Neil Lathwood 03076c4025 feature: Added new alert rule builder UI and rule mapping UI (#8293)
* feature: Added new alert rule builder UI

* Updated to export sql queries

* More updates

* more changes

* removed debug

* fix scrut

* Updated to include import options + various other fixes

* fix rule

* Populate name from collection rules.

* Fix default rule import
Allow new and old style rules in the collection.
Don't add new yet as I'm not sure GenSQL() is working.

* Fix GenSQL call

* Extract filter building to class so it is nicely contained in one place

* moved schema

* some fixes and tweaks

* travis fixes

* Some more features / updates

* Fix up my mistakes when adding default rules

* Use a modal for new alert (Incomplete)
Larger dialog!!
Remove page loading stuff.

Working:
Loading rules, resetting dialog, importing from collection.

Not working yet:
select width
device limited rule access? don't know what this is...

Lots of unused stuff to delete...

* reload "table" after save

* fixed editing rule

* Auto select2 width

* Reload window on save

* Restore per-device alert. Remove debug.

* Small cleanups. Rule Name first.

* Restore button to button type. Rename schema.

* Fixes: wrong command to reload window, remove extra attributes, rule is never passed

* Fixed old rule editing

* some small updates for old imports

* travis update to use trusty

* maybe travis fix

* Ability to set alert rule mappings on the rule edit screen

* pip installs one line, no quiet for deploy

* update schema def

* Fix style and some copyright headers

* fix docs missing file

* Allow new versions of snmpsim and libraries

* Parser WIP

* Fix default rules insert

* reorganize

* Legacy import first draft done

* Implement saving
Skip translation to sql for now

* Working on glues

* small rule collection fix

* Working on glues

* Working on glues

* Docs updates + small UI changes

* Parser WIP

* reorganize

* Legacy import first draft done

* Implement saving
Skip translation to sql for now

* Working on glues

* Working on glues

* Working on glues

* Add table mapping, should move to it's own class

* WIP

* Glue working!!

* Extract Schema class

* Some final touches.
revert alerts_rules.json for now.

* Finish up initial implementation
Needs more tests

* Fix a few places

* small doc updates

* Fix finding tables in grouped rules.

* remove unused code

* code format fixes

* Some quick tests for Schema
Simplified output for findRelationshipPath. Always includes start and target in the result.
This simplifies a lot of code in QueryBuilderParser.php
This also always loads the target table data now (which we want)

* Make bill_id the PRIMARY index for the bills table

* Load macros from a json file in misc instead of the database.

* Fix whitespace and wrong key for collection.

* Handle IN properly when generating SQL

* Fix glue (devices.device_id = ports.port_id) is incorrect :D
Show ALL tables we can resolve relationships for in the query builder filter.

* Remove all macros from the database
Remove insert statements, leave updates to update user's existing rules.
2018-03-14 20:25:19 +00:00

3.1 KiB

source: Alerting/Entities.md

Entities

Entities as described earlier are based on the table and column names within the database, if you are unsure of what the entity is you want then have a browse around inside MySQL using show tables and desc <tablename>.

Below are some common entities that you can use within the alerting system. This list is not exhaustive and you should look at the MySQL database schema for the full list.

Devices

Entity Description
devices.hostname The device hostname
devices.sysName The device sysName
devices.sysDescr The device sysDescr
devices.hardware The device hardware
devices.version The device os version
devices.location The device location
devices.status The status of the device, 1
devices.status_reason The reason the device was detected as down (icmp or snmp)
devices.ignore If the device is ignored this will be set to 1
devices.disabled If the device is disabled this will be set to 1
devices.last_polled The the last polled datetime (yyyy-mm-dd hh:mm:ss)
devices.type The device type such as network, server, firewall, etc.

BGP Peers

Entity Description
bgpPeers.astext This is the description of the BGP Peer
bgpPeers.bgpPeerIdentifier The IP address of the BGP Peer
bgpPeers.bgpPeerRemoteAs The AS number of the BGP Peer
bgpPeers.bgpPeerState The operational state of the BGP session
bgpPeers.bgpPeerAdminStatus The administrative state of the BGP session
bgpPeers.bgpLocalAddr The local address of the BGP session.

IPSec Tunnels

Entity Description
ipsec_tunnels.peer_addr The remote VPN peer address
ipsec_tunnels.local_addr The local VPN address
ipsec_tunnels.tunnel_status The VPN tunnels operational status.

Memory pools

Entity Description
mempools.mempool_type The memory pool type such as hrstorage, cmp and cemp
mempools.mempool_descr The description of the pool such as Physical memory, Virtual memory and System memory
mempools.mempool_perc The used percentage of the memory pool.

Ports

Entity Description
ports.ifDescr The interface description
ports.ifName The interface name
ports.ifSpeed The port speed in bps
ports.ifHighSpeed The port speed in mbps
ports.ifOperStatus The operational status of the port (up or down)
ports.ifAdminStatus The administrative status of the port (up or down)
ports.ifDuplex Duplex setting of the port
ports.ifMtu The MTU setting of the port.`

Processors

Entity Description
processors.processor_usage The usage of the processor as a percentage
processors.processor_descr The description of the processor.

Storage

Entity Description
storage.storage_descr The description of the storage
storage.storage_perc The usage of the storage as a percentage.

Health / Sensors

Entity Description
sensors.sensor_desc The sensors description.
sensors.sensor_current The current sensors value.
sensors.sensor_prev The previous sensor value.
sensors.lastupdate The sensors last updated datetime stamp.