rsigma-runtime 0.18.0

Streaming runtime for rsigma — event sources, sinks, and log processing pipeline
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

//! Versioned persistence snapshot for the alert pipeline.
//!
//! Captures the four pieces of mutable state (dedup active alerts, open
//! incidents, dynamic silences, inhibition active sources) in a single
//! serializable struct. The entity index and cardinality counters are not
//! persisted; the index is rebuilt from the restored incidents on boot.

use serde::{Deserialize, Serialize};

use super::dedup::ActiveAlert;
use super::grouping::Incident;
use super::inhibit::InhibitSourceSnap;
use super::silence::SilenceSnap;

/// Bumped when the snapshot layout changes incompatibly; a mismatch on load
/// logs a warning and the daemon starts with fresh state.
pub const SNAPSHOT_VERSION: u32 = 1;

/// A point-in-time snapshot of the alert pipeline's mutable state.
#[derive(Debug, Serialize, Deserialize)]
pub struct AlertPipelineSnapshot {
    /// Snapshot layout version.
    pub version: u32,
    /// Active dedup alerts as `(fingerprint, alert)` pairs.
    #[serde(default)]
    pub(crate) dedup: Vec<(String, ActiveAlert)>,
    /// Open incidents.
    #[serde(default)]
    pub(crate) incidents: Vec<Incident>,
    /// Dynamic (API) silences; static ones are re-seeded from config.
    #[serde(default)]
    pub(crate) silences: Vec<SilenceSnap>,
    /// Inhibition active sources.
    #[serde(default)]
    pub(crate) inhibit_sources: Vec<InhibitSourceSnap>,
}