From 0dca54990b01986b759213e8ba6552b88be21a1d Mon Sep 17 00:00:00 2001 From: ysyneu Date: Wed, 29 Jul 2026 20:18:23 -0700 Subject: [PATCH 1/2] docs: sync docs with latest product changes - platform/sso: document stable user ID field and member association modes - rum: Flutter symbolication (source-mapping, error-viewing, error-aggregation), Flutter app type & native dashboard differences, UV metric basis, private-deployment replay fetch mode - monitors: MySQL/PostgreSQL TLS/SSL modes, TLS client config rework, remove label_fields (auto-derived), query time offset rename & relocation - ai-sre: session sharing, list search/filters for skills/MCP/A2A agents, wording alignment (AI SRE server) --- en/ai-sre/agents.mdx | 6 +-- en/ai-sre/mcp.mdx | 2 +- en/ai-sre/sessions.mdx | 20 +++++++- en/ai-sre/skills.mdx | 2 +- en/monitors/alert-rules/clickhouse.mdx | 7 ++- en/monitors/alert-rules/mysql.mdx | 7 ++- en/monitors/alert-rules/oracle.mdx | 7 ++- en/monitors/alert-rules/postgres.mdx | 7 ++- en/monitors/alert-rules/sls.mdx | 5 +- en/monitors/alert-rules/victorialogs.mdx | 3 +- en/monitors/data-sources/data-sources.mdx | 39 +++++++++++++-- en/monitors/quickstart/quickstart.mdx | 7 +-- en/on-call/integration/sso/authing.mdx | 4 +- en/platform/configure-sso.mdx | 23 +++++++++ en/rum/analytics/native.mdx | 15 +++++- en/rum/error-tracking/error-aggregation.mdx | 2 + en/rum/error-tracking/error-viewing.mdx | 6 ++- en/rum/error-tracking/source-mapping.mdx | 55 ++++++++++++++++++++- en/rum/quickstart/app-management.mdx | 3 +- en/rum/session-replay/overview.mdx | 16 ++++++ zh/ai-sre/agents.mdx | 6 +-- zh/ai-sre/mcp.mdx | 2 +- zh/ai-sre/sessions.mdx | 20 +++++++- zh/ai-sre/skills.mdx | 2 +- zh/monitors/alert-rules/clickhouse.mdx | 7 ++- zh/monitors/alert-rules/mysql.mdx | 7 ++- zh/monitors/alert-rules/oracle.mdx | 7 ++- zh/monitors/alert-rules/postgres.mdx | 7 ++- zh/monitors/alert-rules/sls.mdx | 5 +- zh/monitors/alert-rules/victorialogs.mdx | 3 +- zh/monitors/data-sources/data-sources.mdx | 39 +++++++++++++-- zh/monitors/quickstart/quickstart.mdx | 7 +-- zh/on-call/integration/sso/authing.mdx | 4 +- zh/platform/configure-sso.mdx | 23 +++++++++ zh/rum/analytics/native.mdx | 15 +++++- zh/rum/error-tracking/error-aggregation.mdx | 2 + zh/rum/error-tracking/error-viewing.mdx | 6 ++- zh/rum/error-tracking/source-mapping.mdx | 55 ++++++++++++++++++++- zh/rum/quickstart/app-management.mdx | 3 +- zh/rum/session-replay/overview.mdx | 16 ++++++ 40 files changed, 386 insertions(+), 86 deletions(-) diff --git a/en/ai-sre/agents.mdx b/en/ai-sre/agents.mdx index 2a7c96ce..d2deca7c 100644 --- a/en/ai-sre/agents.mdx +++ b/en/ai-sre/agents.mdx @@ -77,7 +77,7 @@ On the A2A Agents list page, click **Add A2A Agent** and fill in the form: | Streaming | bool | on | Whether to communicate with the remote agent in streaming mode | | User Auth Mode | enum | `shared` | See "Auth Modes" below | | Skip TLS certificate verification | bool | off | Shown only when the Card URL uses HTTPS. Enable only when the remote endpoint uses a self-signed certificate inside a controlled network; this skips certificate-chain and hostname verification | -| Allow OAuth discovery over HTTP | bool | off | Required only when "Per-user OAuth" is selected and the Card URL is a non-local HTTP URL. Use only in controlled test environments; after you enable it, the Safari service can fetch OAuth metadata from that host | +| Allow OAuth discovery over HTTP | bool | off | Required only when "Per-user OAuth" is selected and the Card URL is a non-local HTTP URL. Use only in controlled test environments; after you enable it, the AI SRE service can fetch OAuth metadata from that host | ### Using the FlashAI Template @@ -199,8 +199,8 @@ The full lifecycle of A2A agents is managed on the **Plugins → Agents** page. Remove an A2A agent from the current scope. **Active sessions that delegated to it will fail.** Deletion requires confirmation. - - The scope filter bar at the top of the list lets you switch between "All", "Account only", and "Specific team", making it easy to focus on relevant resources when managing many. Each row also has a label showing its scope (account / team name). + + The scope filter bar at the top of the list lets you switch between "All", "Account only", and "Specific team", making it easy to focus on relevant resources when managing many. Each row also has a label showing its scope (account / team name). The search box to the right of the filter bar filters the list by keywords in the name, instructions, or Card URL. diff --git a/en/ai-sre/mcp.mdx b/en/ai-sre/mcp.mdx index 4e1a30bc..cfeeab98 100644 --- a/en/ai-sre/mcp.mdx +++ b/en/ai-sre/mcp.mdx @@ -164,7 +164,7 @@ OAuth authorization completes through a browser **bounce page** at `/oauth-callb --- -The MCP list displays each server's **name** (including its AI description), **scope** (account or team name), **transport**, an **enabled** toggle, and an **actions** column — the list only contains MCP servers you have added to the account; the built-in Flashduty MCP server is injected by the runtime and does not appear in this list, see "Inspection" below. The scope filter bar at the top lets you switch between All / Account / Team views. +The MCP list displays each server's **name** (including its AI description), **scope** (account or team name), **transport**, an **enabled** toggle, and an **actions** column — the list only contains MCP servers you have added to the account; the built-in Flashduty MCP server is injected by the runtime and does not appear in this list, see "Inspection" below. The scope filter bar at the top lets you switch between All / Account / Team views, and the search box to its right filters the list by keywords in the name, description, transport, or URL. diff --git a/en/ai-sre/sessions.mdx b/en/ai-sre/sessions.mdx index d5301650..ebb02e75 100644 --- a/en/ai-sre/sessions.mdx +++ b/en/ai-sre/sessions.mdx @@ -1,6 +1,6 @@ --- title: Console -description: An AI SRE session holds one complete conversation between you and the agent, including messages, streaming responses, tool calls, and artifacts. This page covers creating and managing sessions, sending messages, previewing artifacts, session forking, context compaction, team binding, and session data export. +description: An AI SRE session holds one complete conversation between you and the agent, including messages, streaming responses, tool calls, and artifacts. This page covers creating and managing sessions, sharing, sending messages, previewing artifacts, session forking, context compaction, team binding, and session data export. keywords: ["AI SRE", "session", "chat", "streaming response", "tool call", "Artifacts", "Fork", "context compaction", "team binding", "export", "NDJSON"] sidebarTitle: Console --- @@ -61,6 +61,24 @@ The account is the hard access boundary for sessions: sessions are never accessi Pinning is a personal preference and does not modify the session itself; if you can read a session, you can pin or unpin it for yourself. Account owners and admins can manage team sessions, but they cannot read or manage another member's personal session. +### Sharing a Session + +The chat page header provides share controls, shown only when you have manage permission on the current session. Click the **Copy share link** button to enable sharing and copy the link to your clipboard (a "Share link copied" toast appears). The link appends a `share_token` to the current session URL, with the token in the URL fragment (after `#`). The share link is **stable**: while sharing stays enabled, copying it again yields the same link. + +| Topic | Details | +|---|---| +| Who can share | Members with manage permission on the session — the creator of a personal session, or the creator / account owner / admin / team members of a team session | +| Who can open it | Members who hold the link and are signed in to the **same account**; the link does not work across accounts or for anonymous visitors | +| What link holders see | The session opens in **read-only** mode with a "This is a read-only shared session" notice: they can inspect the full context (messages, tool calls, artifacts), but the composer is replaced by the notice — they cannot continue the conversation or modify the original session | +| How to keep working | Link holders can click **Fork into a new session** to derive their own session and continue from there | +| How to revoke | Once sharing is enabled, a **Remove share** button appears in the header; clicking it invalidates the link immediately (a "Share removed" toast appears). Re-enabling sharing later generates a new link — the old link is not restored | + +Sharing mainly changes the visibility of **personal sessions**: a team session is already readable by any member of the same account who has the session ID (see the table above), whereas a personal session is visible only to its creator by default — a share link is the only way for other members of the account to open it. + + +Incognito sessions and Subagent sessions cannot be shared. + + ### Per-Session Actions Hover over a session row to reveal the pin and archive actions. A pinned session displays a persistent pin icon to the left of its name. diff --git a/en/ai-sre/skills.mdx b/en/ai-sre/skills.mdx index 0a0c4fe6..e75d4b35 100644 --- a/en/ai-sre/skills.mdx +++ b/en/ai-sre/skills.mdx @@ -160,7 +160,7 @@ Skill archive size limits: archives saved by the agent in-conversation are cappe --- -The skill list displays each skill's **name** (with source template badge and **Update available** marker), **scope** (account or team), **version**, **enabled** toggle, and an **actions** column. +The skill list displays each skill's **name** (with source template badge and **Update available** marker), **scope** (account or team), **version**, **enabled** toggle, and an **actions** column. The toolbar above the list provides a scope filter (All / Account / Team) and a search box that filters the list by keywords in the name, description, or author. diff --git a/en/monitors/alert-rules/clickhouse.mdx b/en/monitors/alert-rules/clickhouse.mdx index d6106826..c9f9e421 100644 --- a/en/monitors/alert-rules/clickhouse.mdx +++ b/en/monitors/alert-rules/clickhouse.mdx @@ -30,15 +30,14 @@ This mode is suitable for scenarios requiring threshold comparison on aggregated GROUP BY service_name ``` 2. **Field Mapping**: - - **Label Fields**: Fields used to distinguish different alert objects. In the above example, it's `service_name`. This field can be left empty; Monitors will automatically treat all fields except value fields as label fields. - - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. + - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. Monitors automatically treats fields other than the value fields in the query result as labels (`service_name` in the above example). 3. **Threshold Conditions**: - Use `$A.field_name` to reference values. - Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works -The engine executes the SQL query and gets the result set. It groups data by "label fields", then extracts "value fields" values to compare against threshold expressions. +The engine executes the SQL query and gets the result set. It automatically groups data using fields other than the value fields as labels, then extracts the "value fields" values to compare against threshold expressions. ### Recovery Logic @@ -113,6 +112,6 @@ ClickHouse is very sensitive to time partitions. Always include time range filte -Monitors engine converts column names returned by ClickHouse to lowercase. When filling in "label fields" and "value fields", always use lowercase letters. +Monitors engine converts column names returned by ClickHouse to lowercase. When filling in "value fields", always use lowercase letters. diff --git a/en/monitors/alert-rules/mysql.mdx b/en/monitors/alert-rules/mysql.mdx index 9c4451e8..b28fd3e1 100644 --- a/en/monitors/alert-rules/mysql.mdx +++ b/en/monitors/alert-rules/mysql.mdx @@ -30,15 +30,14 @@ This mode is suitable for scenarios requiring threshold comparison on aggregated GROUP BY service_name ``` 2. **Field Mapping**: - - **Label Fields**: Fields used to distinguish different alert objects. In the above example, it's `service_name`. This field can be left empty; Monitors will automatically treat all fields except value fields as label fields. - - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. + - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. Monitors automatically treats fields other than the value fields in the query result as labels (`service_name` in the above example). 3. **Threshold Conditions**: - Use `$A.field_name` to reference values. - Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works -The engine executes SQL query and gets the result set. It groups data by "label fields", then extracts "value fields" values to compare against threshold expressions. +The engine executes SQL query and gets the result set. It automatically groups data using fields other than the value fields as labels, then extracts the "value fields" values to compare against threshold expressions. ### Recovery Logic @@ -105,6 +104,6 @@ Recommended syntax: `log_time > now() - INTERVAL 5 MINUTE` -Monitors engine converts column names returned by MySQL to lowercase. When filling in "label fields" and "value fields", always use lowercase letters. +Monitors engine converts column names returned by MySQL to lowercase. When filling in "value fields", always use lowercase letters. diff --git a/en/monitors/alert-rules/oracle.mdx b/en/monitors/alert-rules/oracle.mdx index 175d3609..27f12b22 100644 --- a/en/monitors/alert-rules/oracle.mdx +++ b/en/monitors/alert-rules/oracle.mdx @@ -30,15 +30,14 @@ This mode is suitable for scenarios requiring threshold comparison on aggregated GROUP BY service_name ``` 2. **Field Mapping**: - - **Label Fields**: Fields used to distinguish different alert objects. In the above example, it's `service_name`. This field can be left empty; Monitors will automatically treat all fields except value fields as label fields. - - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. + - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. Monitors automatically treats fields other than the value fields in the query result as labels (`service_name` in the above example). 3. **Threshold Conditions**: - Use `$A.field_name` to reference values. - Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works -The engine executes SQL query and gets the result set. It groups data by "label fields", then extracts "value fields" values to compare against threshold expressions. +The engine executes SQL query and gets the result set. It automatically groups data using fields other than the value fields as labels, then extracts the "value fields" values to compare against threshold expressions. ### Recovery Logic @@ -105,6 +104,6 @@ Recommended syntax: `log_time > SYSDATE - INTERVAL '5' MINUTE` -Monitors engine converts column names returned by Oracle to lowercase. When filling in "label fields" and "value fields", always use lowercase letters. +Monitors engine converts column names returned by Oracle to lowercase. When filling in "value fields", always use lowercase letters. diff --git a/en/monitors/alert-rules/postgres.mdx b/en/monitors/alert-rules/postgres.mdx index 8971eb50..149cc024 100644 --- a/en/monitors/alert-rules/postgres.mdx +++ b/en/monitors/alert-rules/postgres.mdx @@ -30,15 +30,14 @@ This mode is suitable for scenarios requiring threshold comparison on aggregated GROUP BY service_name ``` 2. **Field Mapping**: - - **Label Fields**: Fields used to distinguish different alert objects. In the above example, it's `service_name`. This field can be left empty; Monitors will automatically treat all fields except value fields as label fields. - - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. + - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. Monitors automatically treats fields other than the value fields in the query result as labels (`service_name` in the above example). 3. **Threshold Conditions**: - Use `$A.field_name` to reference values. - Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works -The engine executes SQL query and gets the result set. It groups data by "label fields", then extracts "value fields" values to compare against threshold expressions. +The engine executes SQL query and gets the result set. It automatically groups data using fields other than the value fields as labels, then extracts the "value fields" values to compare against threshold expressions. ### Recovery Logic @@ -105,6 +104,6 @@ Recommended syntax: `log_time > NOW() - INTERVAL '5 minutes'` -Monitors engine converts column names returned by PostgreSQL to lowercase. When filling in "label fields" and "value fields", always use lowercase letters. +Monitors engine converts column names returned by PostgreSQL to lowercase. When filling in "value fields", always use lowercase letters. diff --git a/en/monitors/alert-rules/sls.mdx b/en/monitors/alert-rules/sls.mdx index 318c053b..cddcff5f 100644 --- a/en/monitors/alert-rules/sls.mdx +++ b/en/monitors/alert-rules/sls.mdx @@ -31,15 +31,14 @@ This mode is suitable for scenarios requiring threshold comparison on aggregated - `sls.timespan.value`: (Optional) Time span value, default is 15. - `sls.timespan.unit`: (Optional) Time span unit, supports `s` (seconds), `m` (minutes), `h` (hours), `d` (days). Default is `m`. 3. **Field Mapping**: - - **Label Fields**: Fields used to distinguish different alert objects. In the above example, it's `host`. This field can be left empty; Monitors will automatically treat all fields except value fields as label fields. - - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. + - **Value Fields**: Numeric fields used for threshold evaluation. In the above example, it's `error_cnt`. Monitors automatically treats fields other than the value fields in the query result as labels (`host` in the above example). 4. **Threshold Conditions**: - Use `$A.field_name` to reference values. - Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works -The engine calls SLS API, specifying time range (like last 15 minutes), executing SQL query. After getting results, it groups by "label fields", extracts "value fields" to compare against thresholds. +The engine calls SLS API, specifying time range (like last 15 minutes), executing SQL query. After getting results, it automatically groups data using fields other than the value fields as labels, then extracts "value fields" to compare against thresholds. ### Recovery Logic diff --git a/en/monitors/alert-rules/victorialogs.mdx b/en/monitors/alert-rules/victorialogs.mdx index 96770355..287cca5c 100644 --- a/en/monitors/alert-rules/victorialogs.mdx +++ b/en/monitors/alert-rules/victorialogs.mdx @@ -18,7 +18,6 @@ Calls `/select/logsql/query` interface, returning two-dimensional table data. | Query Statement | e.g., `error \| fields _time, _stream, _msg \| sort by (_time) desc` | | Return Limit | Limit maximum returned rows, max can be set to 100 | | Time Range | Specify query time window, e.g., "last 5 minutes" | -| Label Fields | Used to distinguish different alert entities, can configure multiple | | Value Fields | Required in threshold evaluation mode | @@ -57,7 +56,7 @@ Result looks like: |-------|-------| | ERROR | 150 | -Configure value field as `total`, label field as `level` (or leave empty, Monitors will auto-detect). Different threshold different level configuration examples: +Configure the value field as `total`; Monitors automatically recognizes fields other than the value fields (`level` in the above example) as labels. Different threshold different level configuration examples: - Warning: `$A.total >= 50` or shorthand `$A >= 50` (since there's only one value field: total) - Critical: `$A.total >= 100` or shorthand `$A >= 100` (since there's only one value field: total) diff --git a/en/monitors/data-sources/data-sources.mdx b/en/monitors/data-sources/data-sources.mdx index 5b844a24..6470dd3a 100644 --- a/en/monitors/data-sources/data-sources.mdx +++ b/en/monitors/data-sources/data-sources.mdx @@ -82,9 +82,11 @@ Wildcard by name stores name strings — if a data source is renamed, existing w | **Headers** | Custom HTTP request headers, supports multiple Key-Value pairs | | **Params** | Custom URL query parameters, supports multiple Key-Value pairs | | **Basic Authentication** | When enabled, requires username and password | -| **Self-Signed Certificate** | When enabled, fill in CA certificate content | -| **TLS Client Authentication** | When enabled, requires ServerName, client certificate, and client key | -| **Skip TLS Certificate Validation** | Skip TLS certificate verification | +| **Use a custom CA certificate** | When checked, fill in the CA certificate content; leave empty to use the system trust store of the alert engine host | +| **Enable client certificate authentication (mTLS)** | When checked, fill in the client certificate and client key; the two must be provided as a pair | +| **Server name (optional)** | Used for SNI and certificate hostname verification; inferred from the connection address when empty | +| **Minimum / Maximum TLS version** | Options: TLS 1.0, 1.1, 1.2, 1.3; defaults to system default. The minimum version must not be higher than the maximum version | +| **Skip server certificate verification** | When checked, the server certificate is not verified | ### MySQL / Oracle / PostgreSQL @@ -100,7 +102,36 @@ Relational databases share a similar configuration structure: | **Username** | Database username | - | | **Password** | Database password | - | -Self-signed certificate and TLS client authentication configurations are also supported. +Oracle uses only the basic connection settings above. MySQL and PostgreSQL additionally support TLS/SSL encrypted connections, selected via the **TLS/SSL mode** dropdown. + +#### TLS/SSL modes for MySQL + +| Mode | Description | +|------|-------------| +| **Disable TLS** (disable) | The connection is not encrypted with TLS | +| **Encrypt without certificate verification** (require) | TLS encryption is required, but the identity of the database server is not verified; a custom CA certificate is not allowed in this mode | +| **Verify certificate and hostname** (verify-full, recommended) | Verifies the certificate authority and the certificate hostname; a custom CA certificate can be configured in this mode | + +With any mode other than "Disable TLS", you can also enable client certificate authentication (mTLS — the client certificate and client key must be provided as a pair), set the server name, and configure the minimum / maximum TLS version. With "Verify certificate and hostname", use the database DNS name that matches the server certificate as the connection address instead of an IP address. + + +Setting any mode other than "Disable TLS" requires all registered Edge instances in the associated alert engine cluster to be v0.51.0 or later. + + +#### TLS/SSL modes for PostgreSQL + +| Mode | Description | +|------|-------------| +| **Disable TLS** (disable) | The connection is not encrypted with TLS | +| **Encrypt without certificate verification** (require) | TLS encryption is required, but the identity of the database server is not verified; a custom CA certificate is not allowed in this mode | +| **Verify certificate authority** (verify-ca) | Verifies that the server certificate was issued by a trusted certificate authority without checking its hostname | +| **Verify certificate and hostname** (verify-full, recommended) | Verifies the certificate authority and ensures the certificate hostname matches the connection address | + +In "Verify certificate authority" and "Verify certificate and hostname" modes, a custom CA certificate is optional — leave it empty to use the system trust store of the alert engine host. Client certificate authentication (mTLS) can be enabled in any mode other than "Disable TLS". With "Verify certificate and hostname", use the database DNS name that matches the server certificate as the connection address instead of an IP address. + + +Setting any mode other than "Disable TLS" requires all registered Edge instances in the associated alert engine cluster to be v0.50.0 or later. + ### Elasticsearch / Loki / ClickHouse / SLS / VictoriaLogs diff --git a/en/monitors/quickstart/quickstart.mdx b/en/monitors/quickstart/quickstart.mdx index 37be2a47..784c1a91 100644 --- a/en/monitors/quickstart/quickstart.mdx +++ b/en/monitors/quickstart/quickstart.mdx @@ -96,10 +96,6 @@ If you need stable rule bindings that are unaffected by data source renames, pre Configure how to query data sources and how to evaluate alert conditions. Please read the usage instructions on the right side of **Query Detection Method** on the page. -| Config Item | Description | -|--------|------| -| **Query Offset** | Sets the query time offset (in seconds) to handle data source ingestion lag. For example, setting it to 60 shifts the query window back by 60 seconds, ensuring data has been fully written before querying | - ### Detection Frequency and Effective Time ![Detection frequency & effective time](https://docs-cdn.flashcat.cloud/imges/mon/0980d71a653985a1706243fc6795685e.png) @@ -107,6 +103,7 @@ Configure how to query data sources and how to evaluate alert conditions. Please | Config Item | Description | |--------|------| | **Detection Frequency** | Usually periodic detection; also supports `cron` expressions (down to seconds) | +| **Query Time Offset** | Sets the query time offset (in seconds) to handle data source ingestion lag. For example, setting it to 60 shifts the query window back by 60 seconds, ensuring data has been fully written before querying. Only applies to Prometheus, Loki, VictoriaLogs, and SLS data sources | | **Rule Timezone** | The timezone in which the rule executes. It controls how `cron` schedules and **Effective Time** windows are interpreted. Defaults to `Asia/Shanghai`. Must be a valid IANA timezone name such as `Asia/Shanghai`, `UTC`, `Europe/London`, or `America/New_York` | | **Effective Time** | Time period when the alert rule is effective; alerts will not trigger outside this period. Time windows are evaluated in the **Rule Timezone** above | @@ -166,7 +163,7 @@ After selecting multiple rules, click **Batch Update** to uniformly modify the f | **Detection Frequency** | Uniformly adjust the detection period | | **Rule Timezone** | Uniformly switch the IANA timezone of the alert rule | | **Effective Time** | Uniformly configure effective time periods | -| **Query Delay** | Uniformly set query delay time | +| **Query Time Offset** | Uniformly set the query time offset. Batch update is available only when the data sources of all selected rules support query time offset (Prometheus, Loki, VictoriaLogs, SLS); otherwise this option is disabled | | **Custom Fields** | Uniformly configure annotations | | **Channel** | Uniformly specify the channel for alert delivery | | **Repeat Notification Config** | Uniformly set repeat notification interval and count | diff --git a/en/on-call/integration/sso/authing.mdx b/en/on-call/integration/sso/authing.mdx index 95a37b61..b8c2b1ed 100644 --- a/en/on-call/integration/sso/authing.mdx +++ b/en/on-call/integration/sso/authing.mdx @@ -70,7 +70,7 @@ Modify permissions: ### 4. Create User and Test Login -Flashduty only supports user email association, so users need to be created with email. +Flashduty associates members by email by default, so create users with an email address. New SSO configurations can also associate members via a stable user ID field — see [Single Sign-On configuration](/en/platform/configure-sso). Create user in Authing: @@ -168,7 +168,7 @@ Modify permissions: ### 4. Create User and Test Login -Flashduty only supports user email association, so users need to be created with email. +Flashduty associates members by email by default, so create users with an email address. New SSO configurations can also associate members via a stable user ID field — see [Single Sign-On configuration](/en/platform/configure-sso). Create user in Authing: diff --git a/en/platform/configure-sso.mdx b/en/platform/configure-sso.mdx index d716976b..7778fa8a 100644 --- a/en/platform/configure-sso.mdx +++ b/en/platform/configure-sso.mdx @@ -16,6 +16,7 @@ Flashduty supports Single Sign-On (SSO) via SAML2.0, OIDC, CAS, and LDAP (privat | Protocol Type | Select SAML2.0 | | Metadata Document | XML document obtained from the identity provider | | Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields | +| Stable User ID Field (`user_id`) | The unique user identifier attribute returned by the identity provider, used to recognize the same member; email or phone changes do not affect recognition. Recommended value: `employee_id`; enter `name_id` to use the NameID (Subject) of the SAML assertion. See [Member Association](#member-association) below | | Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in | | SSO-only login (`force_sso`) | Enabled by default. When on, every member of this account can sign in only via SSO; password and verification-code sign-in are rejected. See [SSO-only login](#sso-only-login) below | | Flashduty Service Provider Info | **Service Provider Metadata** and **Assertion Consumer Service URL** (assertion address for identity provider to call for single sign-on) | @@ -33,6 +34,7 @@ Flashduty supports Single Sign-On (SSO) via SAML2.0, OIDC, CAS, and LDAP (privat | Client ID | Client ID, obtained from identity provider | | Client Secret | Client secret, obtained from identity provider | | Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields | +| Stable User ID Field (`user_id`) | The unique user identifier claim used to recognize the same member; email or phone changes do not affect recognition. Recommended value: `sub`. See [Member Association](#member-association) below | | Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in | | SSO-only login (`force_sso`) | Enabled by default. When on, every member of this account can sign in only via SSO; password and verification-code sign-in are rejected. See [SSO-only login](#sso-only-login) below | | Scopes | Specifies the information and functionality permissions the request can access, with support for customization. Defaults to `openid`, `profile`, `email`, `phone`; you can add custom scopes as tags | @@ -55,6 +57,7 @@ Scopes is a required field. The default values `openid`, `profile`, `email`, `ph | CAS Login Path | CAS login path, e.g., `/login` | | Skip TLS Check | Optional; when enabled, skips TLS certificate verification, suitable for CAS services using self-signed certificates | | Field Mapping | Flashduty extracts user email, username, and phone information from the identity provider through mapped fields | +| Stable User ID Field (`user_id`) | The unique user identifier used to recognize the same member; email or phone changes do not affect recognition. Recommended value: `principal` (the CAS authenticated username); you can also map it to a returned attribute. See [Member Association](#member-association) below | | Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in | | SSO-only login (`force_sso`) | Enabled by default. When on, every member of this account can sign in only via SSO; password and verification-code sign-in are rejected. See [SSO-only login](#sso-only-login) below | | Flashduty Service Provider Info | **Redirect URL**: Identity provider callback address | @@ -79,6 +82,7 @@ LDAP single sign-on is only supported in the **private deployment version**. | User DN | Defines where to start searching for users, e.g., `ou=people,dc=flashduty,dc=com` | | Auth Filter | Custom filter expression for retrieving user DN information, basic form: `(&(mail=%s))`. Note: Opening and closing parentheses are required | | Field Mapping | Flashduty extracts user email, username, phone, and Group information from the identity provider through mapped fields. Email is a required mapping field. The Group field defaults to `memberOf` and is used for role and team synchronization | +| Stable User ID Field (`user_id`) | The unique user identifier attribute used to recognize the same member; email or phone changes do not affect recognition. Recommended value: `uid`; you can also use a stable attribute such as `entryUUID`. See [Member Association](#member-association) below | | Create Account on Sign In | Enabled by default; when disabled, members must be invited before they can sign in | | SSO-only login (`force_sso`) | Enabled by default. When on, every member of this account can sign in only via SSO; password and verification-code sign-in are rejected. See [SSO-only login](#sso-only-login) below | @@ -124,6 +128,25 @@ When using the LDAP protocol, you can automatically synchronize Flashduty roles - The Group DN in mapping rules must be the full path of the Group in LDAP +## Member Association + +--- + +During single sign-on, the system associates the user returned by the identity provider with a member of the account. The association method depends on whether the SSO configuration has a **Stable User ID Field** set: + +| Configuration | Association method | +| --- | --- | +| New SSO configuration (stable user ID field configured) | Recognizes the same member by the stable user ID returned by the identity provider; email or phone changes do not affect recognition. If the stable user ID is not yet bound, the system first matches an existing member by email or phone and establishes the stable user ID binding | +| Existing SSO configuration (no stable user ID field) | Members continue to be associated by email or phone; behavior stays unchanged | + + +Make sure the identity provider always returns a stable and unique user ID. A mapping failure (the identity provider does not return the field) will prevent members from signing in. + + + +Changing identity-scope settings (protocol type, identity provider address, or the stable user ID field) is treated as an identity-scope change, and the system rotates the SSO configuration ID. Existing members are re-associated by email or phone on their next sign-in and bound to the new stable user ID. + + ## SSO-only login --- diff --git a/en/rum/analytics/native.mdx b/en/rum/analytics/native.mdx index 5d6605d5..b0fe4cd3 100644 --- a/en/rum/analytics/native.mdx +++ b/en/rum/analytics/native.mdx @@ -9,6 +9,15 @@ Flashduty Native RUM Insights dashboard provides out-of-the-box visualization da The Insights dashboard includes 4 core analysis dimensions: **Overview**, **Performance Analysis**, **Error Analysis**, **Resource Analysis** + +**Platform Differences** + +The Native dashboard applies to Android, iOS, HarmonyOS, and Flutter apps, with the following platform-specific differences: + +- **Flutter**: A single Flutter app spans both Android and iOS, so the filter bar additionally pins the `os_name` filter to let you slice metrics by device OS. In the Overview and Error Analysis, the **ANR Rate** (from Android devices) and **App Hang Rate** (from iOS devices) cards are displayed side by side. +- **HarmonyOS**: The SDK does not report performance or hang metrics yet, so hang-related cards are hidden and the "Performance" tab is not available. + + ## Overview — Key Metrics at a Glance @@ -464,11 +473,15 @@ Flashduty RUM typically completes data collection and display within **1-3 minut | Metric | Collection Field | Description | |--------|-----------------|-------------| -| UV | usr_id | Total deduplicated users | +| UV | usr_anonymous_id / usr_id | Total deduplicated users, see the note below for the definition | | Session Count | session_id | Total sessions when app is opened and used | | Avg Session Duration | - | Total session duration divided by total sessions | | Session Frequency | - | Total sessions divided by active users | + +**UV definition**: On the Native (Android/iOS/HarmonyOS/Flutter) dashboard and app cards, UV is keyed on the device-stable anonymous ID, i.e. `COUNT(DISTINCT COALESCE(NULLIF(usr_anonymous_id, ''), NULLIF(usr_id, '')))`. The anonymous ID persists across login, so an anonymous session and the same person's later logged-in session count as one user; when anonymous user tracking is disabled, it falls back to `usr_id`. Web and Mini Program dashboards keep the `usr_id` definition unchanged. + + ### Performance Metric Thresholds | Metric | Collection Field | Good | Moderate | Poor | diff --git a/en/rum/error-tracking/error-aggregation.mdx b/en/rum/error-tracking/error-aggregation.mdx index 4c4c32fe..1ba7af90 100644 --- a/en/rum/error-tracking/error-aggregation.mdx +++ b/en/rum/error-tracking/error-aggregation.mdx @@ -19,6 +19,8 @@ When a new error event occurs, Flashduty uses a three-step aggregation strategy **Android NDK native crash exception:** NDK native crashes (where `source_type` contains `ndk`, or the stack contains application-layer native frames) skip the ML similarity analysis in this step and rely entirely on the deterministic fingerprint from Step 1. This is because NDK crash messages (such as `signal: SIGSEGV`) are nearly identical across unrelated crashes; routing them through similarity analysis would incorrectly merge crashes from different code locations into the same Issue. The frame-aware fingerprint precisely distinguishes different crash sites. + + **Flutter native crashes are handled by their real platform:** Native crashes reported by a Flutter app carry `source` = `flutter`; during grouping the real platform is resolved from `source_type` (`ndk`, `android`, `ios`). Crashes whose `source_type` is `ndk` (or whose stack contains application-layer native frames) behave exactly like Android NDK crashes — they skip ML similarity analysis and group by the native-frame fingerprint. Crashes whose `source_type` is `ios` still group by the message fingerprint, the same as a standalone iOS app. diff --git a/en/rum/error-tracking/error-viewing.mdx b/en/rum/error-tracking/error-viewing.mdx index 09697672..111e5ddb 100644 --- a/en/rum/error-tracking/error-viewing.mdx +++ b/en/rum/error-tracking/error-viewing.mdx @@ -173,7 +173,7 @@ Click any Issue to open the details panel and view more information. By default, displays the most recent error information reported during the Issue's occurrence as an error sample. You can also switch through the navigation bar. - View error context and stack information. If the corresponding SourceMap, Android mapping file, or iOS dSYM file has been uploaded, you can see mapped original source code locations and code snippets. + View error context and stack information. If the corresponding SourceMap, Android mapping file, iOS dSYM file, or Flutter symbol file has been uploaded, you can see mapped original source code locations and code snippets. Error Stack @@ -206,6 +206,10 @@ Click any Issue to open the details panel and view more information. For iOS crashes, you can also view the list of Binary Images loaded at the time of the crash, including image names, address ranges, and UUIDs, for offline symbolication analysis. + **Flutter Support** + + Flutter native crashes (with `source_type` of `ndk`, `android`, or `ios`) carry thread stacks and Binary Images, and are rendered with the same native view described above as Android/iOS native crashes. Dart exceptions are symbolicated by matching the build_id in the stack against uploaded Flutter symbol files. + For detailed symbol file upload procedures, see [Source Mapping](./source-mapping). diff --git a/en/rum/error-tracking/source-mapping.mdx b/en/rum/error-tracking/source-mapping.mdx index e8e9082b..4d9f8a10 100644 --- a/en/rum/error-tracking/source-mapping.mdx +++ b/en/rum/error-tracking/source-mapping.mdx @@ -10,6 +10,7 @@ Flashduty supports multi-platform symbol file uploading and source mapping, help - **HarmonyOS**: Upload the ArkTS `sourceMaps.map`, optional `nameCache.json`, and native `.so` symbol files through `@flashcatcloud/hvigor-plugin` - **Android**: Automatically upload ProGuard/R8 mapping files and NDK symbol files via a Gradle plugin - **iOS**: Upload dSYM symbol files via Flashduty CLI +- **Flutter**: Upload the Dart AOT symbol files (`.symbols`) generated by `--split-debug-info` via Flashduty CLI to restore obfuscated Dart exception stacks on Android; iOS native crashes use dSYMs, the same as standalone iOS apps Users can view uploaded symbol files in the "Application Management" - "Source Code Management" menu, and generate scripts through the upload panel to execute uploads locally. @@ -384,14 +385,64 @@ iOS apps generate dSYM (Debug Symbol) files during compilation, containing the d +## Upload Flutter Symbol Files + +When a Flutter app is built with `--obfuscate`, symbols in Dart exception stacks are stripped, leaving only address information. By uploading the Dart AOT symbol files (`app.-.symbols`) generated by `--split-debug-info`, Flashduty reads the ELF GNU build-id from each symbol file, matches it against the build ID carried in the stack, and restores Dart exception stacks on Android. Flutter symbol files are identified in the upload API by `event.type=flutter_symbol_file`. + + + + Enable obfuscation in the Android build and specify the symbol output directory: + + ```bash + flutter build apk --obfuscate --split-debug-info=./debug-symbols + ``` + + + In "Application Management" - "Source Code Management", switch to the "Flutter" tab and click "Upload Source Code". The upload panel generates the command from the form values. + + + Authenticates the upload request; corresponds to the `FLASHCAT_API_KEY` environment variable in the command. + + + + The symbol directory specified by `--split-debug-info`, e.g. `./debug-symbols`. + + + + Application service name, such as `my-app`. Keep it consistent with the `service` set at SDK initialization, so symbols are categorized by service in the console. + + + + Application release version, such as `1.0.0`. Keep it consistent with the `releaseVersion` set at SDK initialization. + + + + Run the generated command in the project root: + + ```bash + FLASHCAT_API_KEY=your-api-key flashcat-cli flutter-symbols upload ./debug-symbols \ + --service my-app \ + --release-version 1.0.0 + ``` + + + + +**Dart stack symbolication is not yet supported on iOS.** The `.symbols` files Flutter generates for iOS contain no build id ([flutter/flutter#138182](https://github.com/flutter/flutter/issues/138182)) and cannot be matched to a specific build, so do not enable `--obfuscate` for iOS builds — otherwise Dart stacks become unrecoverable. iOS native crashes (Objective-C / Swift / C / C++) are unaffected: upload dSYMs to symbolicate them, the same as a standalone iOS app. + + + +Symbol files are matched to crash events by build ID; `service` and `release-version` do not participate in symbolication and only affect categorization and filtering in the console list. Symbol files support the `arm`, `arm64`, and `x64` architectures, detected automatically from the `.symbols` filename. Every Dart code change produces a new build ID, so symbol upload must be part of every release build. For the full Flutter symbolication details, see [Flutter SDK Advanced Configuration](/en/rum/sdk/flutter/advanced-config). + + ## Symbol File Management On the Flashduty platform, symbol file management is done through the "Application Management" - "Source Code Management" menu: | Feature | Description | |---------|-------------| -| View Uploaded Symbol Files | List all uploaded files (SourceMaps, Mini Program SourceMaps, ProGuard mapping files, dSYMs, and NDK native symbol files), including path, service name, version, size, and upload time. The Android tab shows both ProGuard mapping files and NDK native symbol files; NDK rows display build_id, arch, and lib_name columns | -| Filter by Platform | Switch between Web, WeChat Mini Program, iOS, and Android tabs to view symbol files for each platform | +| View Uploaded Symbol Files | List all uploaded files (SourceMaps, Mini Program SourceMaps, ProGuard mapping files, dSYMs, NDK native symbol files, and Flutter symbol files), including path, service name, version, size, and upload time. The Android tab shows both ProGuard mapping files and NDK native symbol files; NDK rows display build_id, arch, and lib_name columns | +| Filter by Platform | Switch between Web, iOS, Android, WeChat Mini Program, HarmonyOS, and Flutter tabs to view symbol files for each platform | | Version Management | Manage different application versions separately through `service` and `release-version` parameters | | Mini Program Dimensions | The WeChat Mini Program list shows the AppID column (from `metadata.appid`) and the Subpackage column (from `metadata.subpackage`); the main package without a subpackage tag shows "Main Package", and an unspecified AppID shows `-` | | Permission Control | Ensure only authorized users can upload or manage through `API Key` | diff --git a/en/rum/quickstart/app-management.mdx b/en/rum/quickstart/app-management.mdx index 0e412381..36056010 100644 --- a/en/rum/quickstart/app-management.mdx +++ b/en/rum/quickstart/app-management.mdx @@ -36,7 +36,7 @@ You can quickly create an application through the RUM product guide page: -Select the frontend technology type corresponding to the application, currently supporting **JavaScript (JS), Android, iOS, and WeChat Mini Program**. +Select the frontend technology type corresponding to the application, currently supporting **JavaScript (JS), Android, iOS, HarmonyOS, Flutter, and WeChat Mini Program**. @@ -75,6 +75,7 @@ The console provides detailed integration guides for each platform: - **JavaScript (Web)**: After configuring parameters like service name, preview the `flashcatRum.init()` initialization code in real-time - **Android**: Shows complete integration steps including adding Gradle dependencies (`cloud.flashcat:dd-sdk-android-core` and `cloud.flashcat:dd-sdk-android-rum`), initializing the SDK in `Application.onCreate()` with RUM enabled, and optional WebView tracking integration - **iOS**: Shows complete integration steps including adding Swift Package Manager dependency (`fc-sdk-ios`, from version 0.3.0), initializing the SDK in `AppDelegate.didFinishLaunchingWithOptions` with RUM enabled, and optional WebView tracking integration +- **Flutter**: The Flutter SDK wraps the Android/iOS native SDKs, so one integration monitors both platforms. See [Flutter SDK Integration](/en/rum/sdk/flutter/sdk-integration) - **WeChat Mini Program**: Fill in `env`, `service`, `version`, and `sessionSampleRate` in the form, and the `flashcatRum.init()` snippet built on `@flashcatcloud/miniprogram-rum` is generated and previewed in real time (see "WeChat Mini Program SDK Configuration Assistant" below) Each platform's SDK configuration page automatically fills in the current application's `applicationId` and `clientToken`, so you can copy the code directly into your project. diff --git a/en/rum/session-replay/overview.mdx b/en/rum/session-replay/overview.mdx index 46f9c49c..94853d1e 100644 --- a/en/rum/session-replay/overview.mdx +++ b/en/rum/session-replay/overview.mdx @@ -92,6 +92,22 @@ Flashduty RUM's **Session Replay** feature is a powerful user behavior analysis +## Private Deployment: Replay Data Fetch Mode + +How the player fetches replay segments is controlled by the `rumReplayFetchMode` setting in `global.app_settings`, with two available modes: + +| Value | Description | +|-------|-------------| +| `url` | The server issues presigned object-storage URLs, and the browser downloads the replay segments directly | +| `segment` | The server reads and inflates the segments from object storage, then streams them to the browser; the browser never touches the object-storage address | + +- **SaaS deployment**: Always uses the `url` mode; no configuration needed. +- **Private deployment**: Defaults to `segment`, which works on any deployment. Presigned URLs are signed with the object storage's intranet endpoint by default, which the browser may not be able to reach. If your object storage exposes an extranet endpoint reachable from browsers, you can set `rumReplayFetchMode` to `url` so the browser fetches segments directly. + + +Seek operations during playback always fetch via the `segment` mode and are not affected by this setting. + + ## Next Steps diff --git a/zh/ai-sre/agents.mdx b/zh/ai-sre/agents.mdx index 37c721db..d8246a0f 100644 --- a/zh/ai-sre/agents.mdx +++ b/zh/ai-sre/agents.mdx @@ -77,7 +77,7 @@ A2A Agent 的列表与管理入口在 **插件 → Agents** 页面（菜单标 | 流式传输 | bool | 开 | 是否以流式方式与远端交互 | | 用户级认证模式 | enum | `shared` | 见下表「认证模式」 | | 跳过 TLS 证书校验 | bool | 关 | 仅当 Card URL 为 HTTPS 时显示。只在远端使用自签证书且网络受控时开启；开启后会跳过证书链和主机名校验 | -| 允许通过 HTTP 进行 OAuth 发现 | bool | 关 | 仅当选择「每用户 OAuth」且 Card URL 是非本地 HTTP 地址时需要确认。只用于受控测试环境；开启后 Safari 服务端会访问该主机的 OAuth metadata | +| 允许通过 HTTP 进行 OAuth 发现 | bool | 关 | 仅当选择「每用户 OAuth」且 Card URL 是非本地 HTTP 地址时需要确认。只用于受控测试环境；开启后 AI SRE 服务端会访问该主机的 OAuth metadata | ### 使用 FlashAI 模板 @@ -199,8 +199,8 @@ A2A Agent 的完整生命周期可在 **插件 → Agents** 页面管理。 从当前范围移除一个 A2A Agent。**委派给它的活跃会话将会失败。** 删除有确认提示。 - - 列表顶部的范围筛选条可在「全部」「仅账户级」「指定团队」之间切换，便于在大量资源中聚焦查看。每行还会以标签标注其范围（账户 / 团队名）。 + + 列表顶部的范围筛选条可在「全部」「仅账户级」「指定团队」之间切换，便于在大量资源中聚焦查看。每行还会以标签标注其范围（账户 / 团队名）。筛选条右侧的搜索框支持按名称、调用说明或 Card URL 中的关键词过滤列表。 diff --git a/zh/ai-sre/mcp.mdx b/zh/ai-sre/mcp.mdx index a5bf59e4..fbcacd39 100644 --- a/zh/ai-sre/mcp.mdx +++ b/zh/ai-sre/mcp.mdx @@ -164,7 +164,7 @@ OAuth 授权通过一个浏览器**中转页** `/oauth-callback` 完成：授权 --- -MCP 列表以表格展示每台服务器的**名称**（含 AI 描述）、**范围**（账户或团队名）、**传输方式**、**启用**开关与**操作**列——列表只包含您在账户中添加的 MCP 服务器；内置 Flashduty MCP 服务器由运行时自动注入，不出现在此列表中，详见下文「检视」小节。顶部的范围筛选条（ScopeBar）可在「全部 / 账户 / 团队」之间切换查看。 +MCP 列表以表格展示每台服务器的**名称**（含 AI 描述）、**范围**（账户或团队名）、**传输方式**、**启用**开关与**操作**列——列表只包含您在账户中添加的 MCP 服务器；内置 Flashduty MCP 服务器由运行时自动注入，不出现在此列表中，详见下文「检视」小节。顶部的范围筛选条（ScopeBar）可在「全部 / 账户 / 团队」之间切换查看；筛选条右侧的搜索框支持按名称、描述、传输方式、URL 等关键词过滤列表。 diff --git a/zh/ai-sre/sessions.mdx b/zh/ai-sre/sessions.mdx index bf03a84c..21ffcfb1 100644 --- a/zh/ai-sre/sessions.mdx +++ b/zh/ai-sre/sessions.mdx @@ -1,6 +1,6 @@ --- title: 控制台 -description: AI SRE 会话承载您与 Agent 的一次完整对话，包含消息、流式响应、工具调用与产物；本文介绍会话的新建与管理、消息发送、产物预览、会话 Fork、上下文压缩、团队绑定与会话数据导出。 +description: AI SRE 会话承载您与 Agent 的一次完整对话，包含消息、流式响应、工具调用与产物；本文介绍会话的新建与管理、分享、消息发送、产物预览、会话 Fork、上下文压缩、团队绑定与会话数据导出。 keywords: ["AI SRE", "会话", "对话", "流式响应", "工具调用", "Artifacts", "Fork", "上下文压缩", "绑定团队", "导出", "NDJSON"] sidebarTitle: 控制台 --- @@ -61,6 +61,24 @@ sidebarTitle: 控制台 置顶是个人偏好，不会修改会话本身；只要您有权读取这条会话，就可以为自己置顶或取消置顶。账户 Owner / 管理员可以管理团队会话，但不能读取或管理其他成员的个人会话。 +### 分享会话 + +聊天页头部提供分享入口，仅当您对当前会话有管理权限时显示。点击 **复制分享链接** 按钮即可开启分享并把链接复制到剪贴板（提示「分享链接已复制」）；链接在当前会话地址上附加 `share_token`，令牌位于 URL 片段（`#` 之后）中。分享链接是**稳定链接**：分享保持开启期间，重复复制得到的是同一条链接。 + +| 事项 | 说明 | +|---|---| +| 谁能分享 | 对会话有管理权限的成员——个人会话的创建者，或团队会话的创建者 / 账户 Owner / 管理员 / 团队成员 | +| 谁能打开 | 持有链接、且登录了**同一账户**的成员；链接不跨账户，也不支持匿名访问 | +| 持链接者看到什么 | 会话以**只读**模式打开，对话区提示「这是一个只读分享会话」：可查看完整上下文（消息、工具调用、产物），但输入框被只读提示替换，不能继续对话或修改原会话 | +| 如何继续排查 | 持链接者可点击 **Fork 为新会话**，把会话派生为自己的新会话后继续处理 | +| 如何撤销 | 分享开启后头部出现 **取消分享** 按钮，点击后链接立即失效（提示「分享已取消」）；之后重新开启分享会生成新链接，旧链接不会恢复可用 | + +分享主要改变**个人会话**的可见性：团队会话本来就允许同账户成员凭会话 ID 读取（见上表），而个人会话默认只有创建者可见，分享链接是同账户其他成员打开它的唯一方式。 + + +隐身（incognito）会话与 Subagent 子会话不支持分享。 + + ### 单条会话操作 将鼠标悬停在会话行上，会显示置顶与归档操作；置顶的会话在名称左侧常驻一个图钉标记。 diff --git a/zh/ai-sre/skills.mdx b/zh/ai-sre/skills.mdx index 850776ea..80cf409d 100644 --- a/zh/ai-sre/skills.mdx +++ b/zh/ai-sre/skills.mdx @@ -160,7 +160,7 @@ Skill 归档大小有上限：通过对话中 Agent 打包保存的归档上限 --- -Skill 列表以表格展示每个 Skill 的**名称**（含来源模板角标与「有更新」标记）、**范围**（账户或团队）、**版本**、**启用**开关与**操作**列。 +Skill 列表以表格展示每个 Skill 的**名称**（含来源模板角标与「有更新」标记）、**范围**（账户或团队）、**版本**、**启用**开关与**操作**列。列表上方的工具条提供范围筛选（全部 / 账户 / 团队）与搜索框，搜索按名称、描述或作者中的关键词过滤列表。 diff --git a/zh/monitors/alert-rules/clickhouse.mdx b/zh/monitors/alert-rules/clickhouse.mdx index 6a4896e2..887f45d7 100644 --- a/zh/monitors/alert-rules/clickhouse.mdx +++ b/zh/monitors/alert-rules/clickhouse.mdx @@ -31,15 +31,14 @@ Monitors 支持使用标准 SQL 语法对 ClickHouse 进行查询，并根据查 GROUP BY service_name ``` 2. **字段映射**： - - **标签字段**：用于区分不同告警对象的字段。上例中为 `service_name`。该字段可留空，Monitors 会自动把除了值字段外的所有字段都作为标签字段。 - - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。 + - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。Monitors 会自动将查询结果中除值字段外的字段作为标签（上例中为 `service_name`）。 3. **阈值条件**： - 使用 `$A.field_name` 引用数值。 - 示例：`Critical: $A.error_cnt > 50`，`Warning: $A.error_cnt > 10`。 ### 工作原理 -引擎执行 SQL 查询，获取结果集。根据"标签字段"将数据分组，然后提取"值字段"的数值与阈值表达式进行比对。 +引擎执行 SQL 查询，获取结果集。自动将除值字段外的字段作为标签对数据进行分组，然后提取"值字段"的数值与阈值表达式进行比对。 ### 恢复逻辑 @@ -114,6 +113,6 @@ ClickHouse 对时间分区非常敏感，务必在 `WHERE` 子句中包含时间 -Monitors 引擎会将 ClickHouse 返回的列名统一转为小写。在填写"标签字段"和"值字段"时，请始终使用小写字母。 +Monitors 引擎会将 ClickHouse 返回的列名统一转为小写。在填写"值字段"时，请始终使用小写字母。 diff --git a/zh/monitors/alert-rules/mysql.mdx b/zh/monitors/alert-rules/mysql.mdx index f5ab1fac..3613a6bc 100644 --- a/zh/monitors/alert-rules/mysql.mdx +++ b/zh/monitors/alert-rules/mysql.mdx @@ -31,15 +31,14 @@ Monitors 支持使用标准 SQL 语法对 MySQL 进行查询，并根据查询 GROUP BY service_name ``` 2. **字段映射**： - - **标签字段**：用于区分不同告警对象的字段。上例中为 `service_name`。该字段可以留空，Monitors 会自动把除了值字段外的所有字段都作为标签字段。 - - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。 + - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。Monitors 会自动将查询结果中除值字段外的字段作为标签（上例中为 `service_name`）。 3. **阈值条件**： - 使用 `$A.field_name` 引用数值。 - 示例：`Critical: $A.error_cnt > 50`，`Warning: $A.error_cnt > 10`。 ### 工作原理 -引擎执行 SQL 查询，获取结果集。根据"标签字段"将数据分组，然后提取"值字段"的数值与阈值表达式进行比对。 +引擎执行 SQL 查询，获取结果集。自动将除值字段外的字段作为标签对数据进行分组，然后提取"值字段"的数值与阈值表达式进行比对。 ### 恢复逻辑 @@ -106,6 +105,6 @@ Monitors 支持使用标准 SQL 语法对 MySQL 进行查询，并根据查询 -Monitors 引擎会将 MySQL 返回的列名统一转为小写。在填写"标签字段"和"值字段"时，请始终使用小写字母。 +Monitors 引擎会将 MySQL 返回的列名统一转为小写。在填写"值字段"时，请始终使用小写字母。 diff --git a/zh/monitors/alert-rules/oracle.mdx b/zh/monitors/alert-rules/oracle.mdx index f3cbd8c2..5329449e 100644 --- a/zh/monitors/alert-rules/oracle.mdx +++ b/zh/monitors/alert-rules/oracle.mdx @@ -31,15 +31,14 @@ Monitors 支持使用标准 SQL 语法对 Oracle 进行查询，并根据查询 GROUP BY service_name ``` 2. **字段映射**： - - **标签字段**：用于区分不同告警对象的字段。上例中为 `service_name`。该字段可以留空，Monitors 会自动把除了值字段外的所有字段都作为标签字段。 - - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。 + - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。Monitors 会自动将查询结果中除值字段外的字段作为标签（上例中为 `service_name`）。 3. **阈值条件**： - 使用 `$A.field_name` 引用数值。 - 示例：`Critical: $A.error_cnt > 50`，`Warning: $A.error_cnt > 10`。 ### 工作原理 -引擎执行 SQL 查询，获取结果集。根据"标签字段"将数据分组，然后提取"值字段"的数值与阈值表达式进行比对。 +引擎执行 SQL 查询，获取结果集。自动将除值字段外的字段作为标签对数据进行分组，然后提取"值字段"的数值与阈值表达式进行比对。 ### 恢复逻辑 @@ -106,6 +105,6 @@ Monitors 支持使用标准 SQL 语法对 Oracle 进行查询，并根据查询 -Monitors 引擎会将 Oracle 返回的列名统一转为小写。在填写"标签字段"和"值字段"时，请始终使用小写字母。 +Monitors 引擎会将 Oracle 返回的列名统一转为小写。在填写"值字段"时，请始终使用小写字母。 diff --git a/zh/monitors/alert-rules/postgres.mdx b/zh/monitors/alert-rules/postgres.mdx index 50b6a7f8..81319fb4 100644 --- a/zh/monitors/alert-rules/postgres.mdx +++ b/zh/monitors/alert-rules/postgres.mdx @@ -31,15 +31,14 @@ Monitors 支持使用标准 SQL 语法对 PostgreSQL 进行查询，并根据查 GROUP BY service_name ``` 2. **字段映射**： - - **标签字段**：用于区分不同告警对象的字段。上例中为 `service_name`。该字段可以留空，Monitors 会自动把除了值字段外的所有字段都作为标签字段。 - - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。 + - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。Monitors 会自动将查询结果中除值字段外的字段作为标签（上例中为 `service_name`）。 3. **阈值条件**： - 使用 `$A.field_name` 引用数值。 - 示例：`Critical: $A.error_cnt > 50`，`Warning: $A.error_cnt > 10`。 ### 工作原理 -引擎执行 SQL 查询，获取结果集。根据"标签字段"将数据分组，然后提取"值字段"的数值与阈值表达式进行比对。 +引擎执行 SQL 查询，获取结果集。自动将除值字段外的字段作为标签对数据进行分组，然后提取"值字段"的数值与阈值表达式进行比对。 ### 恢复逻辑 @@ -106,6 +105,6 @@ Monitors 支持使用标准 SQL 语法对 PostgreSQL 进行查询，并根据查 -Monitors 引擎会将 PostgreSQL 返回的列名统一转为小写。在填写"标签字段"和"值字段"时，请始终使用小写字母。 +Monitors 引擎会将 PostgreSQL 返回的列名统一转为小写。在填写"值字段"时，请始终使用小写字母。 diff --git a/zh/monitors/alert-rules/sls.mdx b/zh/monitors/alert-rules/sls.mdx index efabc9f0..0f5f614d 100644 --- a/zh/monitors/alert-rules/sls.mdx +++ b/zh/monitors/alert-rules/sls.mdx @@ -32,15 +32,14 @@ Monitors 通过 SLS 的 SQL 查询接口（GetLogsV3）获取数据，并根据 - `sls.timespan.value`：（选填）时间跨度数值，默认为 15。 - `sls.timespan.unit`：（选填）时间跨度单位，支持 `s`（秒）、`m`（分）、`h`（时）、`d`（天）。默认为 `m`。 3. **字段映射**： - - **标签字段**：用于区分不同告警对象的字段。上例中为 `host`。该字段可以留空，Monitors 会自动把除了值字段外的所有字段都作为标签字段。 - - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。 + - **值字段**：用于阈值判定的数值字段。上例中为 `error_cnt`。Monitors 会自动将查询结果中除值字段外的字段作为标签（上例中为 `host`）。 4. **阈值条件**： - 使用 `$A.field_name` 引用数值。 - 示例：`Critical: $A.error_cnt > 50`，`Warning: $A.error_cnt > 10`。 ### 工作原理 -引擎调用 SLS API，指定时间范围（如最近 15 分钟），执行 SQL 查询。获取结果后，根据"标签字段"分组，提取"值字段"与阈值比对。 +引擎调用 SLS API，指定时间范围（如最近 15 分钟），执行 SQL 查询。获取结果后，自动将除值字段外的字段作为标签进行分组，提取"值字段"与阈值比对。 ### 恢复逻辑 diff --git a/zh/monitors/alert-rules/victorialogs.mdx b/zh/monitors/alert-rules/victorialogs.mdx index 6e95ba1e..0b9cf19d 100644 --- a/zh/monitors/alert-rules/victorialogs.mdx +++ b/zh/monitors/alert-rules/victorialogs.mdx @@ -19,7 +19,6 @@ Monitors 通过 HTTP 查询 VictoriaLogs，支持查询日志原文、做统计 | 查询语句 | 如 `error \| fields _time, _stream, _msg \| sort by (_time) desc` | | 返回条目限制 | 限制最大返回行数，最大可设置为 100 | | 时间范围 | 指定查询的时间窗口，例如"最近 5 分钟" | -| 标签字段 | 用于区分不同告警实体，可配置多个 | | 值字段 | 阈值判定模式下必填 | @@ -58,7 +57,7 @@ level:ERROR | stats by (level) count(*) total |-------|-------| | ERROR | 150 | -值字段配置为 `total`，标签字段配置为 `level`（或不配置，Monitors 会自动识别）。不同阈值不同级别的配置示例： +值字段配置为 `total`，Monitors 会自动将除值字段外的字段（上例中为 `level`）识别为标签。不同阈值不同级别的配置示例： - Warning：`$A.total >= 50` 或者简写为 `$A >= 50`（因为只有 total 这一个值字段） - Critical：`$A.total >= 100` 或者简写为 `$A >= 100`（因为只有 total 这一个值字段） diff --git a/zh/monitors/data-sources/data-sources.mdx b/zh/monitors/data-sources/data-sources.mdx index e8d80a06..d507748b 100644 --- a/zh/monitors/data-sources/data-sources.mdx +++ b/zh/monitors/data-sources/data-sources.mdx @@ -82,9 +82,11 @@ Monitors 支持以下 9 种数据源类型： | **Headers** | 自定义 HTTP 请求头，支持添加多组 Key-Value | | **Params** | 自定义 URL 查询参数，支持添加多组 Key-Value | | **Basic Authentication** | 启用后需填写用户名和密码 | -| **Self-Signed Certificate** | 启用后填写 CA 证书内容 | -| **TLS Client Authentication** | 启用后需填写 ServerName、客户端证书和客户端密钥 | -| **Skip TLS Certificate Validation** | 跳过 TLS 证书验证 | +| **使用自定义 CA 证书** | 勾选后填写 CA 证书内容；留空时使用告警引擎所在操作系统的系统信任库 | +| **启用客户端证书认证（mTLS）** | 勾选后填写客户端证书和客户端私钥，两者必须成对填写 | +| **服务端名称（可选）** | 用于 SNI 和证书主机名校验；留空时从连接地址推断 | +| **最低 / 最高 TLS 版本** | 可选 TLS 1.0、1.1、1.2、1.3，默认为系统默认；最低版本不得高于最高版本 | +| **跳过服务端证书校验** | 勾选后不校验服务端证书 | ### MySQL / Oracle / PostgreSQL @@ -100,7 +102,36 @@ Monitors 支持以下 9 种数据源类型： | **用户名** | 数据库用户名 | - | | **密码** | 数据库密码 | - | -同样支持自签名证书和 TLS 客户端认证配置。 +Oracle 仅使用上述基础连接配置。MySQL 和 PostgreSQL 额外支持 TLS/SSL 加密连接，通过 **TLS/SSL 模式** 下拉框选择。 + +#### MySQL 的 TLS/SSL 模式 + +| 模式 | 说明 | +|------|------| +| **不启用 TLS**（disable） | 连接不经过 TLS 加密 | +| **加密连接，不校验证书**（require） | 强制使用 TLS 加密，但不验证数据库服务器身份；该模式下不允许配置自定义 CA 证书 | +| **校验证书和主机名**（verify-full，推荐） | 验证服务端证书的签发机构，并校验证书中的主机名；该模式下可配置自定义 CA 证书 | + +选择非「不启用 TLS」模式后，还可以启用客户端证书认证（mTLS，客户端证书和客户端私钥需成对填写）、填写服务端名称，以及设置最低 / 最高 TLS 版本。选择「校验证书和主机名」模式时，连接地址建议填写与服务端证书匹配的数据库域名，不要使用 IP 地址。 + + +设置非「不启用 TLS」模式时，关联告警引擎集群内所有已注册的 Edge 实例必须为 v0.51.0 或更高版本。 + + +#### PostgreSQL 的 TLS/SSL 模式 + +| 模式 | 说明 | +|------|------| +| **不启用 TLS**（disable） | 连接不经过 TLS 加密 | +| **加密连接，不校验证书**（require） | 强制使用 TLS 加密，但不验证数据库服务器身份；该模式下不允许配置自定义 CA 证书 | +| **校验证书颁发机构**（verify-ca） | 验证服务端证书是否由可信的证书颁发机构签发，但不校验证书中的主机名 | +| **校验证书和主机名**（verify-full，推荐） | 验证服务端证书的签发机构，并校验证书中的主机名是否与连接地址一致 | + +在「校验证书颁发机构」和「校验证书和主机名」模式下可选填自定义 CA 证书，留空时使用告警引擎所在操作系统的系统信任库；非「不启用 TLS」模式下均可启用客户端证书认证（mTLS）。选择「校验证书和主机名」模式时，连接地址请填写与服务端证书匹配的数据库域名，不要使用 IP 地址。 + + +设置非「不启用 TLS」模式时，关联告警引擎集群内所有已注册的 Edge 实例必须为 v0.50.0 或更高版本。 + ### Elasticsearch / Loki / ClickHouse / SLS / VictoriaLogs diff --git a/zh/monitors/quickstart/quickstart.mdx b/zh/monitors/quickstart/quickstart.mdx index 2ed27544..5d368daf 100644 --- a/zh/monitors/quickstart/quickstart.mdx +++ b/zh/monitors/quickstart/quickstart.mdx @@ -97,10 +97,6 @@ Monitors 支持一个规则生效到多个数据源，提供两种绑定方式 配置如何查询数据源及如何判定告警条件。请阅读页面上 **查询检测方式** 右侧的使用说明。 -| 配置项 | 说明 | -|--------|------| -| **查询偏移** | 设置查询时间偏移量（秒），用于处理数据源存在采集延迟的场景。例如设置为 60，则查询窗口整体向前偏移 60 秒，确保数据已完成写入后再查询 | - ### 检测频率与生效时间 ![检测频率 & 生效时间](https://docs-cdn.flashcat.cloud/imges/mon/0980d71a653985a1706243fc6795685e.png) @@ -108,6 +104,7 @@ Monitors 支持一个规则生效到多个数据源，提供两种绑定方式 | 配置项 | 说明 | |--------|------| | **检测频率** | 通常是周期性检测，也支持 `cron` 表达式（精确到秒） | +| **查询时间偏移** | 设置查询时间偏移量（秒），用于处理数据源存在采集延迟的场景。例如设置为 60，则查询窗口整体向前偏移 60 秒，确保数据已完成写入后再查询。仅适用于 Prometheus、Loki、VictoriaLogs、SLS 数据源 | | **规则时区** | 告警规则的执行时区，决定 `cron` 调度时间和**生效时间**窗口的解释方式。默认 `Asia/Shanghai`，必须填写有效的 IANA 时区名（如 `Asia/Shanghai`、`UTC`、`Europe/London`、`America/New_York`） | | **生效时间** | 告警规则的生效时间段，非生效时间段内不会触发告警；时间窗口按上面配置的**规则时区**计算 | @@ -167,7 +164,7 @@ Monitors 支持一个规则生效到多个数据源，提供两种绑定方式 | **检测频率** | 统一调整检测周期 | | **规则时区** | 统一切换告警规则的 IANA 时区 | | **生效时间** | 统一配置生效时间段 | -| **查询延迟** | 统一设置查询延迟时间 | +| **查询时间偏移** | 统一设置查询时间偏移。仅当所有选中规则的数据源都支持查询时间偏移（Prometheus、Loki、VictoriaLogs、SLS）时才可批量更新，否则该项禁用 | | **自定义字段** | 统一配置 annotations | | **协作空间** | 统一指定告警投递的协作空间 | | **重复发送配置** | 统一设置重复通知间隔和次数 | diff --git a/zh/on-call/integration/sso/authing.mdx b/zh/on-call/integration/sso/authing.mdx index 58c2a596..363b9ddd 100644 --- a/zh/on-call/integration/sso/authing.mdx +++ b/zh/on-call/integration/sso/authing.mdx @@ -71,7 +71,7 @@ keywords: ["Authing", "SSO", "OIDC", "SAML", "单点登录"] ### 4. 创建用户并测试登录 -Flashduty 只支持用户邮箱关联，所以需要用邮箱创建用户。 +Flashduty 默认通过邮箱关联成员，建议用邮箱创建用户。新建 SSO 配置也可以配置稳定用户 ID 字段进行关联，详见 [单点登录配置](/zh/platform/configure-sso)。 在 Authing 中创建用户： @@ -169,7 +169,7 @@ SSO 地址跳转到登录页面后，使用在 Authing 创建的用户登录 Fla ### 4. 创建用户并测试登录 -Flashduty 只支持用户邮箱关联，所以需要用邮箱创建用户。 +Flashduty 默认通过邮箱关联成员，建议用邮箱创建用户。新建 SSO 配置也可以配置稳定用户 ID 字段进行关联，详见 [单点登录配置](/zh/platform/configure-sso)。 在 Authing 中创建用户： diff --git a/zh/platform/configure-sso.mdx b/zh/platform/configure-sso.mdx index 84accaaa..20776e8b 100644 --- a/zh/platform/configure-sso.mdx +++ b/zh/platform/configure-sso.mdx @@ -17,6 +17,7 @@ Flashduty 支持 SAML2.0、OIDC、CAS 和 LDAP（仅私有化版本）协议的 | 协议类型 | 选择 SAML2.0 | | 元数据文档 | 通过身份提供商获取的 XML 文档 | | 字段映射 | Flashduty 通过映射字段从身份提供商提取用户邮箱、用户名和手机信息 | +| 稳定用户 ID 字段（`user_id`） | 身份提供商返回的用户唯一标识属性，用于识别同一成员，邮箱或手机号变更不影响识别。建议值为 `employee_id`；填写 `name_id` 时取 SAML 断言中的 NameID（Subject）。详见下文 [成员关联方式](#成员关联方式) | | 登录即创建账号 | 默认开启，关闭后需要先邀请成员才可登录 | | 成员仅支持 SSO 登录（`force_sso`） | 默认开启。开启后，账户内所有成员仅能通过 SSO 登录，密码与验证码登录将被拒绝。详见下文 [强制 SSO 登录](#强制-sso-登录) | | Flashduty 服务提供商信息 | **Service Provider Metadata** 和 **Assertion Consumer Service URL**（断言地址，用于身份提供商调用进行单点登录） | @@ -34,6 +35,7 @@ Flashduty 支持 SAML2.0、OIDC、CAS 和 LDAP（仅私有化版本）协议的 | Client ID | 客户端 ID，从身份提供商获取 | | Client Secret | 客户端密钥，从身份提供商获取 | | 字段映射 | Flashduty 通过映射字段从身份提供商提取用户邮箱、用户名和手机信息 | +| 稳定用户 ID 字段（`user_id`） | 用于识别同一成员的用户唯一标识 Claim，邮箱或手机号变更不影响识别，建议值为 `sub`。详见下文 [成员关联方式](#成员关联方式) | | 登录即创建账号 | 默认开启，关闭后需要先邀请成员才可登录 | | 成员仅支持 SSO 登录（`force_sso`） | 默认开启。开启后，账户内所有成员仅能通过 SSO 登录，密码与验证码登录将被拒绝。详见下文 [强制 SSO 登录](#强制-sso-登录) | | Scopes | 指定请求可访问的信息和功能权限，支持自定义。默认值为 `openid`、`profile`、`email`、`phone`，支持以标签形式添加自定义 Scope | @@ -56,6 +58,7 @@ Scopes 为必填字段。默认值 `openid`、`profile`、`email`、`phone` 是 | CAS 登录路径 | CAS 登录路径，如 `/login` | | 跳过 TLS 检查 | 可选项，启用后将跳过 TLS 证书验证，适用于使用自签名证书的 CAS 服务 | | 字段映射 | Flashduty 通过映射字段从身份提供商提取用户邮箱、用户名和手机信息 | +| 稳定用户 ID 字段（`user_id`） | 用于识别同一成员的用户唯一标识，邮箱或手机号变更不影响识别。建议值为 `principal`（即 CAS 认证用户名），也可配置为 CAS 返回的某个属性。详见下文 [成员关联方式](#成员关联方式) | | 登录即创建账号 | 默认开启，关闭后需要先邀请成员才可登录 | | 成员仅支持 SSO 登录（`force_sso`） | 默认开启。开启后，账户内所有成员仅能通过 SSO 登录，密码与验证码登录将被拒绝。详见下文 [强制 SSO 登录](#强制-sso-登录) | | Flashduty 服务提供商信息 | **Redirect URL**：身份提供商回调地址 | @@ -80,6 +83,7 @@ LDAP 单点登录仅**私有化版本**支持。 | 用户 DN | 定义从哪个目录开始搜索用户，如：`ou=people,dc=flashduty,dc=com` | | 认证过滤 | 用于检索用户 DN 信息的自定义 filter 表达式，基本形式为：`(&(mail=%s))`。注意：开始和结束的括号是必须的 | | 字段映射 | Flashduty 通过映射字段从身份提供商提取用户邮箱、用户名、手机和 Group 信息。邮箱为必填映射字段，Group 字段默认值为 `memberOf`，用于角色和团队同步 | +| 稳定用户 ID 字段（`user_id`） | 用于识别同一成员的用户唯一标识属性，邮箱或手机号变更不影响识别。建议值为 `uid`，也可使用 `entryUUID` 等稳定属性。详见下文 [成员关联方式](#成员关联方式) | | 登录即创建账号 | 默认开启，关闭后需要先邀请成员才可登录 | | 成员仅支持 SSO 登录（`force_sso`） | 默认开启。开启后，账户内所有成员仅能通过 SSO 登录，密码与验证码登录将被拒绝。详见下文 [强制 SSO 登录](#强制-sso-登录) | @@ -125,6 +129,25 @@ LDAP 单点登录仅**私有化版本**支持。 - 映射规则中的 Group DN 必须是 LDAP 中 Group 的完整路径 +## 成员关联方式 + +--- + +单点登录时，系统需要将身份提供商返回的用户与账户内成员进行关联，关联方式取决于 SSO 配置是否设置了**稳定用户 ID 字段**： + +| 配置 | 关联方式 | +| --- | --- | +| 新建 SSO 配置（已配置稳定用户 ID 字段） | 按身份提供商返回的稳定用户 ID 识别同一成员，成员邮箱或手机号变更不影响识别。稳定用户 ID 尚未绑定时，系统会先通过邮箱或手机号匹配既有成员，并建立稳定用户 ID 绑定 | +| 既有 SSO 配置（未配置稳定用户 ID 字段） | 继续按邮箱或手机号关联成员，行为保持不变 | + + +请确保身份提供商始终返回稳定且唯一的用户 ID。映射失败（身份提供商未返回该字段）将导致成员无法登录。 + + + +修改身份域相关设置（协议类型、身份提供商地址或稳定用户 ID 字段）会被视为身份域变更，系统将轮换 SSO 配置 ID。既有成员会在下次登录时通过邮箱或手机号重新关联，并绑定新的稳定用户 ID。 + + ## 强制 SSO 登录 --- diff --git a/zh/rum/analytics/native.mdx b/zh/rum/analytics/native.mdx index 3c35372b..32e96cc0 100644 --- a/zh/rum/analytics/native.mdx +++ b/zh/rum/analytics/native.mdx @@ -10,6 +10,15 @@ Flashduty Native RUM 分析看板提供开箱即用的可视化仪表板，自 分析看板包含 4 个核心分析维度：**概览**、**性能分析**、**异常分析**、**资源分析** + +**平台差异** + +Native 看板适用于 Android、iOS、HarmonyOS 和 Flutter 应用，不同平台存在以下差异： + +- **Flutter**：一个 Flutter 应用同时覆盖 Android 和 iOS 两端，筛选栏会额外常驻 `os_name` 筛选项，便于按设备系统切片分析；概览与异常分析中，**ANR 率**（来自 Android 设备）与 **App Hang 率**（来自 iOS 设备）两张卡片并列展示。 +- **HarmonyOS**：SDK 暂未上报性能与卡顿指标，因此不展示卡顿相关卡片，也不提供「性能」页签。 + + ## 概览 — 关键指标一目了然 @@ -465,11 +474,15 @@ Flashduty RUM 通常在数据产生后的 **1-3 分钟**内完成采集和展示 | 指标 | 采集字段 | 说明 | |------|---------|------| -| UV | usr_id | 去重后的用户总数 | +| UV | usr_anonymous_id / usr_id | 去重后的用户总数，详见下方口径说明 | | 会话数 | session_id | 应用被打开使用的总会话数量 | | 会话平均时长 | - | 会话总时长除以会话总数 | | 使用频次 | - | 会话总数除以活跃用户数 | + +**UV 口径说明**：Native（Android/iOS/HarmonyOS/Flutter）看板与应用卡片的 UV 以设备稳定的匿名 ID 为口径，即 `COUNT(DISTINCT COALESCE(NULLIF(usr_anonymous_id, ''), NULLIF(usr_id, '')))`。匿名 ID 在用户登录后保持不变，因此匿名会话与同一用户后续的登录会话会计为同一用户；未开启匿名用户追踪时回退为 `usr_id` 口径。Web 与小程序看板保持 `usr_id` 口径不变。 + + ### 性能指标阈值 | 指标 | 采集字段 | 良好 | 中等 | 差 | diff --git a/zh/rum/error-tracking/error-aggregation.mdx b/zh/rum/error-tracking/error-aggregation.mdx index c546b6c6..0ce46af3 100644 --- a/zh/rum/error-tracking/error-aggregation.mdx +++ b/zh/rum/error-tracking/error-aggregation.mdx @@ -20,6 +20,8 @@ keywords: ["RUM", "异常追踪", "用户监控", "前端监控"] **Android NDK 原生崩溃例外：** NDK 原生崩溃（`source_type` 含 `ndk` 或堆栈中存在应用层原生帧）会跳过此步骤的机器学习相似度分析，完全依赖步骤一的确定性指纹进行聚合。这是因为 NDK 崩溃的错误消息（如 `signal: SIGSEGV`）几乎完全相同，若走相似度分析会将来自不同代码位置的崩溃错误地合并为同一 Issue；而帧感知指纹能够精确区分不同的崩溃点。 + + **Flutter 原生崩溃按真实平台处理：** Flutter 应用上报的原生崩溃 `source` 为 `flutter`，聚合时会按 `source_type`（`ndk`、`android`、`ios`）解析出真实平台。其中 `source_type` 为 `ndk`（或堆栈中存在应用层原生帧）的崩溃与 Android NDK 崩溃一致，同样跳过机器学习相似度分析、使用原生帧指纹聚合；`source_type` 为 `ios` 的崩溃仍走消息指纹，与独立 iOS 应用的行为相同。 diff --git a/zh/rum/error-tracking/error-viewing.mdx b/zh/rum/error-tracking/error-viewing.mdx index 9b37892e..fb53b99f 100644 --- a/zh/rum/error-tracking/error-viewing.mdx +++ b/zh/rum/error-tracking/error-viewing.mdx @@ -174,7 +174,7 @@ Issue 列表支持两种查看模式：侧栏模式和全屏模式。默认以 默认展示当前 Issue 发生期间最近一次上报的错误信息作为错误样例，您也可通过导航条进行切换。 - 查看错误的上下文信息和堆栈信息。如果已上传对应的 SourceMap、Android mapping 文件或 iOS dSYM 文件，您可以看到映射还原后的原始源码位置和代码片段。 + 查看错误的上下文信息和堆栈信息。如果已上传对应的 SourceMap、Android mapping 文件、iOS dSYM 文件或 Flutter 符号文件，您可以看到映射还原后的原始源码位置和代码片段。 错误堆栈 @@ -207,6 +207,10 @@ Issue 列表支持两种查看模式：侧栏模式和全屏模式。默认以 对于 iOS 崩溃，还可以查看崩溃时加载的 Binary Images（二进制镜像）列表，包含镜像名称、地址范围和 UUID 等信息，用于辅助离线符号化分析。 + **Flutter 支持** + + Flutter 原生崩溃（`source_type` 为 `ndk`、`android` 或 `ios`）携带线程堆栈和 Binary Images，与 Android/iOS 原生崩溃一样使用上述 Native 渲染展示；Dart 异常则按堆栈中的 build_id 匹配已上传的 Flutter 符号文件，进行符号化还原。 + 详细的符号文件上传流程请参阅 [源码映射](./source-mapping)。 diff --git a/zh/rum/error-tracking/source-mapping.mdx b/zh/rum/error-tracking/source-mapping.mdx index 25f8baf1..fe5d97d1 100644 --- a/zh/rum/error-tracking/source-mapping.mdx +++ b/zh/rum/error-tracking/source-mapping.mdx @@ -11,6 +11,7 @@ Flashduty 支持多平台的符号文件上传与源码映射，帮助开发者 - **HarmonyOS**：通过 `@flashcatcloud/hvigor-plugin` 上传 ArkTS `sourceMaps.map`、可选 `nameCache.json` 和 Native `.so` 符号文件 - **Android**：通过 Gradle 插件自动上传 ProGuard/R8 mapping 文件和 NDK 符号文件 - **iOS**：通过 Flashduty CLI 上传 dSYM 符号文件 +- **Flutter**：通过 Flashduty CLI 上传 `--split-debug-info` 生成的 Dart AOT 符号文件（`.symbols`），还原 Android 上混淆后的 Dart 异常堆栈；iOS 原生崩溃与原生 iOS 应用一样走 dSYM 用户可在「应用管理」-「源码管理」菜单查看已上传的符号文件，并通过上传面板生成脚本在本地执行上传操作。 @@ -385,14 +386,64 @@ iOS 应用在编译时会生成 dSYM（Debug Symbol）文件，其中包含将 +## 上传 Flutter 符号文件 + +Flutter 应用使用 `--obfuscate` 混淆构建后，Dart 异常堆栈中的符号会被剥离，只剩地址信息。通过上传 `--split-debug-info` 生成的 Dart AOT 符号文件（`app.-.symbols`），Flashduty 会读取符号文件的 ELF GNU build-id，与堆栈中携带的 build ID 匹配，还原 Android 上的 Dart 异常堆栈。Flutter 符号文件在上传 API 中以 `event.type=flutter_symbol_file` 标识。 + + + + Android 构建时开启混淆并指定符号输出目录： + + ```bash + flutter build apk --obfuscate --split-debug-info=./debug-symbols + ``` + + + 在「应用管理」-「源码管理」菜单切换到「Flutter」标签页，点击「上传源码」。上传面板会根据表单内容生成命令。 + + + 用于认证上传请求，对应命令中的 `FLASHCAT_API_KEY` 环境变量。 + + + + `--split-debug-info` 指定的符号目录，例如 `./debug-symbols`。 + + + + 应用的服务名，例如 `my-app`。建议与 SDK 初始化时设置的 `service` 保持一致，便于在控制台按服务归类筛选。 + + + + 应用的发布版本，例如 `1.0.0`。建议与 SDK 初始化时设置的 `releaseVersion` 保持一致。 + + + + 在项目根目录下运行生成的命令： + + ```bash + FLASHCAT_API_KEY=your-api-key flashcat-cli flutter-symbols upload ./debug-symbols \ + --service my-app \ + --release-version 1.0.0 + ``` + + + + +**iOS 的 Dart 堆栈暂不支持符号化。** Flutter 为 iOS 生成的 `.symbols` 不包含 build id（[flutter/flutter#138182](https://github.com/flutter/flutter/issues/138182)），无法与具体构建对应，因此 iOS 构建请勿开启 `--obfuscate`，否则 Dart 堆栈将无法还原。iOS 原生崩溃（Objective-C / Swift / C / C++）不受影响，与原生 iOS 应用一样上传 dSYM 即可符号化。 + + + +符号文件与崩溃事件通过 build ID 匹配，`service` 与 `release-version` 不参与解析，仅影响控制台列表的归类与筛选。符号文件支持 `arm`、`arm64`、`x64` 架构，由 `.symbols` 文件名自动识别。每次改动 Dart 代码都会生成新的 build ID，因此符号上传必须纳入每一次发布构建。更完整的 Flutter 符号化说明请参阅 [Flutter SDK 高级配置](/zh/rum/sdk/flutter/advanced-config)。 + + ## 符号文件管理 在 Flashduty 平台上，符号文件的管理通过「应用管理」-「源码管理」菜单完成： | 功能 | 说明 | |------|------| -| 查看已上传的符号文件 | 列出所有已上传的文件（SourceMap、小程序 SourceMap、ProGuard mapping 文件、dSYM、NDK 原生符号文件），包括路径、服务名、版本号、大小和上传时间。Android 标签页同时展示 ProGuard mapping 文件和 NDK 原生符号文件，NDK 行会显示 build_id、arch 和 lib_name 列 | -| 按平台筛选 | 在 Web、微信小程序、iOS 和 Android 标签页之间切换，查看不同平台的符号文件 | +| 查看已上传的符号文件 | 列出所有已上传的文件（SourceMap、小程序 SourceMap、ProGuard mapping 文件、dSYM、NDK 原生符号文件、Flutter 符号文件），包括路径、服务名、版本号、大小和上传时间。Android 标签页同时展示 ProGuard mapping 文件和 NDK 原生符号文件，NDK 行会显示 build_id、arch 和 lib_name 列 | +| 按平台筛选 | 在 Web、iOS、Android、微信小程序、HarmonyOS 和 Flutter 标签页之间切换，查看不同平台的符号文件 | | 版本管理 | 通过 `service` 和 `release-version` 参数为不同版本的应用分别管理 | | 小程序维度 | 微信小程序列表会展示符号文件元数据中的 AppID（取自 `metadata.appid`）和分包（取自 `metadata.subpackage`）两列；主包没有分包标识时显示「主包」，AppID 未上传时显示 `-` | | 权限控制 | 通过 `API Key` 确保只有授权用户可以上传或管理 | diff --git a/zh/rum/quickstart/app-management.mdx b/zh/rum/quickstart/app-management.mdx index 6788d042..d4c09272 100644 --- a/zh/rum/quickstart/app-management.mdx +++ b/zh/rum/quickstart/app-management.mdx @@ -37,7 +37,7 @@ RUM 应用是承载前端性能监控数据的容器，用于采集、存储和 -选择应用对应的前端技术类型，目前支持 **JavaScript (JS)、Android、iOS、微信小程序**。 +选择应用对应的前端技术类型，目前支持 **JavaScript (JS)、Android、iOS、HarmonyOS、Flutter、微信小程序**。 @@ -76,6 +76,7 @@ RUM 应用是承载前端性能监控数据的容器，用于采集、存储和 - **JavaScript（Web）**：配置服务名等参数后，实时预览 `flashcatRum.init()` 初始化代码 - **Android**：展示完整的集成步骤，包括添加 Gradle 依赖（`cloud.flashcat:dd-sdk-android-core` 和 `cloud.flashcat:dd-sdk-android-rum`）、在 `Application.onCreate()` 中初始化 SDK 并启用 RUM，以及可选的 WebView 追踪集成 - **iOS**：展示完整的集成步骤，包括添加 Swift Package Manager 依赖（`fc-sdk-ios`，版本 0.3.0 起）、在 `AppDelegate.didFinishLaunchingWithOptions` 中初始化 SDK 并启用 RUM，以及可选的 WebView 追踪集成 +- **Flutter**：Flutter SDK 封装了 Android/iOS 原生 SDK，一次集成即可同时监控两端，详见 [Flutter SDK 接入](/zh/rum/sdk/flutter/sdk-integration) - **微信小程序**：通过表单填写 `env`、`service`、`version`、`sessionSampleRate` 后，实时预览基于 `@flashcatcloud/miniprogram-rum` 的 `flashcatRum.init()` 初始化代码（参见下方「微信小程序 SDK 配置助手」） 每个平台的 SDK 配置页面都会自动填入当前应用的 `applicationId` 和 `clientToken`，您可以直接复制代码到项目中使用。 diff --git a/zh/rum/session-replay/overview.mdx b/zh/rum/session-replay/overview.mdx index 52715d8f..7b3aa82c 100644 --- a/zh/rum/session-replay/overview.mdx +++ b/zh/rum/session-replay/overview.mdx @@ -93,6 +93,22 @@ Flashduty RUM 的**会话重放功能**（Session Replay）是一款强大的用 +## 私有化部署：回放数据拉取方式 + +播放器拉取回放分段数据的方式由 `global.app_settings` 中的 `rumReplayFetchMode` 配置控制，可选两种模式： + +| 取值 | 说明 | +|------|------| +| `url` | 服务端签发对象存储预签名 URL，浏览器直接下载回放分段 | +| `segment` | 服务端从对象存储读取并解压分段，再以流式转发给浏览器，浏览器全程不接触对象存储地址 | + +- **SaaS 部署**：固定使用 `url` 模式，无需配置。 +- **私有化部署**：缺省为 `segment`，可适配任意部署环境。预签名 URL 默认使用对象存储的内网端点签发，浏览器可能无法访问；当您的对象存储提供浏览器可达的外网端点时，可将 `rumReplayFetchMode` 配置为 `url`，由浏览器直接拉取分段。 + + +播放过程中的 seek 操作始终通过 `segment` 方式拉取，不受该配置影响。 + + ## 下一步 From 692a7e983272336f2ca98772d6e59262a5cdd18c Mon Sep 17 00:00:00 2001 From: ysyneu Date: Wed, 29 Jul 2026 20:27:37 -0700 Subject: [PATCH 2/2] docs: drop private-deployment replay fetch mode from public docs Deployment-level setting handled by support/delivery, not end-user facing. --- en/rum/session-replay/overview.mdx | 16 ---------------- zh/rum/session-replay/overview.mdx | 16 ---------------- 2 files changed, 32 deletions(-) diff --git a/en/rum/session-replay/overview.mdx b/en/rum/session-replay/overview.mdx index 94853d1e..46f9c49c 100644 --- a/en/rum/session-replay/overview.mdx +++ b/en/rum/session-replay/overview.mdx @@ -92,22 +92,6 @@ Flashduty RUM's **Session Replay** feature is a powerful user behavior analysis -## Private Deployment: Replay Data Fetch Mode - -How the player fetches replay segments is controlled by the `rumReplayFetchMode` setting in `global.app_settings`, with two available modes: - -| Value | Description | -|-------|-------------| -| `url` | The server issues presigned object-storage URLs, and the browser downloads the replay segments directly | -| `segment` | The server reads and inflates the segments from object storage, then streams them to the browser; the browser never touches the object-storage address | - -- **SaaS deployment**: Always uses the `url` mode; no configuration needed. -- **Private deployment**: Defaults to `segment`, which works on any deployment. Presigned URLs are signed with the object storage's intranet endpoint by default, which the browser may not be able to reach. If your object storage exposes an extranet endpoint reachable from browsers, you can set `rumReplayFetchMode` to `url` so the browser fetches segments directly. - - -Seek operations during playback always fetch via the `segment` mode and are not affected by this setting. - - ## Next Steps diff --git a/zh/rum/session-replay/overview.mdx b/zh/rum/session-replay/overview.mdx index 7b3aa82c..52715d8f 100644 --- a/zh/rum/session-replay/overview.mdx +++ b/zh/rum/session-replay/overview.mdx @@ -93,22 +93,6 @@ Flashduty RUM 的**会话重放功能**（Session Replay）是一款强大的用 -## 私有化部署：回放数据拉取方式 - -播放器拉取回放分段数据的方式由 `global.app_settings` 中的 `rumReplayFetchMode` 配置控制，可选两种模式： - -| 取值 | 说明 | -|------|------| -| `url` | 服务端签发对象存储预签名 URL，浏览器直接下载回放分段 | -| `segment` | 服务端从对象存储读取并解压分段，再以流式转发给浏览器，浏览器全程不接触对象存储地址 | - -- **SaaS 部署**：固定使用 `url` 模式，无需配置。 -- **私有化部署**：缺省为 `segment`，可适配任意部署环境。预签名 URL 默认使用对象存储的内网端点签发，浏览器可能无法访问；当您的对象存储提供浏览器可达的外网端点时，可将 `rumReplayFetchMode` 配置为 `url`，由浏览器直接拉取分段。 - - -播放过程中的 seek 操作始终通过 `segment` 方式拉取，不受该配置影响。 - - ## 下一步