feat(log,notify): notification of action log exceed count (#14606)

2026-09-01 15:07:17 +08:00 · 2022-07-12 06:58:46 +08:00
parent 07997efbaa
commit 2c1042c6bb
13 changed files with 74 additions and 8 deletions
@@ -0,0 +1,2 @@
+{{- $d := .resource_details.action -}}
+当前日志 ID: {{ $d.id }}
@@ -1,6 +1,6 @@
 {{- $d := .resource_details -}}
-{{- if eq .resource_type "db_table_field" }}
-数据库{{ $d.db_name }}表{{ $d.table_name }}记录{{ $d.name }}被修改，完整性校验失败
+{{- if eq .resource_type "db_table_record" }}
+表{{ $d.table_name }}记录{{ $d.name }}被修改，完整性校验失败。期望校验和({{ $d.expected_checksum }}) != 计算校验和({{ $d.calculated_checksum }})。
 {{- end -}}
 {{- if eq .resource_type "cloudpods_component" }}
 {{ $d.details }}
@@ -0,0 +1,2 @@
+{{- $d := .resource_details.action -}}
+Current log ID: {{ $d.id }}
@@ -1,6 +1,6 @@
 {{- $d := .resource_details -}}
-{{- if eq .resource_type "db_table_field" }}
-The record {{ $d.name }} in table {{ $d.table_name }} of the database {{ $d.db_name }} has been modified because the checksum test failed.
+{{- if eq .resource_type "db_table_record" }}
+The record {{ $d.name }} in table {{ $d.table_name }} of the database {{ $d.db_name }} has been modified because the checksum test failed. Expected_checksum({{ $d.expected_checksum }}) != Calculated_checksum({{ $d.calculated_checksum }}).
 {{- end -}}
 {{- if eq .resource_type "cloudpods_component" }}
 {{ $d.details }}
@@ -0,0 +1,2 @@
+{{- $d := .resource_details -}}
+操作日志超出设置数量{{ $d.exceed_count }}条，当前{{ $d.current_count }}条
@@ -0,0 +1,2 @@
+{{- $d := .resource_details -}}
+Action logs excced expected count {{ $d.exceed_count }}, current count is {{ $d.current_count }}
@@ -125,6 +125,7 @@ const (
 	TOPIC_RESOURCE_DB_TABLE_RECORD          = "db_table_record"
 	TOPIC_RESOURCE_CLOUDPODS_COMPONENT      = "cloudpods_component"
 	TOPIC_RESOURCE_USER                     = "user"
+	TOPIC_RESOURCE_ACTION_LOG               = "action_log"

 	SUBSCRIBER_TYPE_ROLE     = "role"
 	SUBSCRIBER_TYPE_ROBOT    = "robot"
@@ -52,6 +52,8 @@ var (

 	ActionLock SAction = "lock"

+	ActionExceedCount SAction = "exceed_count"
+
 	ResultFailed  SResult = "failed"
 	ResultSucceed SResult = "succeed"
 )
@@ -107,9 +107,16 @@ func CheckRecordChecksumConsistent(model IModel) error {
 		ts := model.GetModelManager().TableSpec()
 		// notify
 		data := jsonutils.NewDict()
+		spt := ts.GetSplitTable()
+		tableName := ts.Name()
+		if spt != nil {
+			tableName = spt.Name()
+		}
 		data.Set("db_name", jsonutils.NewString(string(ts.GetDBName())))
-		data.Set("table_name", jsonutils.NewString(ts.Name()))
+		data.Set("table_name", jsonutils.NewString(tableName))
 		data.Set("name", jsonutils.NewString(fmt.Sprintf("%s(%s)", obj.Keyword(), obj.GetId())))
+		data.Set("expected_checksum", jsonutils.NewString(savedChecksum))
+		data.Set("calculated_checksum", jsonutils.NewString(calChecksum))
 		if checksumTestFailedNotifier != nil {
 			checksumTestFailedNotifier(data)
 		}
@@ -29,8 +29,10 @@ import (

 	"yunion.io/x/onecloud/pkg/apis"
 	api "yunion.io/x/onecloud/pkg/apis/logger"
+	noapi "yunion.io/x/onecloud/pkg/apis/notify"
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/cloudcommon/notifyclient"
 	"yunion.io/x/onecloud/pkg/logger/extern"
 	"yunion.io/x/onecloud/pkg/logger/options"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -52,6 +54,8 @@ func IsInActionWhiteList(key string) bool {
 type SActionlogManager struct {
 	db.SOpsLogManager
 	db.SRecordChecksumResourceBaseManager
+
+	lastExceedCountNotifyTime time.Time
 }

 type SActionlog struct {
@@ -234,6 +238,31 @@ func (self *SActionlog) PostCreate(ctx context.Context, userCred mcclient.TokenC
 	} {
 		db.DistinctFieldManager.InsertOrUpdate(ctx, ActionLog, k, v)
 	}
+
+	ActionLog.notifyIfExceedCount(ctx, self)
+}
+
+func (manager *SActionlogManager) notifyIfExceedCount(ctx context.Context, l *SActionlog) {
+	exceedCnt := options.Options.ActionLogExceedCount
+	if exceedCnt <= 0 {
+		return
+	}
+
+	interval := utils.ToDuration(options.Options.ActionLogExceedCountNotifyInterval)
+	if time.Since(manager.lastExceedCountNotifyTime) < interval {
+		return
+	}
+	totalCnt := ActionLog.Query().Count()
+	if totalCnt >= exceedCnt {
+		result := map[string]interface{}{
+			"action":        jsonutils.Marshal(l),
+			"current_count": totalCnt,
+			"exceed_count":  exceedCnt,
+		}
+		resultObj := jsonutils.Marshal(result).(*jsonutils.JSONDict)
+		notifyclient.SystemExceptionNotifyWithResult(ctx, noapi.ActionExceedCount, noapi.TOPIC_RESOURCE_ACTION_LOG, "", resultObj)
+		manager.lastExceedCountNotifyTime = time.Now()
+	}
 }

 // 操作日志列表
@@ -28,9 +28,11 @@ type SLoggerOptions struct {

 	EnableSeparateAdminLog bool `help:"enable separate log for auditor admin" default:"false"`

-	SecadminRoleNames []string `help:"role names of security admin" default:"sys_secadmin,domain_secadmin"`
-	OpsadminRoleNames []string `help:"role names of operation admin" default:"sys_opsadmin,domain_opsadmin"`
-	AuditorRoleNames  []string `help:"role names of auditor admin" default:"sys_adtadmin,domain_adtadmin"`
+	SecadminRoleNames                  []string `help:"role names of security admin" default:"sys_secadmin,domain_secadmin"`
+	OpsadminRoleNames                  []string `help:"role names of operation admin" default:"sys_opsadmin,domain_opsadmin"`
+	AuditorRoleNames                   []string `help:"role names of auditor admin" default:"sys_adtadmin,domain_adtadmin"`
+	ActionLogExceedCount               int      `help:"trigger notification when action log exceed count" default:"-1"`
+	ActionLogExceedCountNotifyInterval string   `help:"trigger notification interval" default:"5m"`
 }

 var (
@@ -507,6 +507,11 @@ func init() {
 			"database table record",
 			"数据库记录",
 		},
+		sI18nElme{
+			api.TOPIC_RESOURCE_ACTION_LOG,
+			"action log",
+			"操作日志",
+		},
 		sI18nElme{
 			api.TOPIC_RESOURCE_CLOUDPODS_COMPONENT,
 			"cloudpods component",
@@ -94,6 +94,7 @@ const (
 	DefaultSystemExceptionEvent    = "system exception event"
 	DefaultChecksumTestFailed      = "checksum test failed"
 	DefaultUserLock                = "user lock"
+	DefaultActionLogExceedCount    = "action log exceed count"
 )

 func (sm *STopicManager) InitializeData() error {
@@ -112,6 +113,7 @@ func (sm *STopicManager) InitializeData() error {
 		DefaultSystemExceptionEvent,
 		DefaultChecksumTestFailed,
 		DefaultUserLock,
+		DefaultActionLogExceedCount,
 	)
 	q := sm.Query()
 	topics := make([]STopic, 0, initSNames.Len())
@@ -317,6 +319,14 @@ func (sm *STopicManager) InitializeData() error {
 				notify.ActionLock,
 			)
 			t.Type = notify.TOPIC_TYPE_SECURITY
+		case DefaultActionLogExceedCount:
+			t.addResources(
+				notify.TOPIC_RESOURCE_ACTION_LOG,
+			)
+			t.addAction(
+				notify.ActionExceedCount,
+			)
+			t.Type = notify.TOPIC_TYPE_RESOURCE
 		}
 		if topic == nil {
 			err := sm.TableSpec().Insert(ctx, t)
@@ -545,6 +555,7 @@ func init() {
 			notify.TOPIC_RESOURCE_CLOUDPODS_COMPONENT:      34,
 			notify.TOPIC_RESOURCE_DB_TABLE_RECORD:          35,
 			notify.TOPIC_RESOURCE_USER:                     36,
+			notify.TOPIC_RESOURCE_ACTION_LOG:               37,
 		},
 	)
 	converter.registerAction(
@@ -572,6 +583,7 @@ func init() {
 			notify.ActionSystemException:    20,
 			notify.ActionChecksumTest:       21,
 			notify.ActionLock:               22,
+			notify.ActionExceedCount:        23,
 		},
 	)
 }