService
> {code}
> {
>             "prefix": "alert_detail",
>             "timestamp": 1480056123654,
>             "tags": {
>                 "policyId": "test_all",
>                 "siteId": "sandbox"
>             },
>             "exp": null,
>             "encodedRowkey": "hiCMlG8vvsd___6nZcfO-SCZKe27qlR0",
>             "serializeAlias": null,
>             "serializeVerbose": true,
>             "appIds": [
>                 "HDFS_AUDIT_LOG_MONITOR_APP_SANDBOX"
>             ],
>             "policyValue": "from HDFS_AUDIT_LOG_ENRICHED_STREAM_SANDBOX select * insert
into hdfs_audit_log_enriched_stream_out",
>             "alertData": {
>                 "allowed": true,
>                 "cmd": "delete",
>                 "dst": null,
>                 "host": "10.249.66.185",
>                 "securityZone": "NA",
>                 "sensitivityType": "NA",
>                 "src": "/tmp/hive/hive/caf2438a-87fe-4889-96ac-0c1f0b5dd4e0",
>                 "timestamp": 1480056117845,
>                 "user": "hive"
>             }
>         },
> {code}
> GET   http://localhost:9090/rest/entities?query=AlertService[@siteId="sandbox"]{*}&pageSize=100&startTime=2016-11-22%2001:10:00&endTime=2017-12-22%2003:10:00



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message