Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ tags: [kafka, dms, golang]

While consuming messages from DMS, consumers can customize the duration for pulling messages. To pull messages for a long time, consumers only need to set the parameter of the poll(long) method to a proper value. However, such persistent connections may cause pressure on the client and the server, especially when the number of partitions is large and multiple threads are enabled for each consumer.

As shown in [Figure 1](#kafka-bp-190605001__fig6820724153018), the topic contains multiple partitions, and multiple consumers in the consumer group consume the resources at the same time. Each thread is in a persistent connection. When there are few or no messages in the topic, the connection persists, and all consumers pull messages continuously, which causes a waste of resources.
As shown in [Figure 1], the topic contains multiple partitions, and multiple consumers in the consumer group consume the resources at the same time. Each thread is in a persistent connection. When there are few or no messages in the topic, the connection persists, and all consumers pull messages continuously, which causes a waste of resources.

<center>
**Figure 1** Multi-thread consumption of Kafka consumers
Expand All @@ -17,7 +17,7 @@ As shown in [Figure 1](#kafka-bp-190605001__fig6820724153018), the topic contain

## Solution

When multiple threads are enabled for concurrent access, if there is no message in the topic, only one thread is required to poll for messages in each partition. When a message is found by the polling thread, other threads can be woken up to consume the message for quick responses, as shown in [Figure 2](#kafka-bp-190605001__fig2089525512304).
When multiple threads are enabled for concurrent access, if there is no message in the topic, only one thread is required to poll for messages in each partition. When a message is found by the polling thread, other threads can be woken up to consume the message for quick responses, as shown in [Figure 2].

This solution is applicable to scenarios with low requirements on real-time message consumption. If quasi-real-time message consumption is required, it is recommended that all consumers be in the active state.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ tags: [cts, cts-trigger, functiongraph, events, logs]

# Auditing and Analyzing Logins and Logouts with Functiongraph

Cloud Trace Service (CTS) collects real-time records of operations on cloud resources. You can create a CTS trigger to obtain records of subscribed cloud resource operations, analyze and process the operation records, and report alarms. You can use Simple Message Notification (SMN) to push alarm messages to service personnel by SMS message or email. [Figure 1](#figure-1) shows the procedure.
Cloud Trace Service (CTS) collects real-time records of operations on cloud resources. You can create a CTS trigger to obtain records of subscribed cloud resource operations, analyze and process the operation records, and report alarms. You can use Simple Message Notification (SMN) to push alarm messages to service personnel by SMS message or email. [Figure 1] shows the procedure.

## Solution Design

Expand Down Expand Up @@ -286,7 +286,7 @@ On the *Configuration* tab page of the function, set the environment variables a

**Table 1** Environment variable description

For details about how to set environment variables, see [Using Environment Variables](https://docs.otc.t-systems.com/function-graph/umn/configuring_functions/configuring_environment_variables.html), as shown in [Figure 2](#figure-2).
For details about how to set environment variables, see [Using Environment Variables](https://docs.otc.t-systems.com/function-graph/umn/configuring_functions/configuring_environment_variables.html), as shown in [Figure 2].

<a id="figure-2"></a>

Expand All @@ -308,7 +308,7 @@ CTS records the logins and logouts of users on IAM.

## Processing Operation Records

When a user performs login or logout using an account, the subscription service log will be triggered and a function will be directly invoked. The system then checks whether the IP address of the current login or logout account is in the whitelist based on function code. If the IP address is not in the whitelist, SMN will send notifications, as shown in [Figure 4](#figure-4).
When a user performs login or logout using an account, the subscription service log will be triggered and a function will be directly invoked. The system then checks whether the IP address of the current login or logout account is in the whitelist based on function code. If the IP address is not in the whitelist, SMN will send notifications, as shown in [Figure 4].

<a id="figure-4"></a>

Expand All @@ -318,7 +318,7 @@ When a user performs login or logout using an account, the subscription service

The email contains the unauthorized IP address and user operation (login or logout).

On the *Monitoring* tab page of the function, check the number of invocations, as shown in [Figure 5](#figure-5).
On the *Monitoring* tab page of the function, check the number of invocations, as shown in [Figure 5].

<a id="figure-"></a>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Create a ransomware prevention policy and configure honeypot file directories, e
![](/img/docs/best-practices/security-services/host-security-service/en-us_image_0000001955394073.png)


5. Configure the policy information by referring to [Table 1](#table1).
5. Configure the policy information by referring to [Table 1].

**Figure 2** Protection policy parameters
![](/img/docs/best-practices/security-services/host-security-service/en-us_image_0000002107288888.png)
Expand All @@ -41,7 +41,7 @@ Create a ransomware prevention policy and configure honeypot file directories, e
| OS | Server OS. | Linux |
| Policy | Policy name. | test |
| Action | How an event is handled.<br/>- **Report alarm and isolate**<br/>- **Report alarm** | **Report alarm and isolate** |
| Dynamic Honeypot Protection | After honeypot protection is enabled, the system deploys honeypot files in protected directories and other random locations (unless otherwise specified by users). The honeypot files deployed in random locations are automatically deleted every 12 hours and then randomly deployed again. A honeypot file occupies a few server resources. Therefore, configure the directories that you do not want to deploy the honeypot file in the excluded directories.<br/> (see also [Note](#note1)). | Enabled |
| Dynamic Honeypot Protection | After honeypot protection is enabled, the system deploys honeypot files in protected directories and other random locations (unless otherwise specified by users). The honeypot files deployed in random locations are automatically deleted every 12 hours and then randomly deployed again. A honeypot file occupies a few server resources. Therefore, configure the directories that you do not want to deploy the honeypot file in the excluded directories.<br/> (see also [Note]). | Enabled |
| Honeypot File Directories | Directory that needs to be protected by static honeypot (excluding subdirectories). You are advised to configure important service directories or data directories.<br/><br/>Separate multiple directories with semicolons (;). You can configure up to 20 directories.<br/><br/>This parameter is mandatory for Linux servers and optional for Windows servers. | Linux: **/etc**<br/><br/>Windows: **C:\Test** |
| Excluded Directory (Optional) | Directory that does not need to be protected by honeypot files.<br/><br/>Separate multiple directories with semicolons (;). You can configure up to 20 excluded directories. | Linux: **/etc/lesuo**<br/><br/>Windows: **C:\Test\ProData** |
| File Type | Types of files to be protected.<br/><br/>More than 70 file formats can be protected, including databases, containers, code, certificate keys, and backups.<br/><br/>This parameter is mandatory only for Linux servers. | Select all |
Expand All @@ -54,7 +54,7 @@ Create a ransomware prevention policy and configure honeypot file directories, e
Currently, Linux servers support dynamic generation and deployment of honeypot files. Windows servers support only static deployment of honeypot files.
:::

6. Confirm the policy information and click **OK**.
1. Confirm the policy information and click **OK**.

## Step 2: Enabling Ransomware Prevention

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ This solution describes how to use HSS and CBR to implement three-phase protecti

Enterprises or individuals can use HSS to detect ransomware and identify system risks. CBR can be used to back up service data and plan and control account permissions and organizational structures.

The following figure [HSS+CBR ransomware protection](#figure2) shows the protection principle.
The following figure [HSS+CBR ransomware protection] shows the protection principle.

<a id="figure2"></a>
**Figure 2** HSS+CBR ransomware protection
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ T Cloud Public provides diverse [migration solutions](#migration-solutions) to h

## Migration Solutions

[Table 1](#table1) describes the migration solutions provided by T Cloud Public.
[Table 1] describes the migration solutions provided by T Cloud Public.

<a id="table1">Table 1 Migration solutions</a>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ This enables your runners to scale up rapidly in response to workflow demand and
- Go to your GitHub organization's **Settings**.
- Select **Webhooks** from the sidebar.
- Click **Add webhook**.
- **Payload URL:** Enter the endpoint that will receive webhook events (which you provided [earlier](#install-actions-runner-controller), e.g., `https://github-webhook.example.com`).
- **Payload URL:** Enter the endpoint that will receive webhook events (which you provided [earlier](#installing-actions-runner-controller), e.g., `https://github-webhook.example.com`).
- **Content type:** Choose `application/json`.
- **Secret:** Set a strong secret token (you'll use this in your Kubernetes secret).
- **Events to send:** Select **Let me select individual events** and check:
Expand All @@ -303,7 +303,7 @@ kubectl create secret generic github-webhook-token \
--from-literal=GITHUB_WEBHOOK_SECRET_TOKEN=WEBHOOK_SECRET
```

Replace `WEBHOOK_SECRET` with the exact secret set in the [previous step](#1-register-webhook-in-github).
Replace `WEBHOOK_SECRET` with the exact secret set in the [previous step](#registering-webhook-in-github).

### Configuring a HorizontalRunnerAutoscaler

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ customization:

:::note

1️⃣ **Single Elastic Load Balancer**: This evaluation setup uses a single Elastic Load Balancer to handle all openDesk traffic, including HTTP and HTTPS via Ingress, UDP for Jitsi, and TCP for mail services. Ensure that you specify the `<ELB_ID>` of the same load balancer whose IP address (`<ELB_IP_ADDRESS>`) was configured during the [Configure DNS](#configure-dns) step.
1️⃣ **Single Elastic Load Balancer**: This evaluation setup uses a single Elastic Load Balancer to handle all openDesk traffic, including HTTP and HTTPS via Ingress, UDP for Jitsi, and TCP for mail services. Ensure that you specify the `<ELB_ID>` of the same load balancer whose IP address (`<ELB_IP_ADDRESS>`) was configured during the [Configure DNS](#configuring-dns-records) step.

2️⃣ **Why we need to set** `cluster.networking.cidr`: By default, some openDesk components assume a standard `10.0.0.0/8` pod network. If this setting mismatches your actual cluster CIDR, internal network policies or Postfix trusted networks may fail, causing connectivity issues.

Expand Down
Loading
Loading