Seq.App.EventTimeout 1.5.4

Seq.Apps.EventTimeout - Event Timeout for Seq

NOTE - Builds of Seq prior to the upcoming release of 2021.3 have a bug with the Nuget v2 API which does not handle apps with more than 100 Nuget releases. Event Timeout has had a lot of releases to refine its logic, so falls afoul of this. You can update to new versions using Seq's Manage page for the app and specifying the version, or update your Nuget feed to use the v3 API.

NOTE 2 - v1.5.1+ may have a breaking change. Addition of the "Include description with log message" setting may cause instances to stop with an error. To resolve, open each instance of Event Timeout and save (optionally tick Include description with log message). More information at https://mattmofdoom.com/note-updates-to-event-timeout-and-event-threshold-may-cause-instances-to-stop/

This app provides an event timeout function for Seq. It will read an input stream and monitor for matching text strings on configured properties, during a configured start and end time.

It includes a timeout and suppression interval, which allows you to fine tune the way the timeout works, such as waiting 10 seconds or 4 hours for an event to occur, and then not alerting again for 1 hour.

When a timeout occurs, it will output the configured text and description back to the stream, which can be used as the basis for a signal

This is a highly configurable and powerful Seq app. Consider some of the possible usages:

• Monitor a signal for @Message containing "started" between 1am and 3am, and alert if not seen within 30 minutes
• Monitor a signal for @Message containing ANY value and ServerName containing "MYSERVER" between 12am and 12am (24 hour period), and alert if not seen within 30 minutes
• Monitor a signal for ServerName containing "MYSERVER" and Status containing "Succeeded" between 2am and 3am, and alert if not seen within 10 minutes
• Monitor a signal for @Message containing "started" and ServerName containing "MYSERVER" and JobName containing "Backup" and Component containing "SQL" between 12am and 6am, and alert if not seen within 1 hour
• Monitor a signal for @Message containing ANY value between 12am and 1am on Monday-Friday, and alert if not seen within 20 minutes
• Monitor a signal for @Message containing ANY value between 1am and 2am on Monday-Friday excluding public holidays, and alert if not seen within 10 minutes
• Monitor a signal for @Message containing ANY value between 2am and 3am on the first day of the month and alert if not seen within 20 minutes
• Monitor a signal for @Message containing "stopped" between 3am and 4am on the fourth Friday of the month and alert if not seen within 5 minutes
• Monitor a signal for Status containing "failed" between 4am and 5am on the last weekday of the month and alert if not seen within 45 minutes
• Monitor a signal for @Message containing ANY value between 5am and 8am on the first day, first weekday, second monday, fifth friday, last weekday, and last day of the month, excluding public holidays, and alert if not seen within 30 minutes
• Monitor a signal for @Message containing "success" between 8am and 12pm on Monday-Friday, excluding the third monday and last weekday, excluding public holidays, and alert if not seen within 2 hours

There are many possible ways to configure Event Timeout!

Date/time is converted to UTC time internally, so that the start and end times are always handled correctly when considering local timezone and daylight savings.

Event Timeout includes the optional ability to retrieve public holidays using AbstractApi's Public Holidays API which can retrieve your local and national public holidays.

• You can configure Event Timeout to look for holiday types and locales, so that only (for example) National and Local holidays in Australia or New South Wales will be effective.
• Events with "Bank Holiday" in the name are excluded by default, but can be enabled
• Weekends are excluded by default, but can be enabled
• Retrieval of holidays occurs once per instance per day, at 12am (local time). If an event monitoring period ("Showtime") is in progress, it will only occur after an event monitoring period has ended. If one is scheduled, it will be delayed until holidays are retrieved.
• The Holidays API free tier limits requests to one per second, so a 10 second retry is configured for up to 10 attempts per instance
• This allows even the free Holidays API pricing tier to be used for most cases.
• Proxy configuration is included for Seq instances that do not have outbound internet access

A full feature list and some sample configurations is shown at https://github.com/MattMofDoom/Seq.App.EventTimeout#readme, and more information is available at my Blog of Doom!