1
+ // Copyright observIQ, Inc.
2
+ //
3
+ // Licensed under the Apache License, Version 2.0 (the "License");
4
+ // you may not use this file except in compliance with the License.
5
+ // You may obtain a copy of the License at
6
+ //
7
+ // http://www.apache.org/licenses/LICENSE-2.0
8
+ //
9
+ // Unless required by applicable law or agreed to in writing, software
10
+ // distributed under the License is distributed on an "AS IS" BASIS,
11
+ // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+ // See the License for the specific language governing permissions and
13
+ // limitations under the License.
14
+
1
15
package loganomalyconnector
2
16
3
17
import (
@@ -11,6 +25,10 @@ import (
11
25
"go.uber.org/zap"
12
26
)
13
27
28
+ // Detector implements the log anomaly detection connector.
29
+ // It maintains a rolling window of log rate samples and uses statistical analysis
30
+ // to detect anomalies in log throughput. The detector processes incoming logs,
31
+ // calculates rates, and generates alerts when anomalous patterns are detected.
14
32
type Detector struct {
15
33
ctx context.Context
16
34
cancel context.CancelFunc
@@ -48,7 +66,9 @@ func newDetector(config *Config, logger *zap.Logger, nextConsumer consumer.Logs)
48
66
}
49
67
}
50
68
51
- func (d * Detector ) Start (_ context.Context , host component.Host ) error {
69
+ // Start begins the anomaly detection process, sampling at intervals specified in the config.
70
+ // It launches a background goroutine that periodically checks for and updates anomalies.
71
+ func (d * Detector ) Start (_ context.Context , _ component.Host ) error {
52
72
ticker := time .NewTicker (d .config .SampleInterval )
53
73
54
74
go func () {
@@ -65,15 +85,21 @@ func (d *Detector) Start(_ context.Context, host component.Host) error {
65
85
return nil
66
86
}
67
87
88
+ // Shutdown stops the detector's operations by canceling its context.
89
+ // It cleans up any resources and stops the background sampling process.
68
90
func (d * Detector ) Shutdown (_ context.Context ) error {
69
91
d .cancel ()
70
92
return nil
71
93
}
72
94
95
+ // Capabilities returns the consumer capabilities of the detector.
96
+ // It indicates that this detector does not mutate the data it processes.
73
97
func (d * Detector ) Capabilities () consumer.Capabilities {
74
98
return consumer.Capabilities {MutatesData : false }
75
99
}
76
100
101
+ // ConsumeLogs processes incoming log data, counting the logs and maintaining time-based sampling buckets.
102
+ // The logs are then forwarded to the next consumer in the pipeline.
77
103
func (d * Detector ) ConsumeLogs (ctx context.Context , ld plog.Logs ) error {
78
104
d .stateLock .Lock ()
79
105
defer d .stateLock .Unlock ()
0 commit comments