chore(home): mirror from kalinamall (9883e6a) with papatramp URLs

2026-07-14 20:43:52 +10:00
commit ed4e78f6c3
312 changed files with 42790 additions and 0 deletions
@@ -0,0 +1,119 @@
+"""Auto-create Problems from ingested events (rules + correlation)."""
+
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.config import get_settings
+from app.models import Event, Problem, ProblemEvent
+from app.services.host_health import HEARTBEAT_TYPE
+from app.services.problem_rules import (
+    RuleMatch,
+    RULE_HOST_SILENCE,
+    RULE_RDG_SESSION_FLAP,
+    build_fingerprint,
+    pick_rule_match,
+    resolve_host_silence_problems,
+)
+
+
+def _correlation_cutoff(now: datetime) -> datetime:
+    minutes = get_settings().sac_problem_correlation_window_minutes
+    return now - timedelta(minutes=minutes)
+
+
+def _append_event(db: Session, problem: Problem, event: Event) -> None:
+    linked = db.scalar(
+        select(ProblemEvent).where(
+            ProblemEvent.problem_id == problem.id,
+            ProblemEvent.event_id == event.id,
+        )
+    )
+    if linked is not None:
+        return
+    db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
+    problem.event_count = (problem.event_count or 0) + 1
+    problem.last_seen_at = event.occurred_at
+    problem.updated_at = datetime.now(timezone.utc)
+    if event.severity in {"high", "critical"} and problem.severity not in {"high", "critical"}:
+        problem.severity = event.severity
+    db.flush()
+
+
+def open_or_append_problem(
+    db: Session, event: Event, match: RuleMatch
+) -> tuple[Problem | None, bool]:
+    if match.rule_id == RULE_HOST_SILENCE:
+        from app.services.host_silence_scan import open_or_refresh_host_silence_problem
+
+        ref = event.occurred_at
+        if ref.tzinfo is None:
+            ref = ref.replace(tzinfo=timezone.utc)
+        problem, created = open_or_refresh_host_silence_problem(
+            db, event.host_id, match, now=ref, hostname=event.host.hostname if event.host else None
+        )
+        if problem is None:
+            return None, False
+        _append_event(db, problem, event)
+        return problem, created
+
+    fingerprint = build_fingerprint(
+        event.host_id,
+        match.correlation_type,
+        match.rule_id,
+        match.fingerprint_suffix,
+    )
+    now = datetime.now(timezone.utc)
+    if match.rule_id == RULE_RDG_SESSION_FLAP:
+        cutoff = now - timedelta(seconds=get_settings().sac_rdg_flap_dedup_sec)
+    else:
+        cutoff = _correlation_cutoff(now)
+
+    open_problem = db.scalar(
+        select(Problem)
+        .where(
+            Problem.status == "open",
+            Problem.fingerprint == fingerprint,
+            Problem.host_id == event.host_id,
+            Problem.last_seen_at >= cutoff,
+        )
+        .order_by(Problem.last_seen_at.desc())
+        .limit(1)
+    )
+    if open_problem:
+        _append_event(db, open_problem, event)
+        if match.severity in {"high", "critical"} and open_problem.severity not in {"high", "critical"}:
+            open_problem.severity = match.severity
+            open_problem.summary = match.summary
+        return open_problem, False
+
+    problem = Problem(
+        host_id=event.host_id,
+        title=match.title,
+        summary=match.summary,
+        severity=match.severity,
+        status="open",
+        rule_id=match.rule_id,
+        fingerprint=fingerprint,
+        event_count=1,
+        last_seen_at=event.occurred_at,
+    )
+    db.add(problem)
+    db.flush()
+    db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
+    db.flush()
+    return problem, True
+
+
+def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
+    if event.type == HEARTBEAT_TYPE:
+        resolve_host_silence_problems(db, event.host_id)
+        return None, False
+
+    match = pick_rule_match(db, event)
+    if match is None:
+        return None, False
+
+    problem, created = open_or_append_problem(db, event, match)
+    return problem, created