jcoffey-dev
d05ebe046c
Two faults, both found by running the reset against the demo rather than by reading it, and both fixed on the box before this commit existed. The reset raced its own alerting container. Writing .env changes alerting's environment, so `docker compose up -d alerting` recreates it -- and the next line posted notification targets to it with no wait. On a busy box that lost: curl returned nothing, json.load threw on an empty string, and set -e killed the script. The damage is in the ordering: `docker compose down -v` runs near the top, so any failure after it leaves the public demo up, empty, and with the simulator still stopped, because the unit is only restarted on the last line. It has been surviving nightly on timing alone. It now polls /healthz for up to 60 seconds and fails loudly before the seed rather than after the wipe. Five dashboard panels were raw ClickHouse SQL, which dashboards refuse: validatePanel rejects query_language "sql" outright, because the time-range picker is injected as leading query terms and a SELECT has nowhere to put them. They were written that way because the pipe syntax has no time bucketing -- no timechart, no bin -- so a genuine time series is not available to a dashboard panel at all. Each is now the breakdown the panel was actually asking for: kubelet events by kind and host, DNS by type and result, queue depth by queue and host, IIS by site and host, HAProxy by backend and balancer. Both mistakes were mine and both were avoidable by reading: the rule about pipe-syntax-only dashboards is stated in terraform/README.md, and I had already read the line that says it. Verified on the demo: 50 hosts, 24 services, 1,922,128 records, all 13 dashboards and all 11 alert rules applied, simulator active. `system` appears on exactly 31 hosts, which is the Linux count -- no Windows host was given a journald stream.
139 lines
3.6 KiB
JSON
139 lines
3.6 KiB
JSON
{
|
|
"name": "Windows server estate",
|
|
"description": "IIS, SQL Server, Exchange and the file servers -- the Windows tier as services rather than a Security channel",
|
|
"default_earliest": "-24h",
|
|
"default_latest": "now",
|
|
"panels": [
|
|
{
|
|
"title": "IIS requests",
|
|
"query": "service=iis | stats count",
|
|
"viz_type": "single_stat",
|
|
"position_x": 0,
|
|
"position_y": 0,
|
|
"width": 3,
|
|
"height": 3,
|
|
"query_language": "spl",
|
|
"sort_order": 0
|
|
},
|
|
{
|
|
"title": "IIS 5xx",
|
|
"query": "service=iis | where status>=500 | stats count",
|
|
"viz_type": "single_stat",
|
|
"position_x": 3,
|
|
"position_y": 0,
|
|
"width": 3,
|
|
"height": 3,
|
|
"query_language": "spl",
|
|
"sort_order": 1
|
|
},
|
|
{
|
|
"title": "SQL deadlocks",
|
|
"query": "service=mssql event_kind=deadlock | stats count",
|
|
"viz_type": "single_stat",
|
|
"position_x": 6,
|
|
"position_y": 0,
|
|
"width": 3,
|
|
"height": 3,
|
|
"query_language": "spl",
|
|
"sort_order": 2
|
|
},
|
|
{
|
|
"title": "Mail bounces",
|
|
"query": "service=exchange event_kind=bounce | stats count",
|
|
"viz_type": "single_stat",
|
|
"position_x": 9,
|
|
"position_y": 0,
|
|
"width": 3,
|
|
"height": 3,
|
|
"query_language": "spl",
|
|
"sort_order": 3
|
|
},
|
|
{
|
|
"title": "IIS requests by site and host",
|
|
"query": "service=iis | stats count by site, host | sort -count",
|
|
"viz_type": "bar",
|
|
"position_x": 0,
|
|
"position_y": 3,
|
|
"width": 12,
|
|
"height": 5,
|
|
"viz_config": {
|
|
"x_column": "site",
|
|
"value_column": "count",
|
|
"series_column": "host",
|
|
"stacked": "true"
|
|
},
|
|
"query_language": "spl",
|
|
"sort_order": 4
|
|
},
|
|
{
|
|
"title": "IIS status mix",
|
|
"query": "service=iis | stats count by status | sort -count",
|
|
"viz_type": "bar",
|
|
"position_x": 0,
|
|
"position_y": 8,
|
|
"width": 6,
|
|
"height": 5,
|
|
"viz_config": {
|
|
"x_column": "status",
|
|
"value_column": "count"
|
|
},
|
|
"query_language": "spl",
|
|
"sort_order": 5
|
|
},
|
|
{
|
|
"title": "SQL Server events by database",
|
|
"query": "service=mssql | stats count by db, event_kind",
|
|
"viz_type": "bar",
|
|
"position_x": 6,
|
|
"position_y": 8,
|
|
"width": 6,
|
|
"height": 5,
|
|
"viz_config": {
|
|
"x_column": "db",
|
|
"value_column": "count",
|
|
"series_column": "event_kind",
|
|
"stacked": "true"
|
|
},
|
|
"query_language": "spl",
|
|
"sort_order": 6
|
|
},
|
|
{
|
|
"title": "Busiest shares",
|
|
"query": "service=smb | stats count by share | sort -count | head 10",
|
|
"viz_type": "top_n",
|
|
"position_x": 0,
|
|
"position_y": 13,
|
|
"width": 6,
|
|
"height": 5,
|
|
"viz_config": {
|
|
"label_column": "share",
|
|
"value_column": "count"
|
|
},
|
|
"query_language": "spl",
|
|
"sort_order": 7
|
|
},
|
|
{
|
|
"title": "Denied share access",
|
|
"query": "service=smb event_kind=share_denied | sort -timestamp | head 25 | fields timestamp, host, share, winevt.target_user, message",
|
|
"viz_type": "table",
|
|
"position_x": 6,
|
|
"position_y": 13,
|
|
"width": 6,
|
|
"height": 5,
|
|
"query_language": "spl",
|
|
"sort_order": 8
|
|
},
|
|
{
|
|
"title": "SQL login failures and deadlocks",
|
|
"query": "service=mssql event_kind!=login | sort -timestamp | head 25 | fields timestamp, host, db, event_kind, message",
|
|
"viz_type": "table",
|
|
"position_x": 0,
|
|
"position_y": 18,
|
|
"width": 12,
|
|
"height": 5,
|
|
"query_language": "spl",
|
|
"sort_order": 9
|
|
}
|
|
]
|
|
}
|