62 lines
2.2 KiB
Markdown
62 lines
2.2 KiB
Markdown
|
# 查询主动丢弃的非告警数据
|
||
|
|
|
||
|
|
积压采样只丢弃部分普通日志和非标消息，告警全部保留。审计数据保存在达梦表
|
||
|
|
`syslog_backlog_retention_hourly`。
|
||
|
|
|
||
|
|
## 查看当前运行累计值
|
||
|
|
|
||
|
|
```bash
|
||
|
|
docker exec syslog-consumer-rule-dm sh -c \
|
||
|
|
'curl -fsS http://127.0.0.1:8289/xdrrule/api/syslog/backlog-sampling/status'
|
||
|
|
```
|
||
|
|
|
||
|
|
主要字段：
|
||
|
|
|
||
|
|
- `normal_rows_dropped_total`：本次应用启动后主动丢弃的普通日志行数；
|
||
|
|
- `non_normal_rows_dropped_total`：本次应用启动后主动丢弃的非标消息行数；
|
||
|
|
- `raw_dropped_total`：本次应用启动后没有写入 InfluxDB 的原文条数。
|
||
|
|
|
||
|
|
## 查询指定一天的丢弃总数
|
||
|
|
|
||
|
|
以下查询统计上海时间 `2026-09-13` 一整天：
|
||
|
|
|
||
|
|
```sql
|
||
|
|
SELECT
|
||
|
|
NVL(SUM(normal_rows_dropped), 0) AS normal_dropped,
|
||
|
|
NVL(SUM(non_normal_rows_dropped), 0) AS non_normal_dropped,
|
||
|
|
NVL(SUM(normal_rows_dropped), 0)
|
||
|
|
+ NVL(SUM(non_normal_rows_dropped), 0) AS non_alarm_rows_dropped,
|
||
|
|
NVL(SUM(raw_dropped), 0) AS raw_dropped,
|
||
|
|
NVL(SUM(alarm_rows_total), 0) AS alarm_total,
|
||
|
|
NVL(SUM(alarm_rows_saved), 0) AS alarm_saved
|
||
|
|
FROM syslog_backlog_retention_hourly
|
||
|
|
WHERE source_hour >= TIMESTAMP '2026-09-13 00:00:00'
|
||
|
|
AND source_hour < TIMESTAMP '2026-09-14 00:00:00';
|
||
|
|
```
|
||
|
|
|
||
|
|
## 按小时统计
|
||
|
|
|
||
|
|
```sql
|
||
|
|
SELECT
|
||
|
|
source_hour,
|
||
|
|
SUM(normal_rows_dropped) AS normal_dropped,
|
||
|
|
SUM(non_normal_rows_dropped) AS non_normal_dropped,
|
||
|
|
SUM(normal_rows_dropped) + SUM(non_normal_rows_dropped)
|
||
|
|
AS non_alarm_rows_dropped,
|
||
|
|
SUM(raw_dropped) AS raw_dropped,
|
||
|
|
SUM(alarm_rows_total) AS alarm_total,
|
||
|
|
SUM(alarm_rows_saved) AS alarm_saved,
|
||
|
|
MAX(max_lag_ms) AS max_lag_ms
|
||
|
|
FROM syslog_backlog_retention_hourly
|
||
|
|
WHERE source_hour >= TIMESTAMP '2026-09-13 00:00:00'
|
||
|
|
AND source_hour < TIMESTAMP '2026-09-14 00:00:00'
|
||
|
|
GROUP BY source_hour
|
||
|
|
ORDER BY source_hour;
|
||
|
|
```
|
||
|
|
|
||
|
|
`non_alarm_rows_dropped` 是普通和非标两类达梦业务行的合计。`raw_dropped` 是原始消息口径，
|
||
|
|
可能与这两类记录重叠，因此不要再把 `raw_dropped` 加到 `non_alarm_rows_dropped` 中。
|
||
|
|
|
||
|
|
正常情况下 `alarm_total` 应等于 `alarm_saved`。查询结果为零或没有小时记录，表示该时间段没有触发
|
||
|
|
积压采样，或者采样审计尚未成功写入。
|