SmartResponse-Framework / SmartResponse.Framework

PowerShell module for developing LogRhythm SmartResponse Plugins
Other
8 stars 2 forks source link

Error handling for non existent drill downs #11

Closed timbrigham closed 4 years ago

timbrigham commented 4 years ago

I've noticed that if I use Get-LrAieDrilldown in a smart response it's quite possible to have it execute prior to the logs being added to the alarm, resulting in something like the following for several seconds after the call.

Get-LrAieDrilldown -AlarmId 108939

AlarmID           :
AlarmGuid         :
Priority          :
AIERuleName       :
Status            :
Logs              : {}
SummaryFields     : {}
NotificationSent  :
EventID           :
NormalMessageDate :
AIEMsgXml         :

I can work around this by checking for values / sizes of the data returned and retrying the API call, but it seemed odd enough to mention here.

GeneCupstid commented 4 years ago

Thanks @timbrigham - I have a fix for this. I will be uploading within the next day or so.

(from new comment-based help)

        To mitigate this, Get-LrAieDrilldown will reattempt the request 
        (18) times, waiting (10 seconds) between each attempt. These
        values can be modified by specifying the RetryAttempts and
        RetryWaitSeconds parameters. This should be sufficient for the
        majority of alarms unless the platform is under heavy load.

image

GeneCupstid commented 4 years ago

Also, the longest time I've encountered so far is just over 2 minutes, which was a peak event time during the day - though I'm not sure what others are used to seeing. :)

Since implementing this version, my SRPs have had no issues with getting drilldowns. That's been running for about a week.

timbrigham commented 4 years ago

Thanks @GeneCupstid. So far my response times tend to be around 30 seconds or less. I'll pull down the new version shortly. :)

Jt3kt commented 4 years ago

Just checking in here, how're we looking on the builtin handler for this?

timbrigham commented 4 years ago

Apologies, I've been working on other projects. I'll pull the latest version and get back to you.

GeneCupstid commented 4 years ago

This is implemented. Going forward we will track the PRs more appropriately so these can be properly linked.