Add machine label to cs_active_decisions metric#4568
Conversation
Extend DecisionsByScenario struct with Machine and AlertDecisions fields. Rewrite QueryDecisionCountByScenario to group by (scenario, origin, type, machine) instead of (scenario, origin, type). Implement two helper functions: resolveMachinesByAlertID to look up machine IDs for alert references, and foldByMachine to re-aggregate results by machine. This preserves the DB query cost profile (single GROUP BY + COUNT) while enabling per-machine metrics. Closes crowdsecurity#2784
The AlertDecisions field was missing the sql:"alert_decisions" tag, causing QueryDecisionCountByScenario to fail with column scan errors.
- Add "machine" to GlobalActiveDecisions label list in pkg/metrics/global.go - Pass d.Machine value in cs_active_decisions metric write in cmd/crowdsec/metrics.go This completes Task 2 of wiring the machine label through the metric definition and its write site, following Task 1's addition of the Machine field to DecisionsByScenario.
… folding Covers QueryDecisionCountByScenario's machine resolution: owned-alert resolution, "N/A" fallback for ownerless alerts, folding of same-machine decisions across separate alerts, and correct splitting across distinct machines (with a sum-of-counts invariant guarding against regressions in existing per-scenario totals).
|
@kushiemoon-dev: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
@kushiemoon-dev: There are no area labels on this PR. You can add as many areas as you see fit.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
/kind feature |
|
/area agent |
github-actions
Bot
added
kind/feature
area/agent
and removed
needs/kind
needs/area
labels
|
/kind enhancement |
github-actions
Bot
added
kind/enhancement
1 participant
Summary
machinelabel to thecs_active_decisionsPrometheus GaugeVec, so each time series shows which enrolled machine owns the alert behind those active decisions.Decision -> Alert -> Machineusing the nativealert_decisionsFK column (no raw SQL join), folding rows that share(reason, origin, action, machine). Falls back to"N/A"for decisions whose alert has no owning machine.cscli metrics) are unaffected: the new label only splits existing rows, the summed totals per(reason, origin, action)stay identical.Test plan
go build ./...go test ./pkg/database/...(existing suite + 4 new regression tests: machine-owned alert, no-owning-machine fallback, folding across alerts owned by the same machine, splitting across different machines)go vet ./pkg/metrics/... ./cmd/crowdsec/...Related: #2784