From 8fcd09a3e9b5af98fcef31ba0de8765c0e7e2ed8 Mon Sep 17 00:00:00 2001
From: Bookatz <bookatz@google.com>
Date: Mon, 18 Dec 2017 13:01:10 -0800
Subject: [PATCH] Statsd anomaly detection atom

Creates an atom to represent when statsd's anomaly detection alert
fires, so that statsd can log when it detects an anomaly (in the output
and for any further processing).

Test: manually confirmed that atom was logged
Change-Id: I3376e4038bdc3402a536aab7cebad24b104a9aee
---
 cmds/statsd/src/anomaly/AnomalyTracker.cpp |  4 ++++
 cmds/statsd/src/atoms.proto                | 20 +++++++++++++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/cmds/statsd/src/anomaly/AnomalyTracker.cpp b/cmds/statsd/src/anomaly/AnomalyTracker.cpp
index 4777dcd32377e..162a34b957f8b 100644
--- a/cmds/statsd/src/anomaly/AnomalyTracker.cpp
+++ b/cmds/statsd/src/anomaly/AnomalyTracker.cpp
@@ -23,6 +23,7 @@
 #include <android/os/IIncidentManager.h>
 #include <android/os/IncidentReportArgs.h>
 #include <binder/IServiceManager.h>
+#include <statslog.h>
 #include <time.h>
 
 namespace android {
@@ -224,6 +225,9 @@ void AnomalyTracker::declareAnomaly(const uint64_t& timestampNs) {
     }
 
     StatsdStats::getInstance().noteAnomalyDeclared(mConfigKey, mAlert.name());
+
+    android::util::stats_write(android::util::ANOMALY_DETECTED, mConfigKey.GetUid(),
+                               mConfigKey.GetName().c_str(), mAlert.name().c_str());
 }
 
 void AnomalyTracker::declareAnomalyIfAlarmExpired(const HashableDimensionKey& dimensionKey,
diff --git a/cmds/statsd/src/atoms.proto b/cmds/statsd/src/atoms.proto
index c37f05e165083..1c6d9b09a8399 100644
--- a/cmds/statsd/src/atoms.proto
+++ b/cmds/statsd/src/atoms.proto
@@ -79,7 +79,8 @@ message Atom {
         IsolatedUidChanged isolated_uid_changed = 43;
         PacketWakeupOccurred packet_wakeup_occurred = 44;
         DropboxErrorChanged dropbox_error_changed = 45;
-        AppHook app_hook = 46;
+        AnomalyDetected anomaly_detected = 46;
+        AppHook app_hook = 47;
         // TODO: Reorder the numbering so that the most frequent occur events occur in the first 15.
     }
 
@@ -840,6 +841,23 @@ message AppHook {
     optional State state = 3;
 }
 
+/**
+ * Logs when statsd detects an anomaly.
+ *
+ * Logged from:
+ *   frameworks/base/cmds/statsd/src/anomaly/AnomalyTracker.cpp
+ */
+message AnomalyDetected {
+    // Uid that owns the config whose anomaly detection alert fired.
+    optional int32 config_uid = 1;
+
+    // Name of the config whose anomaly detection alert fired.
+    optional string config_name = 2;
+
+    // Name of the alert (i.e. name of the anomaly that was detected).
+    optional string alert_name = 3;
+}
+
 /**
  * Pulls bytes transferred via wifi (Sum of foreground and background usage).
  *