HOMER 5.x Alerts

Alert Management in HOMER 5.x

Homer 5.x provides a basic but powerful method to watch statistics and generate alarms/alerts.

TIMER_STATS

Logic

Alert counters will be evaluated by route[TIMER_STATS] triggered at time intervals configured homer capture plan - by default, this is set to 60 seconds:

modparam("rtimer", "timer", "name=ta;interval=60;mode=1;")

Route

route[TIMER_STATS] {
...
    #413 
    if($sht(a=>alarm::413) >  $avp(413)) {
        sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Too Many 413', $sht(a=>alarm::413), 'Too many big messages')");
    }
...
}

Counters

Available counters are defined in the main homer capture plan, and new ones can easily be extended.

onreply_route {

...
        if(status == "413") {
                if($sht(a=>alarm::413) == $null) $sht(a=>alarm::413) = 0;
                $sht(a=>alarm::413) = $sht(a=>alarm::413) + 1;
        }

...
}

Alert Notifier

By defaults no alerts will be reported with the exclusion of scanners. To set a threshold alarm for a specific group, browse to the HOMER User-Interface Alarms page, and select the New Alarm + Tab

Complete the available tabs according to your preferences, and click Create Alarm to save.