// Conditions to return
// - Buffer is full
// - Consume timeout
// - Last saved was too far ago
public Tuple <List <ActivityAlert>, AlertProduceReason> ConsumeInSmallBatch()
{
var alerts = new List <ActivityAlert>();
var reason = AlertProduceReason.Undefined;
while (true)
{
ActivityAlert alert = ConsumeItem();
if (alert != null)
{
alerts.Add(alert);
}
if (alerts.Count >= BufferSize)
{
reason = AlertProduceReason.MaxBufferSizeReached;
}
if (alert == null)
{
reason = AlertProduceReason.ConsumeTimeout;
}
if (DateTime.UtcNow > _lastProduced.Add(_maxLastSavedTimeSpan))
{
reason = AlertProduceReason.LastSavedTooLongAgo;
}
if (reason != AlertProduceReason.Undefined)
{
_lastProduced = DateTime.UtcNow;
return(new Tuple <List <ActivityAlert>, AlertProduceReason>(alerts, reason));
}
}
}
// Add alert to a shared memory buffer
public void SendAlert(List <ActivityEvent> tmpEvents)
{
var alert = new ActivityAlert(_ruleId, DateTime.UtcNow, tmpEvents.ToArray());
var offset = new DateTimeOffset(DateTime.UtcNow);
string logMessage = $"New alert: {offset:dd-MM-yyyy HH:mm:ss}, rule id: {alert.RuleId}, " +
$"user {alert.Events[0].User}, {tmpEvents.Count} events ";
_alertLog.Warn(logMessage);
NesperPerformance.TotalAlerts++;
_alertBuffer.Add(alert);
}