.. _alarm_feed: **************************************************** Alarm Feed **************************************************** .. important:: Before using this functionality, disable :ref:`record index protection ` by setting ``'OVERPROTECT_MEDIA': False``. Alerts will not work properly with ``OVERPROTECT_MEDIA`` enabled. Back in FindFace Multi 2.1, we introduced the :ref:`alarm_monitor` — a simple alarm monitoring service that allows an operator (e.g, a security staff member) to see an alarm and quickly react to the alarming event. In FindFace Multi 2.2 this functionality was further developed into another service — Alarm Feed. Although the functionality of the services overlaps, they are intended for different purposes and complement each other. An Alarm Feed user is a responsible person in the monitoring center, who needs to view alarm notifications at the facility for a certain period of time and download a report. At the same time, the Alarm Feed serves for finalizing work with alarming events that a user acknowledged or rejected in the Alarm Monitor, or in case an alarm was acknowledged automatically. .. rubric:: In this chapter: .. contents:: :local: .. _configure_alert: Alert Manager ================================ To start receiving notifications about alarms, configure an alert — a selection of rules and settings, under which the system will send a notification to the selected delivery channels. In FindFace Multi, navigate to :guilabel:`Settings` → :guilabel:`Alert manager` and click :guilabel:`+ New Alert`. |new_alert_en| .. |new_alert_en| image:: /_static/new_alert_en.png :scale: 70% .. |new_alert_ru| image:: /_static/new_alert_ru.png :scale: 70% It will open an alert configuration wizard. To configure an alert, do the following: In the :guilabel:`General` tab, provide an alert name and tags if necessary. Select :guilabel:`Active` to make an alert active. Then, click :guilabel:`Next` to move to the :guilabel:`Alert rules` tab. |alert_general_en| .. |alert_general_en| image:: /_static/alert_general_en.png :scale: 70% .. |alert_general_ru| image:: /_static/alert_general_ru.png :scale: 70% In the :guilabel:`Alert rules` tab, define alert conditions using filters. You can configure a rule for one entity only. Namely, a single rule cannot combine face events and body events filters. They should be separate rules: one is for face events and another one is for body events. A match to the rule will trigger an alert about the alarm. This section has the same set of filters as the :ref:`webhooks` section does. |alert_rules_en| .. |alert_rules_en| image:: /_static/alert_rules_en.png :scale: 70% .. |alert_rules_ru| image:: /_static/alert_rules_ru.png :scale: 70% The :guilabel:`Settings` section allows you to specify: * :guilabel:`Acknowledgment interval` (enabled by default): time in seconds to manually acknowledge or reject an alarming event, 60 seconds by default. An alarm becomes acknowledged automatically after the time interval expires. If the acknowledgment interval is set to ``0``, alarms become acknowledged automatically right after they occur. At any time, you can follow up on the acknowledged alarm in the pending status and complete it manually. * :guilabel:`Deduplication interval`: time in seconds to exclude coinciding object recognition events, 60 seconds by default. For face objects, the system compares their tracks and feature vectors, for silhouettes — their tracks, for vehicles — their tracks and license plate numbers. This setting is disabled by default. To enable it, select the :guilabel:`Enable deduplication` checkbox. |alert_settings_en| .. |alert_settings_en| image:: /_static/alert_settings_en.png :scale: 70% .. |alert_settings_ru| image:: /_static/alert_settings_ru.png :scale: 70% .. _delivery_channels: In the next tab, select the :guilabel:`Delivery channels` to get notifications to. A delivery channel Alarm Monitor implies sending notifications in the Alarm Monitor and Alarm Feed. This setting is enabled by default (non-configurable). |alert_delivery_channels_en| .. |alert_delivery_channels_en| image:: /_static/alert_delivery_channels_en.png :scale: 70% .. |alert_delivery_channels_ru| image:: /_static/alert_delivery_channels_ru.png :scale: 70% To get notifications in the Telegram messenger, :ref:`configure Telegram bot and enable it in FindFace Multi `. .. _fast_comments: In the :guilabel:`Fast comments` tab, create a comment (optional) for an alert. These comments are used to complete your work with an alarm in the Alarm Feed. These comments are alert-specific. They will be added to the default comments (common to all alerts), provided by the system. Read more :ref:`here `. |alert_fast_comment_en| .. |alert_fast_comment_en| image:: /_static/alert_fast_comment_en.png :scale: 70% .. |alert_fast_comment_ru| image:: /_static/alert_fast_comment_ru.png :scale: 70% After you have finished an alert configuration, click :guilabel:`Save and Close`. You will be redirected to the list of already created alerts. Use :guilabel:`More filters` to work with alerts. Display Custom Alarms ================================ FindFace Multi includes integration with :ref:`Annex ` – a software platform that provides video analytics tools. Such kind of integration allows you to monitor events that involve attributes not yet supported by FindFace Multi (e.g., fire, a left item, etc.) subject to the appropriate license. You can configure the display of custom alarms in FindFace Multi. To do that, take steps 1-4 if your FindFace Multi instance uses an external address. Or jump to steps 3 (see **Note**), 4 in case your FindFace Multi instance is running on the local host. #. Open the ``/opt/findface-multi/docker-compose.yaml`` configuration file. Configure the ``service_alarmer`` service by adding ``DSN_FF_UPLOAD: 'http://:3333/`` to the environment: .. code:: sudo vi /opt/findface-multi/docker-compose.yaml ... service_alarmer: command: [python, -m, service_alarmer] depends_on: [rabbitmq, timescaledb] environment: {DROP_ALL: 'False', DSN_AMQP: 'amqp://ntech:123sNyvm5axPkYgI08wiTsnQ5VtJtUAv@127.0.0.1:5672/', DSN_PG: 'postgresql+asyncpg://ntech:LcyEL1UpVUcmxvYIc12jMiR2HkKF123m@127.0.0.1:5433/annex', DSN_FF_UPLOAD: 'http://192.168.112.254:3333/'} image: docker.int.ntl/presale/annex:2.0.1 logging: {driver: journald} network_mode: service:pause restart: always ... #. Add the ``sed -i 's/listen 127.0.0.1:3333/listen 3333/g' /etc/nginx/conf.d/ffupload.conf`` line to the end of the ``/opt/findface-multi/configs/findface-upload/40-ffupload.sh`` file: .. code:: sudo vi /opt/findface-multi/configs/findface-upload/40-ffupload.sh #!/bin/sh sed -i 's/listen 3333/listen 127.0.0.1:3333/g' /etc/nginx/conf.d/ffupload.conf sed -i 's/listen 127.0.0.1:3333/listen 3333/g' /etc/nginx/conf.d/ffupload.conf #. In the ``/opt/findface-multi/configs/findface-multi-ui/nginx-site.conf`` file, configure ``add_header Content-Security-Policy``: add the source ``http://:3333`` to the ``img-src`` directive: .. code:: sudo vi /opt/findface-multi/configs/findface-multi-ui/nginx-site.conf ... add_header Content-Security-Policy "default-src 'self'; img-src 'self' http://192.168.112.254:3333 blob: data:; media-src 'self' blob:; connect-src 'self' data:; style-src 'self' 'unsafe-inline';"; ... .. note:: If your FindFace Multi instance is running on the local host, add the source ``http://:3333`` to the ``img-src`` directive in the ``add_header Content-Security-Policy`` line. #. Restart all FindFace Multi containers. .. code:: cd /opt/findface-multi/ sudo docker-compose down sudo docker-compose up -d .. _work_with_alarms: Work with Alarm Feed ================================ Access Alarm Feed from the main menu. An alarm may take up a status: * :guilabel:`New`: new and unprocessed alarms without comments. * :guilabel:`Pending`: * acknowledged/rejected by an operator; * no action is taken by an operator: an alarm becomes automatically acknowledged after acknowledgment interval expires. * :guilabel:`Completed`: the first comment has been added to an alarm. When a new alarm occurs, you may acknowledge it |acknowledge_button| or reject it |reject_button| (in case you consider an alarm false). If no action is taken by an operator, an alarm becomes automatically acknowledged after acknowledgment interval expires. An alarm is considered processed and completed only when at least one comment is left. Depending on the page layout (tile or list), to leave a comment, go to :guilabel:`Add Comment & Complete` in case you are using a list layout: |complete_alarm_en| .. |complete_alarm_en| image:: /_static/complete_alarm_en.png :scale: 65% .. |complete_alarm_ru| image:: /_static/complete_alarm_ru.png :scale: 65% or :guilabel:`Comment`, if you switched to a tile view: |tile_comment_en| .. |tile_comment_en| image:: /_static/tile_comment_en.png :scale: 60% .. |tile_comment_ru| image:: /_static/tile_comment_ru.png :scale: 60% .. _alarm_comments: You can complete an alarm with a default comment, provided by the system, or with your own comment that was configured on the :ref:`step of creating fast comments ` in the alert. To configure or delete the default comments, locate the ``"annex"`` section in the ``/opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py`` file. Remove a default comment or replace it with your own one in the ``"comments"`` parameter: .. code:: sudo vi /opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py "annex": { "enabled": True, "comments": [ "Action taken" ... ] }, .. note:: A user who completes an alarm in the :ref:`Alarm Feed `, may have limited permissions compared to a user who created an alert in the :ref:`Alert manager `. To view fast comments that were left for an alert in the Alert manager , a user must have an ``alertrule`` view permission enabled. If an ``alertrule`` view permission is disabled, a user will only see and be able to work with the default comments, provided by the system. In order to pause the flow of notifications, click |pause| in the upper-right corner of the :guilabel:`Alarm Feed` tab. .. |pause| image:: /_static/pause.png :scale: 70% .. |acknowledge_button| image:: /_static/acknowledge_button.png :scale: 60% .. |reject_button| image:: /_static/reject_button.png :scale: 60% While working with Alarm Feed, use the following filters: * :guilabel:`Status`: filter alarms by status: new, in progress, or completed. * :guilabel:`Reaction`: display only acknowledged, only rejected alarms, or alarms without any reaction applied. * :guilabel:`Detection time`: display only alarms that were detected within a given date and time interval. * :guilabel:`Processed by`: filter by the person who last acknowledged/rejected and completed an alarm. * :guilabel:`Comments`: filter alarms by comments. * :guilabel:`Alert ID`: filter by an alert ID (alert in the Alert manager) * :guilabel:`Alert message ID`: filter by an alert notification ID (alert notification in the Alarm Feed) .. note:: Each alarm status has preset conditions. E.g., :guilabel:`New` alarms are always without reaction and comments. :guilabel:`Pending` alarms are either acknowledged or rejected and without comments. :guilabel:`Completed` alarms are acknowledged or rejected and with comments. |alarm_feed_filters_en| .. |alarm_feed_filters_en| image:: /_static/alarm_feed_filters_en.png :scale: 65% .. |alarm_feed_filters_ru| image:: /_static/alarm_feed_filters_ru.png :scale: 65% Clicking the alarm record will open the alarm sidebar. The alarm sidebar view may differ depending on the source of the alarm. For alarms that have been configured with FindFace Multi, the :guilabel:`Information` tab in the sidebar displays a full frame image of the event, a thumbnail of the event, a line with a track (if preconfigured), a camera group/name, detection date and time, a camera preview (if the video player is enabled), tags (if any), and alarm information. You will also see if there's a match with a record index and the match probability. In the :guilabel:`Information` tab, you can :guilabel:`Add Comment & Complete` your work with an alarm. |alarm_sidebar_info_en| .. |alarm_sidebar_info_en| image:: /_static/alarm_sidebar_info_en.png :scale: 70% .. |alarm_sidebar_info_ru| image:: /_static/alarm_sidebar_info_ru.png :scale: 70% The :guilabel:`History` tab keeps the following information: date and time of the alarm, who acknowledged/rejected the alarm and at what time, who completed the alarm and at what time. |alarm_sidebar_history_en| .. |alarm_sidebar_history_en| image:: /_static/alarm_sidebar_history_en.png :scale: 65% .. |alarm_sidebar_history_ru| image:: /_static/alarm_sidebar_history_ru.png :scale: 65% For alarms that have been configured with :ref:`Annex `, the sidebar does not display FindFace Multi-specific information. .. _configure_tg_bot: Configure Telegram Bot ================================ You can create a Telegram bot to get alarm notifications into your Telegram messenger. To create a bot, do the following: #. Switch to `BotFather `_ in the Telegram messenger and click ``/start``. #. Send ``/newbot`` command. #. Choose a name for your bot, e.g., ``Alarm_notifications`` – this is the name that will be used as your bot title. #. Choose a username for your bot (if you use letters as a part of the username, mind that only Latin letters allowed): it must be unique and end with ``_bot``, e.g., ``Alarm_notifications888_bot``. You will get a message with the token and a link to your bot. |create_bot| .. |create_bot| image:: /_static/create_bot.png :scale: 65% #. Copy the token. #. Open the ``/opt/findface-multi/docker-compose.yaml`` configuration file. In the ``service_notifier_tg`` section, locate the ``BOT_TOKEN`` and paste the token that you have copied in the previous step into it. .. code:: sudo vi /opt/findface-multi/docker-compose.yaml ... service_notifier_tg: command: [python, -m, service_notifier.tg] depends_on: [rabbitmq] environment: {ALLOWED_SERVICES: null, ALLOWED_STREAMS: null, BOT_TOKEN: 'QWERTYUIOPASDFGH', DSN_AMQP: 'amqp://ntech:CxL2UmYgJU8T36P7734af906pYieGB6Q@127.0.0.1:5672/'} ... #. Open the ``/opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py`` configuration file. In the ``FFSECURITY`` section set ``'ENABLE_TELEGRAM': True``. .. code:: sudo vi /opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py FFSECURITY = { 'ENABLE_TELEGRAM': True, #. Restart all FindFace Multi containers. .. code:: cd /opt/findface-multi/ sudo docker-compose down sudo docker-compose up -d #. In FindFace Multi UI, you will see that Telegram has appeared in the list of delivery channels. To enable it, navigate :guilabel:`Alert manager` → :guilabel:`New alert` → :guilabel:`Delivery channels`. |tg_delivery_en| .. |tg_delivery_en| image:: /_static/tg_delivery_en.png :scale: 70% .. |tg_delivery_ru| image:: /_static/tg_delivery_ru.png :scale: 70% #. Access your bot and ``/login`` with FindFace Multi credentials. .. warning:: According to the Telegram official documentation, `bots have limitations `_ on the number of messages they can broadcast in a single interval. So, if the system sends a number of alerts beyond the limits set by Telegram, some alerts may be skipped.