Automatic actionable event responder for operational clusters
An operational event processor receives information describing operational events arising in relation to a server cluster of a data intake and query system. Responsive actions are identified for the events that are actionable, and those responsive actions are automatically dispatched. Dispatching may include automatically causing the performance of the actions based on remembered preauthorizations, or automatically causing the performance of the actions based on obtaining real time user authorizations. The operational event processor may employ mechanisms to provide extensibility and a high degree of interoperability with other system components.
1. A computer-implemented method comprising:
receiving information at an operational event processing server, the information indicative of an actionable event occurrence pertaining to at least one member of a server cluster;
determining an event-type code based at least in part on the received information;
retrieving an event-type response map entry matching the event-type code;
determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry;
determining, in response to determining that the time-based criterion is satisfied and that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster;
based on a preauthorization value being set in a dispatch field of the event-type response map entry, generating an invocation message to a resolution handler, wherein the dispatch field is configured to store a plurality of values comprising the preauthorization value, an ignore value, and an interactive value; and
performing, by the resolution handler, the response action to the actionable event occurrence.
2. The computer-implemented method of claim 1 , wherein the determined event-type code is reflected in an actionable event queue entry in computer storage.
3. The computer-implemented method of claim 1 , wherein the determined event-type code and a related timestamp are reflected in an actionable event queue entry in computer storage.
4. The computer-implemented method of claim 1 , wherein the determined event-type code, a related timestamp, and a related source-type indicator are reflected in an actionable event queue entry in computer storage.
5. The computer-implemented method of claim 1 , wherein the received information was produced by a member of the server cluster.
6. The computer-implemented method of claim 1 , wherein the received information was produced by a machine instance outside of the server cluster.
7. The computer-implemented method of claim 1 , further comprising:
transmitting a response action message to the resolution handler on an authority member of the server cluster.
8. The computer-implemented method of claim 1 , further comprising:
transmitting a response action message to the resolution handler on an authority member of the server cluster, wherein the authority member, in response to the response action message, communicates with at least one other member of the server cluster to cause performance of the response action.
9. The computer-implemented method of claim 1 , further comprising:
transmitting a response action message to the resolution handler on an authority member of the server cluster, wherein the authority member, in response to the response action message, communicates with a plurality of other members of the server cluster to cause performance of the response action.
10. The computer-implemented method of claim 1 , wherein the preauthorization value is set in the dispatch field via a user interface.
11. The computer-implemented method of claim 1 , wherein retrieving the event-type response map entry comprising correlating the event-type code in an event queue entry to the event-type response map entry of an event-type response map.
12. The computer-implemented method of claim 1 , wherein the event-type code is fully qualified in the event-type response map entry.
13. The computer-implemented method of claim 1 , wherein the response action signifier comprises at least one from among a class name, a procedure name, a filename, a remote procedure call name, and a script name.
14. A system comprising:
a memory; and
a processing device coupled with the memory to perform operations comprising:
receiving information at an operational event processing server, the information indicative of an actionable event occurrence pertaining to at least one member of a server cluster;
determining an event-type code based at least in part on the received information;
retrieving an event-type response map entry matching the event-type code;
determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry;
determining, in response to determining that the time-based criterion is satisfied and that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster;
based on a preauthorization value being set in a dispatch field of the event-type response map entry, generating an invocation message to a resolution handler, wherein the dispatch field is configured to store a plurality of values comprising the preauthorization value, an ignore value, and an interactive value; and
performing, by the resolution handler, the response action to the actionable event occurrence.
15. The system of claim 14 , wherein the determined event-type code is reflected in an actionable event queue entry in computer storage.
16. The system of claim 14 , wherein the received information was produced by a member of the server cluster.
17. The system of claim 14 , wherein the received information was produced by a machine instance outside of the server cluster.
18. The system of claim 14 , further comprising:
transmitting a response action message to the resolution handler on an authority member of the server cluster.
19. The system of claim 14 , further comprising:
transmitting a response action message to a resolution handler on an authority member of the server cluster, wherein the authority member, in response to the response action message, communicates with at least one other member of the server cluster to cause performance of the response action.
20. The system of claim 14 , wherein the preauthorization value is set in the dispatch field via a user interface.
21. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
receiving information at an operational event processing server, the information indicative of an actionable event occurrence pertaining to at least one member of a server cluster;
determining an event-type code based at least in part on the received information;
retrieving an event-type response map entry matching the event-type code;
determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry;
determining, in response to determining that the time-based criterion is satisfied and that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster;
based on a preauthorization value being set in a dispatch field of the event-type response map entry, generating an invocation message to a resolution handler, wherein the dispatch field is configured to store a plurality of values comprising the preauthorization value, an ignore value, and an interactive value; and
performing, by the resolution handler, the response action to the actionable event occurrence.
22. The non-transitory computer readable storage medium of claim 21 , wherein the determined event-type code is reflected in an actionable event queue entry in computer storage.
23. The non-transitory computer readable storage medium of claim 21 , wherein the received information was produced by a member of the server cluster.
24. The non-transitory computer readable storage medium of claim 21 , further comprising:
transmitting a response action message to the resolution handler on an authority member of the server cluster.