public async Task <NormalizedLog> Edit(NormalizedLog model)
{
var result = await _normalizedLogRepository.Update(model);
if (result)
{
return(await _normalizedLogRepository.Read(model.Id));
}
throw new ArgumentException();
}
public async Task <NormalizedLog> Create(NormalizedLog model)
{
var createdId = await _normalizedLogRepository.Create(model);
return(await _normalizedLogRepository.Read(createdId));
}
private async Task <IEnumerable <AlertValue> > GenerateAlertsNonConstantValue(IList <NormalizedLog> logs,
IList <Alert> alerts)
{
var componentId = logs.First().ComponentId;
var alertValues = new List <AlertValue>();
if (alerts.Any())
{
var longestTimespan = alerts.Select(elem => elem.Timespan).Max();
var firstLogTime = logs.Select(elem => elem.DateTime).Min();
var lastLogTime = logs.Select(elem => elem.DateTime).Max();
var startDateTime = firstLogTime - longestTimespan;
var endDateTime = lastLogTime + longestTimespan;
var materializedLogs =
(await _normalizedLogRepository.WithinTimeFrameForComponents(new[] { componentId }, startDateTime, endDateTime,
null)).OrderBy(elem => elem.DateTime).ToArray();
foreach (var alert in alerts)
{
var earliestEvent = firstLogTime - alert.Timespan;
var latestEvent = lastLogTime + alert.Timespan;
var rule = alert.GeneralRule;
var valueMatcher = alert.Value;
var logsWithinTimeFrame =
materializedLogs.Where(elem => elem.DateTime >= earliestEvent && elem.DateTime <= latestEvent).ToArray();
NormalizedLog startLog = null;
var eventCount = 0;
foreach (var log in logsWithinTimeFrame)
{
var isMatch = IsMatch(rule.Id, log, valueMatcher, out var matchedValue);
if (startLog == null)
{
if (isMatch)
{
startLog = log;
eventCount++;
}
}
else
{
if (isMatch)
{
eventCount++;
}
if (eventCount >= alert.Threshold)
{
// create new alert value and save it to db
var alertValue = new AlertValue
{
Id = 0, AlertId = alert.Id, TimespanStart = startLog.DateTime, TimespanEnd = log.DateTime,
ConstantValue = null
};
var createdId = await _alertValueRepository.Create(alertValue);
alertValues.Add(await _alertValueRepository.Read(createdId));
// reset event count
eventCount = 0;
// start search for new window beginning
startLog = null;
}
else
{
var diff = startLog.DateTime - log.DateTime;
if (diff > alert.Timespan)
{
// find next start, search until new positive match is found or until end of current windows is found
var nextLogStart = logsWithinTimeFrame.FirstOrDefault(elem =>
elem.DateTime > startLog.DateTime && elem.DateTime <= log.DateTime &&
IsMatch(rule.Id, elem, valueMatcher, out var nextConstantValue));
// current window is closed, we restart search
if (nextLogStart == null || nextLogStart.Id == log.Id)
{
eventCount = 0;
startLog = null;
}
// we found middle match
else
{
// we lost previous first match
eventCount--;
startLog = nextLogStart;
}
}
}
}
}
}
}
return(alertValues);
}
