Feature/device alert rules - #374
Merged
Merged
Conversation
…ase telemetry, and rule preview - Partition maintenance fail-safe: syslog_partition_manage() stops all partition actions when metadata is invalid or a required partition cannot be created; the dMaxValue safety partition is never dropped; blocked maintenance is logged with a remediation step and shown on the Syslog Status page. - Bounded multi-day partition recovery: a new 'Partition Recovery Limit' setting caps partitions created per table per poller run; recovery runs sequentially for syslog and syslog_removed, retention pruning stays deferred until the future write horizon exists, and each blocked run reports the gap, stop reason, and dMaxValue risk. - Collector health on Syslog Status: last received log timestamp, oldest unprocessed incoming age, incoming backlog, records processed in the latest run, and warnings driven by the new 'Collector Staleness' and 'Collector Backlog Threshold' settings; unavailable metrics read as Unavailable. - Per-phase processing telemetry: partition maintenance, reference updates, removal rules, alert evaluation, incoming transfer, and report processing record start/end/duration/count through the syslog_status mechanism; Syslog Status shows phase timings and the slowest phase. - Rule preview: a 'Test rule' action in the alert and removal editors compiles the rule through the existing QueryBuilder/parameterized paths and returns a bounded, escaped preview without any side effects; gated on realms and CSRF. Tests: 142 passed (667 assertions) via Pest; php -l clean on all files; standalone tests/regression scripts pass; locales/po/cacti.pot regenerated with locales/build_gettext.sh
…sion-maintenance-windows # Conflicts: # locales/po/cacti.pot # syslog_alerts.php # tests/Security/RulePreviewTest.php
…rt-rules # Conflicts: # INFO # functions.php # setup.php
…eRulePolicyTest Pest's toContain() treats every argument as an additional needle to search for (not value + description like PHPUnit's assertContains), so passing a custom failure message as the second argument made the assertion also require the message text itself to be a substring of the generated SQL, failing deterministically in CI. Move the intent into comments and keep single-needle assertions only, matching the fix applied to AlertSuppressionScheduleTest in PR #356.
TheWitness
previously approved these changes
Sep 23, 2026
xmacan
previously approved these changes
Sep 24, 2026
TheWitness
previously requested changes
Sep 24, 2026
TheWitness
left a comment
TheWitness
left a comment
Member
There was a problem hiding this comment.
You should note have remove the po files, but returned to their defaults. Sorry, I should have been more clear.
cigamit
approved these changes
Sep 25, 2026
TheWitness
approved these changes
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow for host based alarm rules
Users can Suppress Alarms for a particular host indefinitely or for a period of time
Or bypass maintenance rules and have the device alert always