feat: Telegram notifications from SAC on ingest
Send Telegram alerts for high/critical events and new Problems. Configurable via TELEGRAM_* env vars; ingest never fails on send errors.
This commit is contained in:
@@ -16,9 +16,9 @@ PROBLEM_TYPES = frozenset(
|
||||
HIGH_SEVERITIES = frozenset({"high", "critical"})
|
||||
|
||||
|
||||
def maybe_create_problem(db: Session, event: Event) -> Problem | None:
|
||||
def maybe_create_problem(db: Session, event: Event) -> tuple[Problem | None, bool]:
|
||||
if event.severity not in HIGH_SEVERITIES and event.type not in PROBLEM_TYPES:
|
||||
return None
|
||||
return None, False
|
||||
|
||||
rule_id = "high_severity" if event.severity in HIGH_SEVERITIES else f"type:{event.type}"
|
||||
|
||||
@@ -34,7 +34,7 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
|
||||
.limit(1)
|
||||
)
|
||||
if existing:
|
||||
return existing
|
||||
return existing, False
|
||||
|
||||
# dedupe: one open problem per host+rule (append event link)
|
||||
open_problem = db.scalar(
|
||||
@@ -51,7 +51,7 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
|
||||
db.add(ProblemEvent(problem_id=open_problem.id, event_id=event.id))
|
||||
open_problem.updated_at = event.received_at
|
||||
db.flush()
|
||||
return open_problem
|
||||
return open_problem, False
|
||||
|
||||
problem = Problem(
|
||||
host_id=event.host_id,
|
||||
@@ -65,4 +65,4 @@ def maybe_create_problem(db: Session, event: Event) -> Problem | None:
|
||||
db.flush()
|
||||
db.add(ProblemEvent(problem_id=problem.id, event_id=event.id))
|
||||
db.flush()
|
||||
return problem
|
||||
return problem, True
|
||||
|
||||
Reference in New Issue
Block a user