Add disk IO detectors (#530)

* feat: add smart-agent_system-diskio module

* fix: remove readme

* fix: change signal name + remove major trigger

* fix: critical trigger 95->90

* feat: convert auto-generated to manual + add enable switch

* lint: fix errors

* doc: clean + add information about optional weighted io detector

* feat: convert manual to auto-generated

* doc: refactor readme + autogen

* fix: clean comments

* fix erroneous test ?

---------

Co-authored-by: Florent DELAHAYE <[email protected]>
Co-authored-by: Jean-Baptiste Simillon <[email protected]>

docs/severity.md

@@ -117,6 +117,7 @@
 - [smart-agent_solr](#smart-agent_solr)
 - [smart-agent_supervisor](#smart-agent_supervisor)
 - [smart-agent_system-common](#smart-agent_system-common)
+- [smart-agent_system-diskio](#smart-agent_system-diskio)
 - [smart-agent_systemd-services](#smart-agent_systemd-services)
 - [smart-agent_systemd-timers](#smart-agent_systemd-timers)
 - [smart-agent_tomcat](#smart-agent_tomcat)
@@ -1280,6 +1281,14 @@
 |System disk space running out|-|X|-|-|-|
 
 
+## smart-agent_system-diskio
+
+|Detector|Critical|Major|Minor|Warning|Info|
+|---|---|---|---|---|---|
+|System disk io usage|X|-|-|-|-|
+|System disk weighted io usage|X|-|-|-|-|
+
+
 ## smart-agent_systemd-services
 
 |Detector|Critical|Major|Minor|Warning|Info|

modules/smart-agent_system-diskio/README.md

@@ -0,0 +1,136 @@
+# SYSTEM-DISKIO SignalFx detectors
+
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+:link: **Contents**
+
+- [How to use this module?](#how-to-use-this-module)
+- [What are the available detectors in this module?](#what-are-the-available-detectors-in-this-module)
+- [How to collect required metrics?](#how-to-collect-required-metrics)
+  - [Metrics](#metrics)
+- [Related documentation](#related-documentation)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+## How to use this module?
+
+This directory defines a [Terraform](https://www.terraform.io/)
+[module](https://www.terraform.io/language/modules/syntax) you can use in your
+existing [stack](https://github.com/claranet/terraform-signalfx-detectors/wiki/Getting-started#stack) by adding a
+`module` configuration and setting its `source` parameter to URL of this folder:
+
+```hcl
+module "signalfx-detectors-smart-agent-system-diskio" {
+  source = "github.com/claranet/terraform-signalfx-detectors.git//modules/smart-agent_system-diskio?ref={revision}"
+
+  environment   = var.environment
+  notifications = local.notifications
+}
+```
+
+Note the following parameters:
+
+* `source`: Use this parameter to specify the URL of the module. The double slash (`//`) is intentional  and required.
+  Terraform uses it to specify subfolders within a Git repo (see [module
+  sources](https://www.terraform.io/language/modules/sources)). The `ref` parameter specifies a specific Git tag in
+  this repository. It is recommended to use the latest "pinned" version in place of `{revision}`. Avoid using a branch
+  like `master` except for testing purpose. Note that every modules in this repository are available on the Terraform
+  [registry](https://registry.terraform.io/modules/claranet/detectors/signalfx) and we recommend using it as source
+  instead of `git` which is more flexible but less future-proof.
+
+* `environment`: Use this parameter to specify the
+  [environment](https://github.com/claranet/terraform-signalfx-detectors/wiki/Getting-started#environment) used by this
+  instance of the module.
+  Its value will be added to the `prefixes` list at the start of the [detector
+  name](https://github.com/claranet/terraform-signalfx-detectors/wiki/Templating#example).
+  In general, it will also be used in the `filtering` internal sub-module to [apply
+  filters](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance#filtering) based on our default
+  [tagging convention](https://github.com/claranet/terraform-signalfx-detectors/wiki/Tagging-convention) by default.
+
+* `notifications`: Use this parameter to define where alerts should be sent depending on their severity. It consists
+  of a Terraform [object](https://www.terraform.io/language/expressions/type-constraints#object) where each key represents an available
+  [detector rule severity](https://docs.splunk.com/observability/alerts-detectors-notifications/create-detectors-for-alerts.html#severity)
+  and its value is a list of recipients. Every recipients must respect the [detector notification
+  format](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs/resources/detector#notification-format).
+  Check the [notification binding](https://github.com/claranet/terraform-signalfx-detectors/wiki/Notifications-binding)
+  documentation to understand the recommended role of each severity.
+
+These 3 parameters along with all variables defined in [common-variables.tf](common-variables.tf) are common to all
+[modules](../) in this repository. Other variables, specific to this module, are available in
+[variables.tf](variables.tf) and [variables-gen.tf](variables-gen.tf).
+In general, the default configuration "works" but all of these Terraform
+[variables](https://www.terraform.io/language/values/variables) make it possible to
+customize the detectors behavior to better fit your needs.
+
+Most of them represent usual tips and rules detailed in the
+[guidance](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance) documentation and listed in the
+common [variables](https://github.com/claranet/terraform-signalfx-detectors/wiki/Variables) dedicated documentation.
+
+Feel free to explore the [wiki](https://github.com/claranet/terraform-signalfx-detectors/wiki) for more information about
+general usage of this repository.
+
+## What are the available detectors in this module?
+
+This module creates the following SignalFx detectors which could contain one or multiple alerting rules:
+
+|Detector|Critical|Major|Minor|Warning|Info|
+|---|---|---|---|---|---|
+|System disk io usage|X|-|-|-|-|
+|System disk weighted io usage|X|-|-|-|-|
+
+## How to collect required metrics?
+
+This module deploys detectors using metrics reported by the
+[SignalFx Smart Agent Monitors](https://github.com/signalfx/signalfx-agent#monitors).
+
+Even if the [Smart Agent is deprecated](https://github.com/signalfx/signalfx-agent/blob/main/docs/smartagent-deprecation-notice.md)
+it remains an efficient, lightweight and simple monitoring agent which still works fine.
+See the [official documentation](https://docs.splunk.com/Observability/gdi/smart-agent/smart-agent-resources.html) for more information
+about this agent.
+You might find the related following documentations useful:
+- the global level [agent configuration](https://github.com/signalfx/signalfx-agent/blob/main/docs/config-schema.md)
+- the [monitor level configuration](https://github.com/signalfx/signalfx-agent/blob/main/docs/monitor-config.md)
+- the internal [agent configuration tips](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance#agent-configuration).
+- the full list of [monitors available](https://github.com/signalfx/signalfx-agent/tree/main/docs/monitors) with their own specific documentation.
+
+In addition, all of these monitors are still available in the [Splunk Otel Collector](https://github.com/signalfx/splunk-otel-collector),
+the Splunk [distro of OpenTelemetry Collector](https://opentelemetry.io/docs/concepts/distributions/) which replaces SignalFx Smart Agent,
+thanks to the internal [Smart Agent Receiver](https://github.com/signalfx/splunk-otel-collector/tree/main/pkg/receiver/smartagentreceiver).
+
+As a result:
+- any SignalFx Smart Agent monitor are compatible with the new agent OpenTelemetry Collector and related modules in this repository keep `smart-agent` as source name.
+- any OpenTelemetry receiver not based on an existing Smart Agent monitor is not available from old agent so related modules in this repository use `otel-collector` as source name.
+
+
+Check the [Related documentation](#related-documentation) section for more detailed and specific information about this module dependencies.
+
+System disk weighted io usage detector is disabled by default. It may be useful in some specific cases where system disk io usage detector show usage above 100% because of multi-queued IOs due to device or driver, please enable it only if you understand what it implies. See [Linux kernel documentation](https://docs.kernel.org/admin-guide/iostats.html).
+
+You must explicitely enable collection of those metrics on Agent:
+- system.disk.io_time
+- system.disk.weighted_io_time
+
+
+### Metrics
+
+
+To filter only required metrics for the detectors of this module, add the
+[datapointsToExclude](https://docs.splunk.com/observability/gdi/smart-agent/smart-agent-resources.html#filtering-data-using-the-smart-agent)
+parameter to the corresponding monitor configuration:
+
+```yaml
+    datapointsToExclude:
+      - metricNames:
+        - '*'
+        - '!system.disk.io_time'
+        - '!system.disk.weighted_io_time'
+
+```
+
+
+
+## Related documentation
+
+* [Terraform SignalFx provider](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs)
+* [Terraform SignalFx detector](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs/resources/detector)
+* [Splunk Observability integrations](https://docs.splunk.com/Observability/gdi/get-data-in/integrations.html)

modules/smart-agent_system-diskio/common-filters.tf

@@ -0,0 +1 @@
+../../common/module/filters-smart-agent.tf

modules/smart-agent_system-diskio/common-locals.tf

@@ -0,0 +1 @@
+../../common/module/locals.tf

modules/smart-agent_system-diskio/common-modules.tf

@@ -0,0 +1 @@
+../../common/module/modules.tf

modules/smart-agent_system-diskio/common-variables.tf

@@ -0,0 +1 @@
+../../common/module/variables.tf

modules/smart-agent_system-diskio/common-versions.tf

@@ -0,0 +1 @@
+../../common/module/versions.tf

modules/smart-agent_system-diskio/conf/01-disk-iotime.yaml

@@ -0,0 +1,16 @@
+module: system
+name: "Disk IO usage"
+id: disk_io_usage
+value_unit: "%"
+condition: "var.disk_io_usage_enabled"
+transformation: ".scale(100)"
+
+signals:
+  signal:
+    metric: system.disk.io_time
+    rollup: rate
+rules:
+  critical:
+    threshold: 90
+    comparator: ">"
+    lasting_duration: "30m"

modules/smart-agent_system-diskio/conf/02-disk-weightediotime.yaml

@@ -0,0 +1,15 @@
+module: system
+name: "Disk weighted IO usage"
+id: disk_weighted_io_usage
+value_unit: "%"
+condition: "var.disk_weighted_io_usage_enabled"
+transformation: ".scale(100)"
+signals:
+  signal:
+    metric: system.disk.weighted_io_time
+    rollup: rate
+rules:
+  critical:
+    threshold: 90
+    comparator: ">"
+    lasting_duration: "30m"

modules/smart-agent_system-diskio/conf/readme.yaml

@@ -0,0 +1,6 @@
+source_doc: |
+  System disk weighted io usage detector is disabled by default. It may be useful in some specific cases where system disk io usage detector show usage above 100% because of multi-queued IOs due to device or driver, please enable it only if you understand what it implies. See [Linux kernel documentation](https://docs.kernel.org/admin-guide/iostats.html).
+
+  You must explicitely enable collection of those metrics on Agent:
+  - system.disk.io_time
+  - system.disk.weighted_io_time

modules/smart-agent_system-diskio/detectors-gen.tf

@@ -0,0 +1,68 @@
+resource "signalfx_detector" "disk_io_usage" {
+  count = (var.disk_io_usage_enabled) ? 1 : 0
+
+  name = format("%s %s", local.detector_name_prefix, "System disk io usage")
+
+  authorized_writer_teams = var.authorized_writer_teams
+  teams                   = try(coalescelist(var.teams, var.authorized_writer_teams), null)
+  tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
+
+  viz_options {
+    label        = "signal"
+    value_suffix = "%"
+  }
+
+  program_text = <<-EOF
+    signal = data('system.disk.io_time', filter=${module.filtering.signalflow}, rollup='rate')${var.disk_io_usage_aggregation_function}${var.disk_io_usage_transformation_function}.publish('signal')
+    detect(when(signal > ${var.disk_io_usage_threshold_critical}, lasting=%{if var.disk_io_usage_lasting_duration_critical == null}None%{else}'${var.disk_io_usage_lasting_duration_critical}'%{endif}, at_least=${var.disk_io_usage_at_least_percentage_critical})).publish('CRIT')
+EOF
+
+  rule {
+    description           = "is too high > ${var.disk_io_usage_threshold_critical}%"
+    severity              = "Critical"
+    detect_label          = "CRIT"
+    disabled              = coalesce(var.disk_io_usage_disabled, var.detectors_disabled)
+    notifications         = try(coalescelist(lookup(var.disk_io_usage_notifications, "critical", []), var.notifications.critical), null)
+    runbook_url           = try(coalesce(var.disk_io_usage_runbook_url, var.runbook_url), "")
+    tip                   = var.disk_io_usage_tip
+    parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+    parameterized_body    = var.message_body == "" ? local.rule_body : var.message_body
+  }
+
+  max_delay = var.disk_io_usage_max_delay
+}
+
+resource "signalfx_detector" "disk_weighted_io_usage" {
+  count = (var.disk_weighted_io_usage_enabled) ? 1 : 0
+
+  name = format("%s %s", local.detector_name_prefix, "System disk weighted io usage")
+
+  authorized_writer_teams = var.authorized_writer_teams
+  teams                   = try(coalescelist(var.teams, var.authorized_writer_teams), null)
+  tags                    = compact(concat(local.common_tags, local.tags, var.extra_tags))
+
+  viz_options {
+    label        = "signal"
+    value_suffix = "%"
+  }
+
+  program_text = <<-EOF
+    signal = data('system.disk.weighted_io_time', filter=${module.filtering.signalflow}, rollup='rate')${var.disk_weighted_io_usage_aggregation_function}${var.disk_weighted_io_usage_transformation_function}.publish('signal')
+    detect(when(signal > ${var.disk_weighted_io_usage_threshold_critical}, lasting=%{if var.disk_weighted_io_usage_lasting_duration_critical == null}None%{else}'${var.disk_weighted_io_usage_lasting_duration_critical}'%{endif}, at_least=${var.disk_weighted_io_usage_at_least_percentage_critical})).publish('CRIT')
+EOF
+
+  rule {
+    description           = "is too high > ${var.disk_weighted_io_usage_threshold_critical}%"
+    severity              = "Critical"
+    detect_label          = "CRIT"
+    disabled              = coalesce(var.disk_weighted_io_usage_disabled, var.detectors_disabled)
+    notifications         = try(coalescelist(lookup(var.disk_weighted_io_usage_notifications, "critical", []), var.notifications.critical), null)
+    runbook_url           = try(coalesce(var.disk_weighted_io_usage_runbook_url, var.runbook_url), "")
+    tip                   = var.disk_weighted_io_usage_tip
+    parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+    parameterized_body    = var.message_body == "" ? local.rule_body : var.message_body
+  }
+
+  max_delay = var.disk_weighted_io_usage_max_delay
+}
+

modules/smart-agent_system-diskio/outputs.tf

@@ -0,0 +1,10 @@
+output "disk_io_usage" {
+  description = "Detector resource for disk_io_usage"
+  value       = signalfx_detector.disk_io_usage
+}
+
+output "disk_weighted_io_usage" {
+  description = "Detector resource for disk_weighted_io_usage"
+  value       = signalfx_detector.disk_weighted_io_usage
+}
+

modules/smart-agent_system-diskio/tags.tf

@@ -0,0 +1,3 @@
+locals {
+  tags = ["smart-agent", "system-diskio"]
+}