// Conditions to return // - Buffer is full // - Consume timeout // - Last saved was too far ago public Tuple <List <ActivityAlert>, AlertProduceReason> ConsumeInSmallBatch() { var alerts = new List <ActivityAlert>(); var reason = AlertProduceReason.Undefined; while (true) { ActivityAlert alert = ConsumeItem(); if (alert != null) { alerts.Add(alert); } if (alerts.Count >= BufferSize) { reason = AlertProduceReason.MaxBufferSizeReached; } if (alert == null) { reason = AlertProduceReason.ConsumeTimeout; } if (DateTime.UtcNow > _lastProduced.Add(_maxLastSavedTimeSpan)) { reason = AlertProduceReason.LastSavedTooLongAgo; } if (reason != AlertProduceReason.Undefined) { _lastProduced = DateTime.UtcNow; return(new Tuple <List <ActivityAlert>, AlertProduceReason>(alerts, reason)); } } }
// Add alert to a shared memory buffer public void SendAlert(List <ActivityEvent> tmpEvents) { var alert = new ActivityAlert(_ruleId, DateTime.UtcNow, tmpEvents.ToArray()); var offset = new DateTimeOffset(DateTime.UtcNow); string logMessage = $"New alert: {offset:dd-MM-yyyy HH:mm:ss}, rule id: {alert.RuleId}, " + $"user {alert.Events[0].User}, {tmpEvents.Count} events "; _alertLog.Warn(logMessage); NesperPerformance.TotalAlerts++; _alertBuffer.Add(alert); }