Groups and deduplicates alerts. More...

#include <alert_pipeline.h>

Collaboration diagram for kcenon::monitoring::alert_aggregator:

Public Member Functions
	alert_aggregator (const alert_aggregator_config &config)
	Construct with configuration.

std::string	add_alert (const alert &a)
	Add an alert for aggregation.

std::vector< alert_group >	get_ready_groups ()
	Get groups ready for notification.

void	mark_sent (const std::string &group_key)
	Mark a group as sent.

void	cleanup ()
	Remove resolved alerts and clean up old groups.

size_t	group_count () const
	Get current group count.

size_t	total_alert_count () const
	Get total alert count across all groups.

Private Member Functions
std::string	compute_group_key (const alert &a) const

alert_labels	extract_common_labels (const alert &a) const

Private Attributes
alert_aggregator_config	config_

std::mutex	mutex_

std::unordered_map< std::string, alert_group >	groups_

std::unordered_map< std::string, std::chrono::steady_clock::time_point >	first_seen_

std::unordered_map< std::string, std::chrono::steady_clock::time_point >	last_sent_

Detailed Description

Groups and deduplicates alerts.

The aggregator collects alerts over time and groups them based on configured labels. This reduces notification noise by batching related alerts together.

Thread Safety:: This class is thread-safe.

Examples: alert_pipeline_example.cpp.

Definition at line 79 of file alert_pipeline.h.

Constructor & Destructor Documentation

◆ alert_aggregator()

kcenon::monitoring::alert_aggregator::alert_aggregator ( const alert_aggregator_config & config )

inlineexplicit

Construct with configuration.

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 84 of file alert_pipeline.h.

85 : config_(config) {}

kcenon::monitoring::alert_aggregator::config_

alert_aggregator_config config_

Definition alert_pipeline.h:246

Member Function Documentation

◆ add_alert()

std::string kcenon::monitoring::alert_aggregator::add_alert ( const alert & a )

inline

Add an alert for aggregation.

Parameters

a	Alert to aggregate

Returns: Group key the alert was added to

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 92 of file alert_pipeline.h.

                                        {
        std::lock_guard<std::mutex> lock(mutex_);
 
        std::string group_key = compute_group_key(a);
        auto now = std::chrono::steady_clock::now();
 
        auto it = groups_.find(group_key);
        if (it == groups_.end()) {
            alert_group new_group(group_key);
            new_group.common_labels = extract_common_labels(a);
            new_group.add_alert(a);
            groups_[group_key] = std::move(new_group);
            first_seen_[group_key] = now;
        } else {
            // Check for duplicate
            bool is_duplicate = false;
            for (auto& existing : it->second.alerts) {
                if (existing.fingerprint() == a.fingerprint()) {
                    existing = a;  // Update existing alert
                    is_duplicate = true;
                    break;
                }
            }
            if (!is_duplicate) {
                it->second.add_alert(a);
            }
        }
 
        return group_key;
    }

References kcenon::monitoring::alert_group::add_alert(), kcenon::monitoring::alert_group::common_labels, compute_group_key(), extract_common_labels(), kcenon::monitoring::alert::fingerprint(), first_seen_, groups_, and mutex_.

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ cleanup()

void kcenon::monitoring::alert_aggregator::cleanup ( )

inline

Remove resolved alerts and clean up old groups.

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 170 of file alert_pipeline.h.

                   {
        std::lock_guard<std::mutex> lock(mutex_);
 
        auto now = std::chrono::steady_clock::now();
 
        for (auto it = groups_.begin(); it != groups_.end(); ) {
            auto& group = it->second;
 
            // Remove resolved alerts that have timed out
            auto alert_it = group.alerts.begin();
            while (alert_it != group.alerts.end()) {
                if (alert_it->state == alert_state::resolved) {
                    auto resolved_time = alert_it->resolved_at.value_or(now);
                    if (now - resolved_time > config_.resolve_timeout) {
                        alert_it = group.alerts.erase(alert_it);
                        continue;
                    }
                }
                ++alert_it;
            }
 
            // Remove empty groups
            if (group.empty()) {
                first_seen_.erase(it->first);
                last_sent_.erase(it->first);
                it = groups_.erase(it);
            } else {
                ++it;
            }
        }
    }

References config_, first_seen_, groups_, last_sent_, mutex_, kcenon::monitoring::alert_aggregator_config::resolve_timeout, and kcenon::monitoring::resolved.

Referenced by main().

Here is the caller graph for this function:

◆ compute_group_key()

std::string kcenon::monitoring::alert_aggregator::compute_group_key ( const alert & a ) const

inlineprivate

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 223 of file alert_pipeline.h.

                                                      {
        if (config_.group_by_labels.empty()) {
            return a.rule_name;
        }
 
        std::string key;
        for (const auto& label : config_.group_by_labels) {
            key += a.labels.get(label) + ":";
        }
        return key;
    }

References config_, kcenon::monitoring::alert_labels::get(), kcenon::monitoring::alert_aggregator_config::group_by_labels, kcenon::monitoring::alert::labels, and kcenon::monitoring::alert::rule_name.

Referenced by add_alert().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ extract_common_labels()

alert_labels kcenon::monitoring::alert_aggregator::extract_common_labels ( const alert & a ) const

inlineprivate

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 235 of file alert_pipeline.h.

                                                             {
        alert_labels common;
        for (const auto& label : config_.group_by_labels) {
            std::string val = a.labels.get(label);
            if (!val.empty()) {
                common.set(label, val);
            }
        }
        return common;
    }

References config_, kcenon::monitoring::alert_labels::get(), kcenon::monitoring::alert_aggregator_config::group_by_labels, kcenon::monitoring::alert::labels, and kcenon::monitoring::alert_labels::set().

Referenced by add_alert().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ get_ready_groups()

std::vector< alert_group > kcenon::monitoring::alert_aggregator::get_ready_groups ( )

inline

Get groups ready for notification.

Returns: Vector of ready groups

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 127 of file alert_pipeline.h.

                                              {
        std::lock_guard<std::mutex> lock(mutex_);
 
        std::vector<alert_group> ready;
        auto now = std::chrono::steady_clock::now();
 
        for (auto& [key, group] : groups_) {
            if (group.empty()) {
                continue;
            }
 
            // Check if first wait has elapsed
            auto first_seen = first_seen_[key];
            if (now - first_seen < config_.group_wait) {
                continue;
            }
 
            // Check if enough time since last send
            auto last_sent_it = last_sent_.find(key);
            if (last_sent_it != last_sent_.end()) {
                if (now - last_sent_it->second < config_.group_interval) {
                    continue;
                }
            }
 
            ready.push_back(group);
        }
 
        return ready;
    }

References config_, first_seen_, kcenon::monitoring::alert_aggregator_config::group_interval, kcenon::monitoring::alert_aggregator_config::group_wait, groups_, last_sent_, and mutex_.

Referenced by main().

Here is the caller graph for this function:

◆ group_count()

size_t kcenon::monitoring::alert_aggregator::group_count ( ) const

inline

Get current group count.

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 205 of file alert_pipeline.h.

                               {
        std::lock_guard<std::mutex> lock(mutex_);
        return groups_.size();
    }

References groups_, and mutex_.

Referenced by main().

Here is the caller graph for this function:

◆ mark_sent()

void kcenon::monitoring::alert_aggregator::mark_sent ( const std::string & group_key )

inline

Mark a group as sent.

Parameters

group_key Group key to mark

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 162 of file alert_pipeline.h.

                                               {
        std::lock_guard<std::mutex> lock(mutex_);
        last_sent_[group_key] = std::chrono::steady_clock::now();
    }

References last_sent_, and mutex_.

Referenced by main().

Here is the caller graph for this function:

◆ total_alert_count()

size_t kcenon::monitoring::alert_aggregator::total_alert_count ( ) const

inline

Get total alert count across all groups.

Examples: /home/runner/work/monitoring_system/monitoring_system/include/kcenon/monitoring/alert/alert_pipeline.h.

Definition at line 213 of file alert_pipeline.h.

                                     {
        std::lock_guard<std::mutex> lock(mutex_);
        size_t count = 0;
        for (const auto& [key, group] : groups_) {
            count += group.size();
        }
        return count;
    }