feat: UseSAC sac-client.sh and --check-sac

2026-05-26 21:46:35 +10:00
parent 44f8eb6103
commit dd971d80bc
3 changed files with 280 additions and 1 deletions
@@ -0,0 +1,209 @@
+# SAC client for ssh-monitor (source from ssh-monitor)
+# shellcheck shell=bash
+
+sac_normalize_mode() {
+ printf '%s' "${1:-off}" | tr '[:upper:]' '[:lower:]'
+}
+
+sac_is_configured() {
+ [ -n "${SAC_URL:-}" ] && [ -n "${SAC_API_KEY:-}" ]
+}
+
+sac_base_url() {
+ local url="${SAC_URL%/}"
+ case "$url" in
+ */api/v1/events) url="${url%/api/v1/events}" ;;
+ esac
+ printf '%s' "${url%/}"
+}
+
+sac_agent_instance_id() {
+ local id_file="${SAC_AGENT_ID_FILE:-/var/lib/ssh-monitor/agent_instance_id}"
+ local dir
+ dir="$(dirname "$id_file")"
+ if [ ! -d "$dir" ]; then
+ mkdir -p "$dir" 2>/dev/null || id_file="/tmp/ssh-monitor-agent_instance_id"
+ fi
+ if [ -f "$id_file" ]; then
+ cat "$id_file"
+ return 0
+ fi
+ local new_id
+ new_id="$(python3 -c 'import uuid; print(uuid.uuid4())')"
+ printf '%s\n' "$new_id" >"$id_file" 2>/dev/null || true
+ printf '%s' "$new_id"
+}
+
+sac_check_health() {
+ local base code
+ base="$(sac_base_url)"
+ [ -n "$base" ] || return 1
+ if [ "${DRY_RUN:-0}" = "1" ]; then
+ return 0
+ fi
+ code="$(curl -sS -o /dev/null -w '%{http_code}' \
+  --connect-timeout "${SAC_TIMEOUT_SEC:-12}" \
+  --max-time "${SAC_TIMEOUT_SEC:-12}" \
+  "${base}/health" || echo 000)"
+ [ "$code" = "200" ]
+}
+
+sac_spool_write() {
+ local event_id="$1"
+ local body="$2"
+ local dir="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
+ mkdir -p "$dir" 2>/dev/null || return 1
+ printf '%s' "$body" >"${dir}/${event_id}.json"
+}
+
+sac_spool_remove() {
+ local event_id="$1"
+ local dir="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
+ rm -f "${dir}/${event_id}.json"
+}
+
+# send_sac_event type severity title summary [details_json]
+sac_send_event() {
+ local event_type="$1"
+ local severity="$2"
+ local title="$3"
+ local summary="$4"
+ local details_json="${5:-}"
+
+ if ! sac_is_configured; then
+ write_log "WARN: SAC не настроен (SAC_URL / SAC_API_KEY)"
+ return 1
+ fi
+
+ if [ "${DRY_RUN:-0}" = "1" ]; then
+ printf '[DRY-RUN SAC] %s | %s | %s\n' "$event_type" "$severity" "$title" >&2
+ return 0
+ fi
+
+ local payload http_code event_id
+ payload="$(SAC_EVENT_TYPE="$event_type" \
+  SAC_SEVERITY="$severity" \
+  SAC_TITLE="$title" \
+  SAC_SUMMARY="$summary" \
+  SAC_DETAILS_JSON="$details_json" \
+  SAC_AGENT_ID="$(sac_agent_instance_id)" \
+  SAC_PRODUCT_VERSION="${SSH_MONITOR_VERSION:-unknown}" \
+  python3 <<'PY'
+import json, os, socket, uuid
+from datetime import datetime, timezone
+
+def details():
+    raw = os.environ.get("SAC_DETAILS_JSON", "").strip()
+    if not raw:
+        return None
+    return json.loads(raw)
+
+host = socket.gethostname()
+payload = {
+    "schema_version": "1.0",
+    "event_id": str(uuid.uuid4()),
+    "occurred_at": datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds"),
+    "source": {
+        "product": "ssh-monitor",
+        "product_version": os.environ.get("SAC_PRODUCT_VERSION", "unknown"),
+        "agent_instance_id": os.environ["SAC_AGENT_ID"],
+    },
+    "host": {
+        "hostname": host,
+        "os_family": "linux",
+    },
+    "category": "agent",
+    "type": os.environ["SAC_EVENT_TYPE"],
+    "severity": os.environ["SAC_SEVERITY"],
+    "title": os.environ["SAC_TITLE"],
+    "summary": os.environ["SAC_SUMMARY"],
+}
+d = details()
+if d is not None:
+    payload["details"] = d
+print(json.dumps(payload, ensure_ascii=False))
+PY
+)" || return 1
+
+ event_id="$(printf '%s' "$payload" | python3 -c 'import json,sys; print(json.load(sys.stdin)["event_id"])')"
+
+ local tmp resp
+ tmp="$(mktemp)"
+ resp="$(mktemp)"
+ printf '%s' "$payload" >"$tmp"
+ http_code="$(curl -sS -o "$resp" -w '%{http_code}' \
+  -X POST "${SAC_URL}" \
+  -H "Authorization: Bearer ${SAC_API_KEY}" \
+  -H "Content-Type: application/json" \
+  -H "Idempotency-Key: ${event_id}" \
+  --connect-timeout "${SAC_TIMEOUT_SEC:-12}" \
+  --max-time "${SAC_TIMEOUT_SEC:-12}" \
+  -d @"$tmp" 2>/dev/null || echo 000)"
+ rm -f "$tmp"
+
+ if [ "$http_code" = "202" ]; then
+ sac_spool_remove "$event_id" 2>/dev/null || true
+ write_log "SAC: принято event_id=$event_id type=$event_type"
+ return 0
+ fi
+
+ write_log "WARN: SAC POST HTTP $http_code: $(tr '\n' ' ' <"$resp" | head -c 200)"
+ sac_spool_write "$event_id" "$payload"
+ return 1
+}
+
+# notify_or_sac type severity title summary telegram_message
+notify_or_sac() {
+ local event_type="$1"
+ local severity="$2"
+ local title="$3"
+ local summary="$4"
+ local telegram_message="${5:-$summary}"
+ local mode
+ mode="$(sac_normalize_mode "${UseSAC:-off}")"
+
+ case "$mode" in
+ off)
+ notify_send "$telegram_message"
+ ;;
+ exclusive)
+ sac_send_event "$event_type" "$severity" "$title" "$summary"
+ ;;
+ dual)
+ sac_send_event "$event_type" "$severity" "$title" "$summary" || true
+ notify_send "$telegram_message"
+ ;;
+ fallback)
+ if sac_send_event "$event_type" "$severity" "$title" "$summary"; then
+ return 0
+ fi
+ notify_send "$telegram_message"
+ ;;
+ *)
+ write_log "WARN: неизвестный UseSAC=$mode, только Telegram"
+ notify_send "$telegram_message"
+ ;;
+ esac
+}
+
+run_check_sac() {
+ printf 'Проверка SAC (ssh-monitor)\n'
+ printf 'UseSAC=%s\n' "${UseSAC:-off}"
+ printf 'SAC_URL=%s\n' "${SAC_URL:-}"
+ if ! sac_is_configured; then
+ printf 'SAC: SAC_URL или SAC_API_KEY не заданы\n' >&2
+ return 1
+ fi
+ if sac_check_health; then
+ printf 'SAC health: OK\n'
+ else
+ printf 'SAC health: FAIL\n' >&2
+ return 1
+ fi
+ if sac_send_event "agent.test" "info" "SAC test" "ssh-monitor --check-sac"; then
+ printf 'SAC ingest agent.test: OK (ожидается HTTP 202)\n'
+ return 0
+ fi
+ printf 'SAC ingest agent.test: FAIL\n' >&2
+ return 1
+}