Existing release of signalfx-tracing uses "tar" package v4 which has the following vulnerability. tar package versions before 6.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS). When stripping the trailing slash from files arguments, we were using f.replace(/\\/+$/, \'\'), which can get exponentially slow when f contains many / characters. This is ""unlikely but theoretically possible"" because it requires that the user is passing untrusted input into the tar.extract() or tar.list() array of entries to parse/extract, which would be quite unusual. As a security first policy in our organization we strive to keep updating to the latest fixes for all vulnerable packages. We are currently blocked because we use signalfx-tracing@latest. We need signalfx-tracing to update to the latest version of tar and release a package with no other breaking changes in the package. here is more information about the needed package of tar   For more details refer this GitHub link:https://github.com/signalfx/signalfx-nodejs-tracing/issues/97 ... View more

I am working in Hxc capture program and currently I am facing an issue in Signalfx. So I am reaching out for help/guidance. I have created an Alert in signalFx using terraform. The condition for the alert is that if the signal is less than 1 for a certain time( 2 for warning and 5 for critical),then alert will be triggered. The code in Signalflow is : signal = data('HealthCheckStatus', filter=filter('stat', 'upper') and filter('aws_account_id', '823990414917') and filter('aws_tag_Name', 'hxc-staging-health-check')).publish(label='A') detect(when(signal < 1, '2m')).publish('WARNING[staging]: Route53 health down for 2m') detect(when(signal < 1, '5m')).publish('CRITICAL[staging]: Route53 health down for 5m')   After that we created a condition when the signal came below 1 ( it came to 0).In the Alert graph we can see the same .But instead of actually triggering the alert,it is giving us a preview. (Attached screenshot)   The exact Alert message is "Estimated alert count: 1 in 1 hour. Alerts that would have triggered  shown in chart below." So the bottom line is that Signalfx is not triggering the alert. The code that I am using for this is : https://github.com/HylandSoftware/tf-cfg-hxc-signalfx-alerts/blob/main/terraform/alerts-route53-health.tf   Alert Link:https://hyland.signalfx.com/#/detector/v2/FQo6JaWA0AI/edit?detectorSignalFlowEditor=1     ... View more