diff --git a/docs/severity.md b/docs/severity.md index 6febc4b5a..03f5602f7 100644 --- a/docs/severity.md +++ b/docs/severity.md @@ -102,6 +102,7 @@ - [smart-agent_systemd-timers](#smart-agent_systemd-timers) - [smart-agent_tomcat](#smart-agent_tomcat) - [smart-agent_varnish](#smart-agent_varnish) +- [smart-agent_winprocess](#smart-agent_winprocess) - [smart-agent_zookeeper](#smart-agent_zookeeper) @@ -1106,6 +1107,13 @@ |Varnish memory usage|X|X|-|-|-| +## smart-agent_winprocess + +|Detector|Critical|Major|Minor|Warning|Info| +|---|---|---|---|---|---| +|Winprocess status|X|-|-|-|-| + + ## smart-agent_zookeeper |Detector|Critical|Major|Minor|Warning|Info| diff --git a/modules/smart-agent_winprocess/README.md b/modules/smart-agent_winprocess/README.md new file mode 100644 index 000000000..c4b5643b9 --- /dev/null +++ b/modules/smart-agent_winprocess/README.md @@ -0,0 +1,129 @@ +# WINPROCESS SignalFx detectors + + + +:link: **Contents** + +- [How to use this module?](#how-to-use-this-module) +- [What are the available detectors in this module?](#what-are-the-available-detectors-in-this-module) +- [How to collect required metrics?](#how-to-collect-required-metrics) + - [Metrics](#metrics) +- [Related documentation](#related-documentation) + + + +## How to use this module? + +This directory defines a [Terraform](https://www.terraform.io/) +[module](https://www.terraform.io/language/modules/syntax) you can use in your +existing [stack](https://github.com/claranet/terraform-signalfx-detectors/wiki/Getting-started#stack) by adding a +`module` configuration and setting its `source` parameter to URL of this folder: + +```hcl +module "signalfx-detectors-smart-agent-winprocess" { + source = "github.com/claranet/terraform-signalfx-detectors.git//modules/smart-agent_winprocess?ref={revision}" + + environment = var.environment + notifications = local.notifications +} +``` + +Note the following parameters: + +* `source`: Use this parameter to specify the URL of the module. The double slash (`//`) is intentional and required. + Terraform uses it to specify subfolders within a Git repo (see [module + sources](https://www.terraform.io/language/modules/sources)). The `ref` parameter specifies a specific Git tag in + this repository. It is recommended to use the latest "pinned" version in place of `{revision}`. Avoid using a branch + like `master` except for testing purpose. Note that every modules in this repository are available on the Terraform + [registry](https://registry.terraform.io/modules/claranet/detectors/signalfx) and we recommend using it as source + instead of `git` which is more flexible but less future-proof. + +* `environment`: Use this parameter to specify the + [environment](https://github.com/claranet/terraform-signalfx-detectors/wiki/Getting-started#environment) used by this + instance of the module. + Its value will be added to the `prefixes` list at the start of the [detector + name](https://github.com/claranet/terraform-signalfx-detectors/wiki/Templating#example). + In general, it will also be used in the `filtering` internal sub-module to [apply + filters](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance#filtering) based on our default + [tagging convention](https://github.com/claranet/terraform-signalfx-detectors/wiki/Tagging-convention) by default. + +* `notifications`: Use this parameter to define where alerts should be sent depending on their severity. It consists + of a Terraform [object](https://www.terraform.io/language/expressions/type-constraints#object) where each key represents an available + [detector rule severity](https://docs.splunk.com/observability/alerts-detectors-notifications/create-detectors-for-alerts.html#severity) + and its value is a list of recipients. Every recipients must respect the [detector notification + format](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs/resources/detector#notification-format). + Check the [notification binding](https://github.com/claranet/terraform-signalfx-detectors/wiki/Notifications-binding) + documentation to understand the recommended role of each severity. + +These 3 parameters alongs with all variables defined in [common-variables.tf](common-variables.tf) are common to all +[modules](../) in this repository. Other variables, specific to this module, are available in +[variables-gen.tf](variables-gen.tf). +In general, the default configuration "works" but all of these Terraform +[variables](https://www.terraform.io/language/values/variables) make it possible to +customize the detectors behavior to better fit your needs. + +Most of them represent usual tips and rules detailled in the +[guidance](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance) documentation and listed in the +common [variables](https://github.com/claranet/terraform-signalfx-detectors/wiki/Variables) dedicated documentation. + +Feel free to explore the [wiki](https://github.com/claranet/terraform-signalfx-detectors/wiki) for more information about +general usage of this repository. + +## What are the available detectors in this module? + +This module creates the following SignalFx detectors which could contain one or multiple alerting rules: + +|Detector|Critical|Major|Minor|Warning|Info| +|---|---|---|---|---|---| +|Winprocess status|X|-|-|-|-| + +## How to collect required metrics? + +This module deploys detectors using metrics reported by the +[SignalFx Smart Agent Monitors](https://github.com/signalfx/signalfx-agent#monitors). + +Even if the [Smart Agent is deprecated](https://github.com/signalfx/signalfx-agent/blob/main/docs/smartagent-deprecation-notice.md) +it remains an efficient, lightweight and simple monitoring agent which still works fine. +See the [official documentation](https://docs.splunk.com/Observability/gdi/smart-agent/smart-agent-resources.html) for more information +about this agent. +You might find the related following documentations useful: +- the global level [agent configuration](https://github.com/signalfx/signalfx-agent/blob/main/docs/config-schema.md) +- the [monitor level configuration](https://github.com/signalfx/signalfx-agent/blob/main/docs/monitor-config.md) +- the internal [agent configuration tips](https://github.com/claranet/terraform-signalfx-detectors/wiki/Guidance#agent-configuration). +- the full list of [monitors available](https://github.com/signalfx/signalfx-agent/tree/main/docs/monitors) with their own specific documentation. + +In addition, all of these monitors are still available in the [Splunk Otel Collector](https://github.com/signalfx/splunk-otel-collector), +the Splunk [distro of OpenTelemetry Collector](https://opentelemetry.io/docs/concepts/distributions/) which replaces SignalFx Smart Agent, +thanks to the internal [Smart Agent Receiver](https://github.com/signalfx/splunk-otel-collector/tree/main/internal/receiver/smartagentreceiver). + +As a result: +- any SignalFx Smart Agent monitor are compatible with the new agent OpenTelemetry Collector and related modules in this repository keep `smart-agent` as source name. +- any OpenTelemetry receiver not based on an existing Smart Agent monitor is not available from old agent so related modules in this repository use `otel-collector` as source name. + + +Check the [Related documentation](#related-documentation) section for more detailed and specific information about this module dependencies. + + + +### Metrics + + +To filter only required metrics for the detectors of this module, add the +[datapointsToExclude](https://docs.splunk.com/observability/gdi/smart-agent/smart-agent-resources.html#filtering-data-using-the-smart-agent) +parameter to the corresponding monitor configuration: + +```yaml + datapointsToExclude: + - metricNames: + - '*' + - '!win_services.state' + +``` + + + +## Related documentation + +* [Terraform SignalFx provider](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs) +* [Terraform SignalFx detector](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs/resources/detector) +* [Splunk Observability integrations](https://docs.splunk.com/Observability/gdi/get-data-in/integrations.html) diff --git a/modules/smart-agent_winprocess/common-filters.tf b/modules/smart-agent_winprocess/common-filters.tf new file mode 120000 index 000000000..4df54e41e --- /dev/null +++ b/modules/smart-agent_winprocess/common-filters.tf @@ -0,0 +1 @@ +../../common/module/filters-smart-agent.tf \ No newline at end of file diff --git a/modules/smart-agent_winprocess/common-locals.tf b/modules/smart-agent_winprocess/common-locals.tf new file mode 120000 index 000000000..5672d21ab --- /dev/null +++ b/modules/smart-agent_winprocess/common-locals.tf @@ -0,0 +1 @@ +../../common/module/locals.tf \ No newline at end of file diff --git a/modules/smart-agent_winprocess/common-modules.tf b/modules/smart-agent_winprocess/common-modules.tf new file mode 120000 index 000000000..8c81ef377 --- /dev/null +++ b/modules/smart-agent_winprocess/common-modules.tf @@ -0,0 +1 @@ +../../common/module/modules.tf \ No newline at end of file diff --git a/modules/smart-agent_winprocess/common-variables.tf b/modules/smart-agent_winprocess/common-variables.tf new file mode 120000 index 000000000..f3037a584 --- /dev/null +++ b/modules/smart-agent_winprocess/common-variables.tf @@ -0,0 +1 @@ +../../common/module/variables.tf \ No newline at end of file diff --git a/modules/smart-agent_winprocess/common-versions.tf b/modules/smart-agent_winprocess/common-versions.tf new file mode 120000 index 000000000..fa7f5509f --- /dev/null +++ b/modules/smart-agent_winprocess/common-versions.tf @@ -0,0 +1 @@ +../../common/module/versions.tf \ No newline at end of file diff --git a/modules/smart-agent_winprocess/conf/01-winprocess.yaml b/modules/smart-agent_winprocess/conf/01-winprocess.yaml new file mode 100644 index 000000000..67cccef49 --- /dev/null +++ b/modules/smart-agent_winprocess/conf/01-winprocess.yaml @@ -0,0 +1,15 @@ +module: winprocess +name: status + +transformation: ".mean(over='15m')" +aggregation: true + +signals: + A: + metric: win_services.state + signal: + formula: A +rules: + critical: + threshold: 4 + comparator: '<' diff --git a/modules/smart-agent_winprocess/conf/readme.yaml b/modules/smart-agent_winprocess/conf/readme.yaml new file mode 100644 index 000000000..9015fc41a --- /dev/null +++ b/modules/smart-agent_winprocess/conf/readme.yaml @@ -0,0 +1,3 @@ +documentations: + +source_doc: diff --git a/modules/smart-agent_winprocess/detectors-gen.tf b/modules/smart-agent_winprocess/detectors-gen.tf new file mode 100644 index 000000000..bca32c4db --- /dev/null +++ b/modules/smart-agent_winprocess/detectors-gen.tf @@ -0,0 +1,28 @@ +resource "signalfx_detector" "status" { + name = format("%s %s", local.detector_name_prefix, "Winprocess status") + + authorized_writer_teams = var.authorized_writer_teams + teams = try(coalescelist(var.teams, var.authorized_writer_teams), null) + tags = compact(concat(local.common_tags, local.tags, var.extra_tags)) + + program_text = <<-EOF + A = data('win_services.state', filter=${module.filtering.signalflow})${var.status_aggregation_function}${var.status_transformation_function} + signal = A.publish('signal') + detect(when(signal < ${var.status_threshold_critical}, lasting=%{if var.status_lasting_duration_critical == null}None%{else}'${var.status_lasting_duration_critical}'%{endif}, at_least=${var.status_at_least_percentage_critical})).publish('CRIT') +EOF + + rule { + description = "is too low < ${var.status_threshold_critical}" + severity = "Critical" + detect_label = "CRIT" + disabled = coalesce(var.status_disabled, var.detectors_disabled) + notifications = try(coalescelist(lookup(var.status_notifications, "critical", []), var.notifications.critical), null) + runbook_url = try(coalesce(var.status_runbook_url, var.runbook_url), "") + tip = var.status_tip + parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject + parameterized_body = var.message_body == "" ? local.rule_body : var.message_body + } + + max_delay = var.status_max_delay +} + diff --git a/modules/smart-agent_winprocess/outputs.tf b/modules/smart-agent_winprocess/outputs.tf new file mode 100644 index 000000000..741c3f94a --- /dev/null +++ b/modules/smart-agent_winprocess/outputs.tf @@ -0,0 +1,5 @@ +output "status" { + description = "Detector resource for status" + value = signalfx_detector.status +} + diff --git a/modules/smart-agent_winprocess/tags.tf b/modules/smart-agent_winprocess/tags.tf new file mode 100644 index 000000000..d6ba91ca1 --- /dev/null +++ b/modules/smart-agent_winprocess/tags.tf @@ -0,0 +1,3 @@ +locals { + tags = ["smart-agent", "winprocess"] +} diff --git a/modules/smart-agent_winprocess/variables-gen.tf b/modules/smart-agent_winprocess/variables-gen.tf new file mode 100644 index 000000000..2f3821133 --- /dev/null +++ b/modules/smart-agent_winprocess/variables-gen.tf @@ -0,0 +1,61 @@ +# status detector + +variable "status_notifications" { + description = "Notification recipients list per severity overridden for status detector" + type = map(list(string)) + default = {} +} + +variable "status_aggregation_function" { + description = "Aggregation function and group by for status detector (i.e. \".mean(by=['host'])\")" + type = string + default = "" +} + +variable "status_transformation_function" { + description = "Transformation function for status detector (i.e. \".mean(over='5m')\")" + type = string + default = ".mean(over='15m')" +} + +variable "status_max_delay" { + description = "Enforce max delay for status detector (use \"0\" or \"null\" for \"Auto\")" + type = number + default = null +} + +variable "status_tip" { + description = "Suggested first course of action or any note useful for incident handling" + type = string + default = "" +} + +variable "status_runbook_url" { + description = "URL like SignalFx dashboard or wiki page which can help to troubleshoot the incident cause" + type = string + default = "" +} + +variable "status_disabled" { + description = "Disable all alerting rules for status detector" + type = bool + default = null +} + +variable "status_threshold_critical" { + description = "Critical threshold for status detector" + type = number + default = 4 +} + +variable "status_lasting_duration_critical" { + description = "Minimum duration that conditions must be true before raising alert" + type = string + default = null +} + +variable "status_at_least_percentage_critical" { + description = "Percentage of lasting that conditions must be true before raising alert (>= 0.0 and <= 1.0)" + type = number + default = 1 +}