Drastic drop in concurrent connections-bluecoat-sgos
Vendor: bluecoat
OS: sgos
Description:
Alert when a drop was detected in the number of concurrent connections.
Remediation Steps:
Review why this may be happening.
bluecoat-show-http-stats
name: bluecoat-show-http-stats
description: Fetch http stats
type: monitoring
monitoring_interval: 5 minute
requires:
vendor: bluecoat
os.name: sgos
comments:
concurrent-connections:
why: |
It is important to monitor the current client connections and make sure the value is below the maximum for the appliance.
how: |
Bluecoat Proxy through SSH and retrieves the output of the "show http-stats" command. The output includes client connections information and statistics.
can-with-snmp: false
can-with-syslog: false
concurrent-connections-limit:
why: |
It is important to make sure that the number of current connected clients is lower than the maximum allowed concurrent clients, otherwise, connections might drop.
how: |
Bluecoat Proxy through SSH and retrieves the output of the "show http-stats" command. The output includes client connections information and statistics.
can-with-snmp: false
can-with-syslog: false
steps:
- run:
type: SSH
command: show http-stats
parse:
type: AWK
file: show-http-stats.parser.1.awk
concurrent_connections_drastic_change_down
package com.indeni.server.rules.library
/*
* Rule is cancelled at the moment since we rewrote Change detection algorithm
* Rule should be re written with the new algorithm
import com.indeni.apidata.data.conditions.True
import com.indeni.ruleengine._
import com.indeni.ruleengine.expressions.conditions.ResultsFound
import com.indeni.ruleengine.expressions.core.{StatusTreeExpression, _}
import com.indeni.ruleengine.expressions.data.{SelectTagsExpression, SelectTimeSeriesExpression, TimeSeriesExpression}
import com.indeni.ruleengine.expressions.scope.ScopableExpression
import com.indeni.ruleengine.expressions.Expression
import com.indeni.ruleengine.expressions.tools.changePointAnalysis.DropDetectionExpression
import com.indeni.server.params._
import com.indeni.server.rules._
import com.indeni.server.rules.library.ConcurrentConnectionsDrasticChangeDownRule._
import com.indeni.server.rules.library.core.PerDeviceRule
import com.indeni.server.sensor.models.managementprocess.alerts.dto.AlertSeverity
import com.indeni.apidata.time.TimeSpan
*/
/**
* Rule is cancelled at the moment since we rewrote Change detection algorithm
* Rule should be re written with the new algorithm
case class ConcurrentConnectionsDrasticChangeDownRule() extends PerDeviceRule with RuleHelper {
private val reviewedTimeframeParameter = new ParameterDefinition(REVIEWED_TIMEFRAME_PARAMETER_NAME,
"",
"Reviewed Timeframe",
"The window of time we review to detect changes.",
ParameterDefinition.UIType.TIMESPAN,
TimeSpan.fromMinutes(120))
override val metadata: RuleMetadata = RuleMetadata.builder(NAME, "All Devices: Drastic drop in concurrent connections", "Alert when a drop was detected in the number of concurrent connections.", AlertSeverity.ERROR).configParameter(reviewedTimeframeParameter).build()
override def expressionTree: StatusTreeExpression = {
val numOfConnectionsTimeSeries = TimeSeriesExpression[Double]("concurrent-connections")
val actualValue = numOfConnectionsTimeSeries.last
val lastChange = DropDetectionExpression(numOfConnectionsTimeSeries).withLazy
StatusTreeExpression(
// Which objects to pull (normally, devices)
SelectTagsExpression(context.metaDao, Set(DeviceKey), True),
StatusTreeExpression(
// The time-series we check the test condition against:
SelectTimeSeriesExpression[Double](context.tsDao, Set("concurrent-connections"), historyLength = getParameterTimeSpanForRule(reviewedTimeframeParameter)),
// The condition which, if true, we have an issue. Checked against the time-series we've collected
ResultsFound(lastChange)
// The Alert Item to add for this specific item
).withRootInfo(
getHeadline(),
scopableStringFormatExpression("A drop has been detected in the number of concurrent connections. %s.", new ScopableExpression[Any] {
override protected def evalWithScope(time: Long, scope: Scope): String = s"Changed from ${lastChange.eval(time).head.before} to ${lastChange.eval(time).head.after}"
override def args: Set[Expression[_]] = Set(lastChange)
}),
ConstantExpression("Review why this may be happening.")
).asCondition()
).withoutInfo()
}
}
object ConcurrentConnectionsDrasticChangeDownRule {
/* --- Constants --- */
private[library] val NAME = "concurrent_connections_drastic_change_down"
private[library] val REVIEWED_TIMEFRAME_PARAMETER_NAME: String = "reviewed_timeframe"
}
*/