Skip to main content

Workflows

A workflow is a set of triggers and actions that will occur if any of those triggers are met. The mapping configurations will map rWeb Zones to workflows in order to check network trigger conditions. When a workflow is triggered, it will attempt to start all specified actions, stopping them when the trigger condition is no longer met or according to more advanced conditions.

Workflows​

# Workflows must have a unique identifier for a [[mapping]] to refer to.
# This workflow is "A-Workflow"
[workflows.A-Workflow]

# When this workflow is triggered, -all- of the following
# actions will be evaluated.
actions = [
    "BgpExample",
    "BgpFlowspecExample"
]

# If set, all actions triggered by this workflow will be in no-operation mode.
# Actions will be logged and recorded but not actually executed.
# Optional, default false
no-op = true

# Triggers must be met continuously for this entire duration of time
# before any action will be taken.
# Optional, default false
min-trigger-time = "1 minute"

# Actions are guaranteed to run for at least this amount of time.
# Can help prevent flapping.
# Optional, default false
min-action-time = "1 minute"

# Triggers must be unmet continuously for this entire duration of time
# before any previous action will be withdrawn/stopped.
# Can also prevent flapping.
# Optional, default false
min-untriggered-time = "1 minute"

Workflow Keys​

At a minimum, each workflow section should have a unique identifier, and zero or more actions that it should start (as shown above.md). There are also a number of optional flags that can be set to change workflow behavior:

  • no-op: A boolean flag that defaults to false, but when set forces all actions triggered by the workflow into no-operation mode. All of the action starts and stops as a result of this workflow will only log when an action would be started or stopped, but it won't actually perform the action.
  • min-trigger-time: An optional duration value that represents how long a trigger must be (continuously) exceeded before the related actions are started. This can help prevent starting potentially expensive network redirect events for transient blips in traffic levels.
  • min-action-time: An optional duration value that indicates the minimum amount of time an action should be in effect before stopping it. If not set, the related actions will be stopped as soon as the associated workflow triggers fall below their threshold. Similar to min-trigger-time, you may not want to withdraw a traffic announcement just to make it again immediately based on transient network conditions.
  • min-untriggered-time: An optional duration value that imposes a condition on stopping an action. This value sets the minimum amount of time the workflow must be untriggered (uncontinuously) before the action is stopped.

In other words, no-op can be used to test what actions would be started based on your mappings and triggers (without actually doing those actions), min-trigger-time can be used to affect when an action would start, and min-action-time and min-untriggered-time can be used to affect when an action would stop.

info

If both min-action-time and min-untriggered-time are set, both conditions must be satisfied before the associated actions will be stopped. That is, the action must have been active for at least the duration set by min-action-time and the associated triggers for the workflow must have been below threshold (continuously) for the duration set by min-untriggered-time.

Triggers​

# If -any- of these triggers are met, then the workflow actions will be started.
[[workflows.A-Workflow.trigger]]
# Trigger type. See full list below.
type = "host-bits-per-second"
# Triggers when this rate is exceeded.
# Any bit rate trigger must be at least 1 mbps.
limit = "200 M"

[[workflows.A-Workflow.trigger]]
# A second example trigger, for a host seeing >10kpps TCP SYN
type = "host-tcp-syn-packets-per-second"
limit = "10 k"

Trigger Keys​

Zero or more workflow triggers can be set, each with a given type and a limit (using a unit value). These triggers are tested against the Zones specified in the mapping associated with this workflow.

Each trigger tests against either individual hosts, or traffic conditions in the associated Zones in general. It is also possible to set an always-on trigger type, that always considers the given workflow as triggered, ignoring any of the optional "min-xxxx-time" conditions that may be set.

The full set of types is listed below, and the applicable limit values use the unit as stated in the rate trigger's name:

Always On​

The key always-on always triggers the workflow, ignoring min-trigger-time, min-action-time, and min-untriggered-time. If using this trigger, does not require you to set a limit value.

Per host triggers​

These trigger based on individual hosts within the Zone(s) associated with this workflow.

  • host-packets-per-second
  • host-fragmented-packets-per-second
  • host-icmp-packets-per-second
  • host-tcp-packets-per-second
  • host-tcp-syn-packets-per-second
  • host-udp-packets-per-second
  • host-bits-per-second
  • host-fragmented-bits-per-second
  • host-icmp-bits-per-second
  • host-tcp-bits-per-second
  • host-tcp-syn-bits-per-second
  • host-udp-bits-per-second

Per zone triggers​

These trigger based on the total traffic within the Zone(s) associated with this workflow.

  • zone-packets-per-second
  • zone-fragmented-packets-per-second
  • zone-icmp-packets-per-second
  • zone-tcp-packets-per-second
  • zone-tcp-syn-packets-per-second
  • zone-udp-packets-per-second
  • zone-bits-per-second
  • zone-fragmented-bits-per-second
  • zone-icmp-bits-per-second
  • zone-tcp-bits-per-second
  • zone-tcp-syn-bits-per-second
  • zone-udp-bits-per-second