Skip to content

Commit

Permalink
updated offline query to be consistently 10 intervals (#135023)
Browse files Browse the repository at this point in the history
  • Loading branch information
@juliaElastic
juliaElastic authored Jun 24, 2022
1 parent f582589 commit 14c6405
Show file tree
Hide file tree
Showing 4 changed files with 10 additions and 8 deletions.
6 changes: 4 additions & 2 deletions x-pack/plugins/fleet/common/services/agent_status.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
import { AGENT_POLLING_THRESHOLD_MS } from '../constants';
import type { Agent, AgentStatus } from '../types';

const offlineTimeoutIntervalCount = 10; // 30s*10 = 5m timeout

export function getAgentStatus(agent: Agent): AgentStatus {
const { last_checkin: lastCheckIn } = agent;

Expand All @@ -34,7 +36,7 @@ export function getAgentStatus(agent: Agent): AgentStatus {
if (agent.upgrade_started_at && !agent.upgraded_at) {
return 'updating';
}
if (intervalsSinceLastCheckIn >= 10) {
if (intervalsSinceLastCheckIn >= offlineTimeoutIntervalCount) {
return 'offline';
}

Expand Down Expand Up @@ -63,7 +65,7 @@ export function buildKueryForErrorAgents(path: string = '') {

export function buildKueryForOfflineAgents(path: string = '') {
return `${path}last_checkin < now-${
(4 * AGENT_POLLING_THRESHOLD_MS) / 1000
(offlineTimeoutIntervalCount * AGENT_POLLING_THRESHOLD_MS) / 1000
}s AND not (${buildKueryForErrorAgents(path)}) AND not ( ${buildKueryForUpdatingAgents(path)} )`;
}

Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.fixtures.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ export const expectedCompleteUnitedIndexQuery = {
{
range: {
'united.agent.last_checkin': {
lt: 'now-120s',
lt: 'now-300s',
},
},
},
Expand Down
6 changes: 3 additions & 3 deletions ...ck/plugins/security_solution/server/endpoint/routes/metadata/support/agent_status.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,15 +93,15 @@ describe('test filtering endpoint hosts by agent status', () => {
const status = ['healthy'];
const kuery = buildStatusesKuery(status);
const expected =
'(not (united.agent.last_checkin < now-120s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) )) AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*)))';
'(not (united.agent.last_checkin < now-300s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) )) AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*)))';
expect(kuery).toEqual(expected);
});

it('correctly builds kuery for offline status', () => {
const status = ['offline'];
const kuery = buildStatusesKuery(status);
const expected =
'(united.agent.last_checkin < now-120s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) ))';
'(united.agent.last_checkin < now-300s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) ))';
expect(kuery).toEqual(expected);
});

Expand Down Expand Up @@ -132,7 +132,7 @@ describe('test filtering endpoint hosts by agent status', () => {
const statuses = ['offline', 'unhealthy'];
const kuery = buildStatusesKuery(statuses);
const expected =
'(united.agent.last_checkin < now-120s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) ) OR (united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*)))';
'(united.agent.last_checkin < now-300s AND not ((united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*))) AND not ( ((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*) ) OR (united.agent.last_checkin_status:error or united.agent.last_checkin_status:degraded) AND not (((united.agent.upgrade_started_at:*) and not (united.agent.upgraded_at:*)) or (not (united.agent.last_checkin:*)) or (united.agent.unenrollment_started_at:*)))';
expect(kuery).toEqual(expected);
});
});
Expand Down
4 changes: 2 additions & 2 deletions x-pack/test/fleet_api_integration/apis/agents/status.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ export default function ({ getService }: FtrProviderContext) {
index: AGENTS_INDEX,
body: {
doc: {
last_checkin: new Date().toISOString(),
last_checkin: new Date(Date.now() - 1000 * 60 * 3).toISOString(), // 2m online
},
},
});
Expand All @@ -46,7 +46,7 @@ export default function ({ getService }: FtrProviderContext) {
index: AGENTS_INDEX,
body: {
doc: {
last_checkin: new Date(Date.now() - 1000 * 60 * 60 * 60 * 10).toISOString(),
last_checkin: new Date(Date.now() - 1000 * 60 * 6).toISOString(), // 6m offline
},
},
});
Expand Down

0 comments on commit 14c6405

Please sign in to comment.