detect: a window on a quiet source closes (VEJAS_IDLE_CLOSE_SECS) - #4
Merged
Merged
Conversation
A detect unit sets the engine's idle grace (varpulis #286, main 92f07b9) from VEJAS_IDLE_CLOSE_SECS, 60 seconds by default, 0 turns it off, after restoring its snapshot, and ticks the program on every idle poll (the 500 ms receive timeout), publishing what the tick closes: those emits stand for no message, so nothing is acked, and a crash before the next snapshot replays and closes them again. Tick emits count in vejas_emits_published (metrics::observe_tick_emits), not as processed events. The emit subject is worked out by one helper for both paths. e2e/detect D7: three VPN failures, then silence, with a 5 s window and VEJAS_IDLE_CLOSE_SECS=1: the alert arrives with n = 3; the v0.3.2 runtime never raises it. D4 lists four units. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3K1TGnWTvwYzt9rKuJXES
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Since v0.3.2, a detect unit closes a window on the next event of its source past the window's end. A source that goes quiet sends no such event. A brute force on VPN logons, or on one application's log, was therefore raised only when that source spoke again.
What changes
92f07b9(#286). The engine gains an idle grace: once a type has sent nothing for the grace, its event time moves on with the wall clock, minus the grace. Its clock is also kept in the snapshot.VEJAS_IDLE_CLOSE_SECS: 60 s by default, and0turns it off. It does so after restoring its snapshot.vejas_emits_published, not as processed events.emit_subject) works out the emit subject for both paths.e2e/detectD7. The scenario is three VPN failures, then silence, with a 5 s window andVEJAS_IDLE_CLOSE_SECS=1. The alert arrives withn = 3. Against the published v0.3.2 binary (VEJAS_BIN), D7 fails: nothing is ever raised. D4 now lists four units.detects.mddocumentsVEJAS_IDLE_CLOSE_SECS, and the CHANGELOG entry sits under Unreleased.Checks run locally
cargo test: 43 passed.e2e/detect/run.sh: all invariants hold.e2e/detect-demo/run.sh: every beat holds.🤖 Generated with Claude Code
https://claude.ai/code/session_01N3K1TGnWTvwYzt9rKuJXES