# 钉钉Webhook服务
from flask import Flask, request, jsonify
import json
import requests
import logging
from datetime import datetime

app = Flask(__name__)
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class DingTalkNotifier:
    def __init__(self, webhook_url, secret=None):
        self.webhook_url = webhook_url
        self.secret = secret
    
    def send_alert(self, alert_data):
        """发送告警到钉钉"""
        try:
            # 构建消息内容
            message = self.build_message(alert_data)
            
            # 发送消息
            response = requests.post(
                self.webhook_url,
                json=message,
                headers={'Content-Type': 'application/json'},
                timeout=10
            )
            
            if response.status_code == 200:
                result = response.json()
                if result.get('errcode') == 0:
                    logger.info("钉钉消息发送成功")
                    return True
                else:
                    logger.error(f"钉钉消息发送失败: {result.get('errmsg')}")
                    return False
            else:
                logger.error(f"钉钉消息发送失败: HTTP {response.status_code}")
                return False
                
        except Exception as e:
            logger.error(f"发送钉钉消息异常: {str(e)}")
            return False
    
    def build_message(self, alert_data):
        """构建钉钉消息"""
        alerts = alert_data.get('alerts', [])
        
        if not alerts:
            return None
        
        # 获取告警信息
        alert = alerts[0]
        status = alert.get('status', 'unknown')
        labels = alert.get('labels', {})
        annotations = alert.get('annotations', {})
        
        # 构建消息内容
        if status == 'firing':
            title = f"🚨 告警通知 - {labels.get('alertname', 'Unknown')}"
            color = "#FF0000"
        else:
            title = f"✅ 告警恢复 - {labels.get('alertname', 'Unknown')}"
            color = "#00FF00"
        
        # 构建消息文本
        message_text = f"""
**{title}**

**告警级别**: {labels.get('severity', 'unknown')}
**服务**: {labels.get('service', 'unknown')}
**实例**: {labels.get('instance', 'unknown')}
**时间**: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

**描述**: {annotations.get('description', 'No description')}
**摘要**: {annotations.get('summary', 'No summary')}
"""
        
        # 构建钉钉消息
        message = {
            "msgtype": "markdown",
            "markdown": {
                "title": title,
                "text": message_text
            },
            "at": {
                "atMobiles": self.get_at_mobiles(labels),
                "isAtAll": False
            }
        }
        
        return message
    
    def get_at_mobiles(self, labels):
        """获取需要@的手机号"""
        # 根据告警级别和服务获取需要@的手机号
        severity = labels.get('severity', '')
        service = labels.get('service', '')
        
        at_mobiles = []
        
        if severity == 'critical':
            # 严重告警@值班人员
            at_mobiles.extend(['13800138000', '13800138001'])
        
        if service == 'mysql':
            # MySQL告警@DBA团队
            at_mobiles.extend(['13800138002', '13800138003'])
        
        return at_mobiles

# 全局钉钉通知器
dingtalk_notifier = DingTalkNotifier(
    webhook_url="https://oapi.dingtalk.com/robot/send?access_token=your_token",
    secret="your_secret"
)

@app.route('/dingtalk', methods=['POST'])
def dingtalk_webhook():
    """钉钉Webhook接口"""
    try:
        # 获取告警数据
        alert_data = request.get_json()
        
        if not alert_data:
            return jsonify({'error': 'No alert data'}), 400
        
        # 发送钉钉通知
        success = dingtalk_notifier.send_alert(alert_data)
        
        if success:
            return jsonify({'status': 'success'}), 200
        else:
            return jsonify({'status': 'failed'}), 500
            
    except Exception as e:
        logger.error(f"处理钉钉Webhook异常: {str(e)}")
        return jsonify({'error': str(e)}), 500

@app.route('/health', methods=['GET'])
def health_check():
    """健康检查接口"""
    return jsonify({'status': 'healthy'}), 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080, debug=False)

# 告警流程管理器
import time
import logging
from datetime import datetime, timedelta
from typing import Dict, List, Optional

class AlertFlowManager:
    def __init__(self):
        self.logger = logging.getLogger(__name__)
        self.alert_history = {}
        self.alert_groups = {}
        self.inhibition_rules = []
    
    def process_alert(self, alert_data: Dict) -> bool:
        """处理告警"""
        try:
            alerts = alert_data.get('alerts', [])
            
            for alert in alerts:
                # 检查告警抑制
                if self.check_inhibition(alert):
                    self.logger.info(f"告警被抑制: {alert.get('labels', {}).get('alertname')}")
                    continue
                
                # 告警分组
                group_key = self.get_group_key(alert)
                if group_key not in self.alert_groups:
                    self.alert_groups[group_key] = []
                
                self.alert_groups[group_key].append(alert)
                
                # 记录告警历史
                self.record_alert_history(alert)
                
                # 发送通知
                self.send_notification(alert)
            
            return True
            
        except Exception as e:
            self.logger.error(f"处理告警异常: {str(e)}")
            return False
    
    def check_inhibition(self, alert: Dict) -> bool:
        """检查告警抑制"""
        try:
            labels = alert.get('labels', {})
            
            for rule in self.inhibition_rules:
                if self.match_inhibition_rule(alert, rule):
                    return True
            
            return False
            
        except Exception as e:
            self.logger.error(f"检查告警抑制异常: {str(e)}")
            return False
    
    def match_inhibition_rule(self, alert: Dict, rule: Dict) -> bool:
        """匹配抑制规则"""
        try:
            labels = alert.get('labels', {})
            
            # 检查源匹配
            source_match = rule.get('source_match', {})
            if source_match:
                for key, value in source_match.items():
                    if labels.get(key) != value:
                        return False
            
            # 检查目标匹配
            target_match = rule.get('target_match', {})
            if target_match:
                for key, value in target_match.items():
                    if labels.get(key) != value:
                        return False
            
            # 检查相等标签
            equal_labels = rule.get('equal', [])
            if equal_labels:
                for label in equal_labels:
                    if labels.get(label) is None:
                        return False
            
            return True
            
        except Exception as e:
            self.logger.error(f"匹配抑制规则异常: {str(e)}")
            return False
    
    def get_group_key(self, alert: Dict) -> str:
        """获取告警分组键"""
        try:
            labels = alert.get('labels', {})
            
            # 按告警名称、集群、服务分组
            group_parts = [
                labels.get('alertname', 'unknown'),
                labels.get('cluster', 'unknown'),
                labels.get('service', 'unknown')
            ]
            
            return '|'.join(group_parts)
            
        except Exception as e:
            self.logger.error(f"获取告警分组键异常: {str(e)}")
            return 'unknown'
    
    def record_alert_history(self, alert: Dict):
        """记录告警历史"""
        try:
            labels = alert.get('labels', {})
            alertname = labels.get('alertname', 'unknown')
            instance = labels.get('instance', 'unknown')
            
            key = f"{alertname}:{instance}"
            
            if key not in self.alert_history:
                self.alert_history[key] = []
            
            self.alert_history[key].append({
                'timestamp': datetime.now(),
                'status': alert.get('status', 'unknown'),
                'labels': labels,
                'annotations': alert.get('annotations', {})
            })
            
            # 清理旧历史记录
            self.cleanup_alert_history(key)
            
        except Exception as e:
            self.logger.error(f"记录告警历史异常: {str(e)}")
    
    def cleanup_alert_history(self, key: str):
        """清理告警历史"""
        try:
            if key in self.alert_history:
                # 保留最近24小时的记录
                cutoff_time = datetime.now() - timedelta(hours=24)
                self.alert_history[key] = [
                    record for record in self.alert_history[key]
                    if record['timestamp'] > cutoff_time
                ]
                
        except Exception as e:
            self.logger.error(f"清理告警历史异常: {str(e)}")
    
    def send_notification(self, alert: Dict):
        """发送通知"""
        try:
            labels = alert.get('labels', {})
            severity = labels.get('severity', 'unknown')
            service = labels.get('service', 'unknown')
            
            # 根据告警级别和服务选择通知方式
            if severity == 'critical':
                self.send_critical_notification(alert)
            elif severity == 'warning':
                self.send_warning_notification(alert)
            else:
                self.send_info_notification(alert)
            
        except Exception as e:
            self.logger.error(f"发送通知异常: {str(e)}")
    
    def send_critical_notification(self, alert: Dict):
        """发送严重告警通知"""
        try:
            # 立即发送邮件
            self.send_email_notification(alert)
            
            # 发送钉钉通知
            self.send_dingtalk_notification(alert)
            
            # 发送短信通知
            self.send_sms_notification(alert)
            
            self.logger.info("严重告警通知已发送")
            
        except Exception as e:
            self.logger.error(f"发送严重告警通知异常: {str(e)}")
    
    def send_warning_notification(self, alert: Dict):
        """发送警告告警通知"""
        try:
            # 发送邮件通知
            self.send_email_notification(alert)
            
            # 发送钉钉通知
            self.send_dingtalk_notification(alert)
            
            self.logger.info("警告告警通知已发送")
            
        except Exception as e:
            self.logger.error(f"发送警告告警通知异常: {str(e)}")
    
    def send_info_notification(self, alert: Dict):
        """发送信息告警通知"""
        try:
            # 仅发送邮件通知
            self.send_email_notification(alert)
            
            self.logger.info("信息告警通知已发送")
            
        except Exception as e:
            self.logger.error(f"发送信息告警通知异常: {str(e)}")
    
    def send_email_notification(self, alert: Dict):
        """发送邮件通知"""
        # 邮件通知实现
        pass
    
    def send_dingtalk_notification(self, alert: Dict):
        """发送钉钉通知"""
        # 钉钉通知实现
        pass
    
    def send_sms_notification(self, alert: Dict):
        """发送短信通知"""
        # 短信通知实现
        pass

# 使用示例
if __name__ == "__main__":
    flow_manager = AlertFlowManager()
    
    # 示例告警数据
    alert_data = {
        "alerts": [
            {
                "status": "firing",
                "labels": {
                    "alertname": "HighCPUUsage",
                    "severity": "warning",
                    "instance": "server1",
                    "service": "system"
                },
                "annotations": {
                    "summary": "CPU使用率过高",
                    "description": "服务器CPU使用率超过80%"
                }
            }
        ]
    }
    
    flow_manager.process_alert(alert_data)

# 智能告警规则引擎
import time
import logging
from datetime import datetime, timedelta
from typing import Dict, List, Optional
import numpy as np
from sklearn.ensemble import IsolationForest

class IntelligentAlertEngine:
    def __init__(self):
        self.logger = logging.getLogger(__name__)
        self.metric_history = {}
        self.anomaly_detector = IsolationForest(contamination=0.1)
        self.baseline_metrics = {}
        self.alert_thresholds = {}
    
    def analyze_metric_anomaly(self, metric_name: str, value: float, labels: Dict) -> bool:
        """分析指标异常"""
        try:
            # 获取指标历史数据
            history_key = f"{metric_name}:{labels.get('instance', 'unknown')}"
            
            if history_key not in self.metric_history:
                self.metric_history[history_key] = []
            
            # 添加当前值
            self.metric_history[history_key].append({
                'timestamp': datetime.now(),
                'value': value,
                'labels': labels
            })
            
            # 保持最近1000个数据点
            if len(self.metric_history[history_key]) > 1000:
                self.metric_history[history_key] = self.metric_history[history_key][-1000:]
            
            # 检查是否有足够的历史数据
            if len(self.metric_history[history_key]) < 50:
                return False
            
            # 提取特征
            features = self.extract_features(history_key)
            
            # 异常检测
            is_anomaly = self.detect_anomaly(features, value)
            
            return is_anomaly
            
        except Exception as e:
            self.logger.error(f"分析指标异常异常: {str(e)}")
            return False
    
    def extract_features(self, history_key: str) -> List[float]:
        """提取特征"""
        try:
            history = self.metric_history[history_key]
            values = [record['value'] for record in history]
            
            # 计算统计特征
            features = [
                np.mean(values),      # 均值
                np.std(values),      # 标准差
                np.median(values),   # 中位数
                np.percentile(values, 25),  # 25分位数
                np.percentile(values, 75),  # 75分位数
                np.max(values),      # 最大值
                np.min(values),      # 最小值
            ]
            
            # 计算趋势特征
            if len(values) >= 10:
                # 计算斜率
                x = np.arange(len(values[-10:]))
                y = np.array(values[-10:])
                slope = np.polyfit(x, y, 1)[0]
                features.append(slope)
                
                # 计算变化率
                change_rate = (values[-1] - values[-10]) / values[-10] if values[-10] != 0 else 0
                features.append(change_rate)
            else:
                features.extend([0, 0])
            
            return features
            
        except Exception as e:
            self.logger.error(f"提取特征异常: {str(e)}")
            return []
    
    def detect_anomaly(self, features: List[float], current_value: float) -> bool:
        """检测异常"""
        try:
            if len(features) < 9:
                return False
            
            # 添加当前值作为特征
            features.append(current_value)
            
            # 重塑特征数组
            features_array = np.array(features).reshape(1, -1)
            
            # 异常检测
            anomaly_score = self.anomaly_detector.decision_function(features_array)[0]
            is_anomaly = self.anomaly_detector.predict(features_array)[0] == -1
            
            # 记录异常分数
            self.logger.info(f"异常检测分数: {anomaly_score}, 是否异常: {is_anomaly}")
            
            return is_anomaly
            
        except Exception as e:
            self.logger.error(f"检测异常异常: {str(e)}")
            return False
    
    def calculate_dynamic_threshold(self, metric_name: str, labels: Dict) -> float:
        """计算动态阈值"""
        try:
            history_key = f"{metric_name}:{labels.get('instance', 'unknown')}"
            
            if history_key not in self.metric_history:
                return 0.8  # 默认阈值
            
            history = self.metric_history[history_key]
            values = [record['value'] for record in history]
            
            if len(values) < 10:
                return 0.8  # 默认阈值
            
            # 计算动态阈值
            mean_value = np.mean(values)
            std_value = np.std(values)
            
            # 基于3-sigma规则计算阈值
            threshold = mean_value + 3 * std_value
            
            # 限制阈值范围
            threshold = max(0.1, min(0.99, threshold))
            
            return threshold
            
        except Exception as e:
            self.logger.error(f"计算动态阈值异常: {str(e)}")
            return 0.8
    
    def generate_intelligent_alert(self, metric_name: str, value: float, labels: Dict) -> Optional[Dict]:
        """生成智能告警"""
        try:
            # 分析异常
            is_anomaly = self.analyze_metric_anomaly(metric_name, value, labels)
            
            if not is_anomaly:
                return None
            
            # 计算动态阈值
            threshold = self.calculate_dynamic_threshold(metric_name, labels)
            
            # 确定告警级别
            severity = self.determine_severity(value, threshold)
            
            # 生成告警
            alert = {
                'alertname': f'Intelligent{metric_name}Alert',
                'severity': severity,
                'labels': labels,
                'annotations': {
                    'summary': f'智能检测到{metric_name}异常',
                    'description': f'指标{metric_name}值{value}超过动态阈值{threshold}',
                    'intelligent_detection': 'true',
                    'threshold': str(threshold),
                    'anomaly_score': str(self.anomaly_detector.decision_function([[value]])[0])
                }
            }
            
            return alert
            
        except Exception as e:
            self.logger.error(f"生成智能告警异常: {str(e)}")
            return None
    
    def determine_severity(self, value: float, threshold: float) -> str:
        """确定告警级别"""
        try:
            if value > threshold * 1.5:
                return 'critical'
            elif value > threshold * 1.2:
                return 'warning'
            else:
                return 'info'
                
        except Exception as e:
            self.logger.error(f"确定告警级别异常: {str(e)}")
            return 'warning'

# 使用示例
if __name__ == "__main__":
    engine = IntelligentAlertEngine()
    
    # 示例指标数据
    metric_name = "cpu_usage"
    value = 0.85
    labels = {
        "instance": "server1",
        "service": "system"
    }
    
    alert = engine.generate_intelligent_alert(metric_name, value, labels)
    if alert:
        print(f"生成智能告警: {alert}")