Reconnoiter Notes

gistfile1.txt

https://labs.omniti.com/labs/reconnoiter/lists/users/2010-July/000467.html on display maths.

https://labs.omniti.com/labs/reconnoiter/lists/users/2010-October/000543.html on getting esper going.
https://labs.omniti.com/labs/reconnoiter/lists/users/2010-December/000583.html and thread

http://blog.brosting.net/?p=10 general stuff
http://www.control-alt-del.org/2011/10/31/monitoring-with-reconnoiter-part-deux/

http://www.ducea.com/2010/07/13/howto-install-reconnoiter-on-debian-lenny/

messages that will hit the firehose:

* NOIT CONFIG

 *  'n' TIMESTAMP strlen(xmlconfig) base64(gzip(xmlconfig))

 *

 * CHECK:

 *  'C' TIMESTAMP UUID TARGET MODULE NAME

 * Java class: NoitCheck

 * STATUS:

 *  'S' TARGET TIMESTAMP UUID STATE AVAILABILITY DURATION STATUS_MESSAGE
"S\t10.234.10.10\t1302531662.763\t10.224.78.8`ping_icmp`ping_icmp_surechem-build-i-2558a653_dsci_it`91d453c0-4111-012e-9138-12313b0049f6\tB\tA\t5000\tcnt=5,avail=60,min=0.0005,max=0.0009,avg=0.0007\n"
 * Java class: NoitStatus

 * METRICS:

 *  'M' TIMESTAMP UUID NAME TYPE VALUE

* Java class: NoitMetric, NoitMetricNumeric, NoitMetricText

* STRATCON QUERY

* 'Q' REMOTE ID NAME QUERY 

* STRATCON NEW STATEMENT

*  'D' REMOTE ID QUERY 

* STRATCON DEL STATEMENT

*  'q' REMOTE ID 

How IEP hangs together (i think)
two types: 

statements
 - operations on the event stream, generate internal IEP data
 - arguments:
  - provides - a symbolic name for the statement
  - requires - this statement requires a previous statement; refers to the "provides"

queries 
 - simple operations on either:
   - the plain java objects corresponding to above types on the wire.
   - the results of statements
 - take a topic argument, which is the topic on the MQ that stuff ends up in.

querying a Noit metric:
each value from each check creates a new NoitMetricFoo object - either NoitMetricNumeric or NoitMetricText
can query an object using any of the getters on that object
eg
NoitMetricNumeric(uuid='870b0c50-7749-012f-ae46-12313b0e650f',name='df`df`srv`0')
uuid is the uuid of the check, name is the name of the metric in that check. So each value creates a new object
to do joins you must have a window:
from 
                NoitMetricNumeric(uuid='870b0c50-7749-012f-ae46-12313b0e650f',name='df`df`srv`1').win:length(1) f ,
                NoitMetricNumeric(uuid='870b0c50-7749-012f-ae46-12313b0e650f',name='df`df`srv`0').win:length(1) u