fix

cmd/spike-alerts/main.go

@@ -65,6 +65,14 @@ func main() {
 		log.Fatal(err)
 	}
 	cfg.DataSince = alerts.DataSince(ctx, conn, *database)
+	features.MarkBadActors(events, features.BadActorConfig{})
+	badActors := map[string]int{}
+	for _, e := range events {
+		if e.BadActor != "" {
+			badActors[e.BadActor]++
+		}
+	}
+	log.Printf("bad-actor events (ignored for alerts, kept as data): %v of %d", badActors, len(events))
 	log.Printf("loaded %d error events", len(events))
 
 	cache := map[string]classification{}
@@ -73,7 +81,11 @@ func main() {
 	muted := map[triage.Category]int{}
 	fired := 0
 	for at := first.Add(*window); !at.After(end); at = at.Add(*step) {
-		for _, spike := range suppress.Filter(alerts.FilterActionable(features.DetectSpikes(events, at, cfg), *showMuted, muted)) {
+		detected := alerts.DetectAlerts(events, at, cfg) // exactly what the server alerts on
+		if *showMuted {
+			detected = alerts.FilterActionable(features.DetectSpikes(events, at, cfg), true, muted)
+		}
+		for _, spike := range suppress.Filter(detected) {
 			fired++
 			var cls []classification
 			for _, p := range spike.Patterns {

cmd/window-features/main.go

@@ -107,5 +107,6 @@ func readEvents(path string) []features.Event {
 	if err := scanner.Err(); err != nil {
 		log.Fatal(err)
 	}
+	features.MarkBadActors(result, features.BadActorConfig{})
 	return result
 }