From 6b68d5fce9e65cb677b53fcdad00764175ef6a27 Mon Sep 17 00:00:00 2001 From: Tony Murray Date: Tue, 13 Mar 2018 17:19:57 -0500 Subject: [PATCH] alerts: Added alert_id to alerts for templates (#8368) * Add alert_id to alerts for templates Extract alert loading to a function loadAlerts(). Alternative to #8351 * Actually add alert_id to $obj * travis fixes --- includes/alerts.inc.php | 71 ++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 44 deletions(-) diff --git a/includes/alerts.inc.php b/includes/alerts.inc.php index 8c7d294a32..a3c25b83d1 100644 --- a/includes/alerts.inc.php +++ b/includes/alerts.inc.php @@ -539,6 +539,7 @@ function DescribeAlert($alert) return 'Unknown State'; }//end if $obj['uid'] = $alert['id']; + $obj['alert_id'] = $alert['alert_id']; $obj['severity'] = $alert['severity']; $obj['rule'] = $alert['rule']; $obj['name'] = $alert['name']; @@ -656,21 +657,7 @@ function IssueAlert($alert) */ function RunAcks() { - foreach (dbFetchRows('SELECT alerts.device_id, alerts.rule_id, alerts.state FROM alerts WHERE alerts.state = 2 && alerts.open = 1') as $alert) { - $tmp = array( - $alert['rule_id'], - $alert['device_id'], - ); - $alert = dbFetchRow('SELECT alert_log.id,alert_log.rule_id,alert_log.device_id,alert_log.state,alert_log.details,alert_log.time_logged,alert_rules.rule,alert_rules.severity,alert_rules.extra,alert_rules.name FROM alert_log,alert_rules WHERE alert_log.rule_id = alert_rules.id && alert_log.device_id = ? && alert_log.rule_id = ? && alert_rules.disabled = 0 ORDER BY alert_log.id DESC LIMIT 1', array($alert['device_id'], $alert['rule_id'])); - if (empty($alert['rule']) || !IsRuleValid($tmp[1], $tmp[0])) { - // Alert-Rule does not exist anymore, let's remove the alert-state. - echo 'Stale-Rule: #'.$tmp[0].'/'.$tmp[1]."\r\n"; - dbDelete('alerts', 'rule_id = ? && device_id = ?', array($tmp[0], $tmp[1])); - continue; - } - - $alert['details'] = json_decode(gzuncompress($alert['details']), true); - $alert['state'] = 2; + foreach (loadAlerts('alerts.state = 2 && alerts.open = 1') as $alert) { IssueAlert($alert); dbUpdate(array('open' => 0), 'alerts', 'rule_id = ? && device_id = ?', array($alert['rule_id'], $alert['device_id'])); } @@ -683,21 +670,7 @@ function RunAcks() */ function RunFollowUp() { - global $config; - foreach (dbFetchRows('SELECT alerts.device_id, alerts.rule_id, alerts.state FROM alerts WHERE alerts.state != 2 && alerts.state > 0 && alerts.open = 0') as $alert) { - $tmp = array( - $alert['rule_id'], - $alert['device_id'], - ); - $alert = dbFetchRow('SELECT alert_log.id,alert_log.rule_id,alert_log.device_id,alert_log.state,alert_log.details,alert_log.time_logged,alert_rules.rule, alert_rules.query,alert_rules.severity,alert_rules.extra,alert_rules.name FROM alert_log,alert_rules WHERE alert_log.rule_id = alert_rules.id && alert_log.device_id = ? && alert_log.rule_id = ? && alert_rules.disabled = 0 ORDER BY alert_log.id DESC LIMIT 1', array($alert['device_id'], $alert['rule_id'])); - if (empty($alert['rule']) || !IsRuleValid($tmp[1], $tmp[0])) { - // Alert-Rule does not exist anymore, let's remove the alert-state. - echo 'Stale-Rule: #'.$tmp[0].'/'.$tmp[1]."\r\n"; - dbDelete('alerts', 'rule_id = ? && device_id = ?', array($tmp[0], $tmp[1])); - continue; - } - - $alert['details'] = json_decode(gzuncompress($alert['details']), true); + foreach (loadAlerts('alerts.state != 2 && alerts.state > 0 && alerts.open = 0') as $alert) { $rextra = json_decode($alert['extra'], true); if ($rextra['invert']) { continue; @@ -739,6 +712,29 @@ function RunFollowUp() }//end foreach }//end RunFollowUp() +function loadAlerts($where) +{ + $alerts = []; + foreach (dbFetchRows("SELECT alerts.id, alerts.device_id, alerts.rule_id, alerts.state FROM alerts WHERE $where") as $alert_status) { + $alert = dbFetchRow( + 'SELECT alert_log.id,alert_log.rule_id,alert_log.device_id,alert_log.state,alert_log.details,alert_log.time_logged,alert_rules.rule,alert_rules.severity,alert_rules.extra,alert_rules.name FROM alert_log,alert_rules WHERE alert_log.rule_id = alert_rules.id && alert_log.device_id = ? && alert_log.rule_id = ? && alert_rules.disabled = 0 ORDER BY alert_log.id DESC LIMIT 1', + array($alert_status['device_id'], $alert_status['rule_id']) + ); + + if (empty($alert['rule_id']) || !IsRuleValid($alert_status['device_id'], $alert_status['rule_id'])) { + echo 'Stale-Rule: #' . $alert_status['rule_id'] . '/' . $alert_status['device_id'] . "\r\n"; + // Alert-Rule does not exist anymore, let's remove the alert-state. + dbDelete('alerts', 'rule_id = ? && device_id = ?', [$alert_status['rule_id'], $alert_status['device_id']]); + } else { + $alert['alert_id'] = $alert_status['id']; + $alert['state'] = $alert_status['state']; + $alert['details'] = json_decode(gzuncompress($alert['details']), true); + $alerts[] = $alert; + } + } + + return $alerts; +} /** * Run all alerts @@ -747,20 +743,7 @@ function RunFollowUp() function RunAlerts() { global $config; - foreach (dbFetchRows('SELECT alerts.device_id, alerts.rule_id, alerts.state FROM alerts WHERE alerts.state != 2 && alerts.open = 1') as $alert) { - $tmp = array( - $alert['rule_id'], - $alert['device_id'], - ); - $alert = dbFetchRow('SELECT alert_log.id,alert_log.rule_id,alert_log.device_id,alert_log.state,alert_log.details,alert_log.time_logged,alert_rules.rule,alert_rules.severity,alert_rules.extra,alert_rules.name FROM alert_log,alert_rules WHERE alert_log.rule_id = alert_rules.id && alert_log.device_id = ? && alert_log.rule_id = ? && alert_rules.disabled = 0 ORDER BY alert_log.id DESC LIMIT 1', array($alert['device_id'], $alert['rule_id'])); - if (empty($alert['rule_id']) || !IsRuleValid($tmp[1], $tmp[0])) { - echo 'Stale-Rule: #'.$tmp[0].'/'.$tmp[1]."\r\n"; - // Alert-Rule does not exist anymore, let's remove the alert-state. - dbDelete('alerts', 'rule_id = ? && device_id = ?', array($tmp[0], $tmp[1])); - continue; - } - - $alert['details'] = json_decode(gzuncompress($alert['details']), true); + foreach (loadAlerts('alerts.state != 2 && alerts.open = 1') as $alert) { $noiss = false; $noacc = false; $updet = false;