feat: sudo и notify_send шлют события в SAC (dual)

sac-client.sh

@@ -170,15 +170,15 @@ notify_or_sac() {
  sac_send_event "$event_type" "$severity" "$title" "$summary"
  ;;
  dual)
- sac_send_event "$event_type" "$severity" "$title" "$summary" || true
- notify_send "$telegram_message"
- ;;
+  sac_send_event "$event_type" "$severity" "$title" "$summary" || true
+  NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"
+  ;;
  fallback)
- if sac_send_event "$event_type" "$severity" "$title" "$summary"; then
- return 0
- fi
- notify_send "$telegram_message"
- ;;
+  if sac_send_event "$event_type" "$severity" "$title" "$summary"; then
+   return 0
+  fi
+  NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"
+  ;;
  *)
  write_log "WARN: неизвестный UseSAC=$mode, только Telegram"
  notify_send "$telegram_message"

ssh-monitor

@@ -706,6 +706,16 @@ PY
  return 1
 }
 
+sac_mirror_notify_message() {
+ local message="$1"
+ local mode
+ mode="$(sac_normalize_mode "${UseSAC:-off}")"
+ [ "$mode" = "off" ] && return 0
+ local summary
+ summary="$(printf '%s' "$message" | tr '\n' ' ' | head -c 400)"
+ sac_send_event "agent.notification" "info" "SSH Monitor" "$summary" "" || return 1
+}
+
 notify_send() {
  local message="$1"
  message="$(message_ensure_server_line "$message")"
@@ -714,6 +724,28 @@ notify_send() {
  return 0
  fi
 
+ local sac_mode
+ sac_mode="$(sac_normalize_mode "${UseSAC:-off}")"
+ if [ "${NOTIFY_SKIP_SAC_MIRROR:-0}" != "1" ]; then
+ case "$sac_mode" in
+ exclusive)
+ if sac_mirror_notify_message "$message"; then
+ return 0
+ fi
+ write_log "WARN: UseSAC=exclusive: SAC не принял событие"
+ return 1
+ ;;
+ dual)
+ sac_mirror_notify_message "$message" || true
+ ;;
+ fallback)
+ if sac_mirror_notify_message "$message"; then
+ return 0
+ fi
+ ;;
+ esac
+ fi
+
  local any_ok=0
  local ch
  for ch in "${NOTIFY_CHAIN[@]}"; do
@@ -1399,7 +1431,8 @@ monitor_sudo() {
  message="${message}💻 Команда: ${sudo_cmd}"$'\n'
  message="${message}📁 Директория: ${pwd:-unknown}"$'\n'
  message="${message}🕐 Время: $(notification_date '+%d.%m.%Y %H:%M:%S')"
- notify_send "$message"
+ local sac_summary="${user}: ${sudo_cmd}"
+ notify_or_sac "privilege.sudo.command" "warning" "Использование sudo" "$sac_summary" "$message"
  write_log "SUDO: $user выполнил $sudo_cmd${run_as:+ (USER=$run_as)}"
  fi
  done <<<"$sudo_logs"