Пример #1
0
        // Conditions to return
        // - Buffer is full
        // - Consume timeout
        // - Last saved was too far ago
        public Tuple <List <ActivityAlert>, AlertProduceReason> ConsumeInSmallBatch()
        {
            var alerts = new List <ActivityAlert>();
            var reason = AlertProduceReason.Undefined;

            while (true)
            {
                ActivityAlert alert = ConsumeItem();
                if (alert != null)
                {
                    alerts.Add(alert);
                }

                if (alerts.Count >= BufferSize)
                {
                    reason = AlertProduceReason.MaxBufferSizeReached;
                }
                if (alert == null)
                {
                    reason = AlertProduceReason.ConsumeTimeout;
                }
                if (DateTime.UtcNow > _lastProduced.Add(_maxLastSavedTimeSpan))
                {
                    reason = AlertProduceReason.LastSavedTooLongAgo;
                }

                if (reason != AlertProduceReason.Undefined)
                {
                    _lastProduced = DateTime.UtcNow;
                    return(new Tuple <List <ActivityAlert>, AlertProduceReason>(alerts, reason));
                }
            }
        }
Пример #2
0
        // Add alert to a shared memory buffer
        public void SendAlert(List <ActivityEvent> tmpEvents)
        {
            var    alert      = new ActivityAlert(_ruleId, DateTime.UtcNow, tmpEvents.ToArray());
            var    offset     = new DateTimeOffset(DateTime.UtcNow);
            string logMessage = $"New alert: {offset:dd-MM-yyyy HH:mm:ss}, rule id: {alert.RuleId}, " +
                                $"user {alert.Events[0].User}, {tmpEvents.Count} events ";

            _alertLog.Warn(logMessage);
            NesperPerformance.TotalAlerts++;
            _alertBuffer.Add(alert);
        }