Graylog2 / Graylog2/graylog2-server

Notification Grace Period may be ignored in certain conditions

Open
#22,098 2 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Event notification grace period appears to be getting ignored under certain conditions.

I observed this and reproduced (see steps to reproduce).

Image

![Image](https://github.com/user-attachments/assets/da9a4daf-8928-49de-9c63-97a24d1dc6f4)

## Expected Behavior

Notification grace period is not ignored

## Current Behavior

Notification grace period is ignored.

## Possible Solution

## Steps to Reproduce (for bugs)

1. Configure message to send to a Graylog Forwarder
2. Create a valid notification that can send/execute
3. Create/configure an event with the following
* Image
* configure the notification created in the previous step, configure a grace period that you can test with
4. With the messages being sent to the forwarder, stop Graylog service (e.g. `systemctl stop graylog-server`)
5. wait an amount of time that is a multiple of the grace period, for example, if your grace period is 5m, wait 10m or 15m
6. re-start Graylog service
7. Observe that forwarder reconnects to graylog and all of its messages are dumped into `graylog-server`'s journal.
8. As messages are processed, the event criteria will be met, and several notifications will be sent all at the same exact time, ignoring the grace period

## Context

I originally encountered this as my graylog node was mistakenly offline for a couple of days and received a large amount of notifications all at once when [re]starting graylog.

## Your Environment

* Graylog Version: 6.1
* Java Version: bundleed
* OpenSearch Version: 2.15.0
* MongoDB Version: 7.0.17
* Operating System: Ubuntu Server 22.04 LTS
* Browser version: Google Chrome Version 134.0.6998.118 (Official Build) (arm64)

Please let me know if there are any questions.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.