Sensu-go: Copy of entity contained in Event does not have valid LastSeen field

[jamesdphillips]

Expected Behavior

A call to myEvent.Entity.LastSeen returns a valid unix timestamp.

Current Behavior

A call to myEvent.Entity.LastSeen returns 0.

Possible Solution

One solution might be to:

1. Pass the entity's LastSeen value along to the agent in the CheckRequest.
2. Have the agent copy over the given LastSeen value when the event is produced.

Steps to Reproduce (for bugs)

1. Produce event.
2. etcdctl get "/sensu.io/events/default/default/oh-deer/check-buck"
3. Observe last_seen value to be 0.

Context

An attempt was made to display the value in the Web UI.

Your Environment

Irrelevant.

[echlebek]

Is this actually a bug? What should the value be if the event has never been seen? I think 0 would be a reasonable value in that case.

[mercul3s]

The entity, if it exists, should always have a last_seen timestamp. The behavior here should be similar to keepalive events, which do have a last_seen timestamp. I'm not sure what proxy entities should have for last_seen, I think there a zero value may make sense. Here's what event entities look like for keepalive, check, and proxy check events:

# Keepalive event entity
{
  "timestamp": 1525287323,
  "entity": {
    "class": "agent",
    "deregister": false,
    "deregistration": {},
    "environment": "default",
    "id": "defiant.i.pdx.axcella.net",
    "keepalive_timeout": 120,
    "last_seen": 1525287323,
    "organization": "default",
    "redact": [
      "password",
      "passwd",
      "pass",
      "api_key",
      "api_token",
      "access_key",
      "secret_key",
      "private_key",
      "secret"
    ],
    "subscriptions": [
      "test",
      "entity:defiant.i.pdx.axcella.net"
    ],
    "system": {
      "hostname": "defiant.i.pdx.axcella.net",
      "os": "darwin",
      "platform": "darwin",
      "platform_version": "10.13.4",
      "network": {
        "interfaces": [
          {
            "name": "en10",
            "mac": "9c:eb:e8:56:18:8c",
            "addresses": [
              "fe80::872:3c65:d5b2:cb5/64",
              "10.0.80.155/24"
            ]
          }
        ]
      },
      "arch": "amd64"
    },
    "user": "agent"
  }

# Check event entity
{
  "timestamp": 1525287302,
  "entity": {
    "class": "agent",
    "deregister": false,
    "deregistration": {},
    "environment": "default",
    "id": "defiant.i.pdx.axcella.net",
    "keepalive_timeout": 120,
    "organization": "default",
    "redact": [
      "password",
      "passwd",
      "pass",
      "api_key",
      "api_token",
      "access_key",
      "secret_key",
      "private_key",
      "secret"
    ],
    "subscriptions": [
      "test",
      "entity:defiant.i.pdx.axcella.net"
    ],
    "system": {
      "hostname": "defiant.i.pdx.axcella.net",
      "os": "darwin",
      "platform": "darwin",
      "platform_version": "10.13.4",
      "network": {
        "interfaces": [
          {
            "name": "en10",
            "mac": "9c:eb:e8:56:18:8c",
            "addresses": [
              "fe80::872:3c65:d5b2:cb5/64",
              "10.0.80.155/24"
            ]
          }
        ]
      },
      "arch": "amd64"
    },
    "user": "agent"
  }

# Proxy event entity
{
  "timestamp": 1525287213,
  "entity": {
    "class": "proxy",
    "deregister": false,
    "deregistration": {},
    "environment": "default",
    "id": "example.com",
    "keepalive_timeout": 0,
    "organization": "default",
    "subscriptions": [
      "entity:example.com",
      "entity:example.com"
    ],
    "system": {
      "network": {
        "interfaces": null
      }
    }
  },

last_seen doesn't appear in the check event entity json. It should probably look like the keepalive entity does.

[echlebek]

@mercul3s oh I totally missed that this was about _entities_ and not _events_. That makes much more sense to me now. Thank you for clarifying.

[mercul3s]

I've done the quick fix of adding the last_seen time at the agent when the event is created, and opened #1434 to figure out a longer term fix for the entity time source of truth.