#!/bin/bash

### Event Metrics

### ECS-EC-INGRES (Collection) - Incoming raw event rate per 60s, Peak in the last 60s, Total EC Throttles in the last 60s
log_line=$(grep "Incoming raw event rate" /var/log/qradar.log |grep "ecs-ec-ingress.ecs-ec-ingress" |awk '{print $5,$29,$42,$59}' |tail -1 |tr "[|]" " ")
engine=$(echo $log_line |awk -F. '{print $1}')
rate60=$(echo $log_line |awk '{print $2}')
peak60=$(echo $log_line |awk '{print $3}')
throttle60=$(echo $log_line |awk '{print $4}' |tr "." " ")
echo "qradar_eps,engine=$engine rate=$rate60,peak=$peak60,throttle=$throttle60 $(date +%s%N)"

### ECS-EC (parsing, and normalization of event data) - Incoming raw event rate per 60s, Peak in the last 60s, Total EC Throttles in the last 60s
log_line=$(grep "Incoming raw event rate" /var/log/qradar.log |grep "ecs-ec.ecs-ec" |awk '{print $5,$29,$42,$59}' |tail -1 |tr "[|]" " ")
engine=$(echo $log_line |awk -F. '{print $1}')
rate60=$(echo $log_line |awk '{print $2}')
peak60=$(echo $log_line |awk '{print $3}')
throttle60=$(echo $log_line |awk '{print $4}' |tr "." " ")
echo "qradar_eps,engine=$engine rate=$rate60,peak=$peak60,throttle=$throttle60 $(date +%s%N)"

### ECS-EC - SensorDevices per 60s, Events Dropped per 60s, Events Log Only per 60s
log_line=$(grep "giveback Event" /var/log/qradar.log |awk '{print $5,$18,$23,$29}' |tail -1 |tr "[|]" " ")
engine=$(echo $log_line |awk -F. '{print $1}')
sensor60=$(echo $log_line |awk '{print $2}')
drops60=$(echo $log_line |awk '{print $3}')
log_only60=$(echo $log_line |awk '{print $4}')
echo "qradar_eps,engine=$engine sensor=$sensor60,drops=$drops60,log_only=$log_only60 $(date +%s%N)"

### ECS-EP (Rules, routing, event storage) - Incoming Event Rate per 60s
log_line=$(grep "EPMonitor" /var/log/qradar.log |awk '{print $5,$16,$26}' |tail -1 |tr "[|]" " ")
engine=$(echo $log_line |awk -F. '{print $1}')
rate60=$(echo $log_line |awk '{print $2}')
echo "qradar_eps,engine=$engine rate=$rate60 $(date +%s%N)"


### Flow Metrics

### ECS-EC (parsing, and normalization of event data) - Incoming raw flow rate per 60s, Peak in the last 60s
log_line=$(cat /var/log/qradar.log |grep "Incoming flow rate" |awk '{print $5,$28,$41'} |tail -1 |sed s/[\(\)]//g |tr "[|]" " ")
engine=$(echo $log_line |awk -F'[: .]' '{print $1}')
rate60=$(echo $log_line |awk -F'[: ]' '{print $2}')
peak60=$(echo $log_line |awk -F'[: ]' '{print $4}')
echo "qradar_fps,engine=$engine rate=$rate60,peak=$peak60 $(date +%s%N)"

### ECS-EC - SensorDevices per 60s, Events Dropped per 60s, Events Log Only per 60s
log_line=$(cat /var/log/qradar.log |grep "giveback Flow" |awk '{print $5,$18,$23,$27}' |tail -1 |sed s/[\(\)]//g |tr "[|]" " ")
engine=$(echo $log_line |awk -F. '{print $1}')
sensor60=$(echo $log_line |awk '{print $2}')
drops60=$(echo $log_line |awk '{print $3}')
echo "qradar_fps,engine=$engine sensor=$sensor60,drops=$drops60 $(date +%s%N)"