Skip to content

Commit 9510330

Browse files
bmfmanciniCopilot
bmfmancini
and
Copilot
authored
Feature - Resolve syslog IP against cacti Hosts (#243)
* agents * Update copilot-instructions.md * correct filename spelling * Allow for resolving syslog device ip against cacti hosts table Some devices dont send the device name as the hostname for syslog instead they send the IP This feature will allow for resolving the IP against the cacti host table as the device may not be in DNS * Update .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update functions.php * Consolodate setting Update the flow as follows 1) If we recive a host check DNS 2.) if the IP is not in DNS check the cacti host table 3.) Mark as invalid if we cant find it * update friendly name * Update functions.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/ISSUE_TEMPLATE/copilot-instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * update the host validation logic Dont just mark the device as invalid instead pass the original sent hostname/ip and log that it could not be resolved * Update to Hostname resolution logic 1.) Provide a way to disable dns resolution if your hosts are not in DNS 2.) Prefix an invalid hostname with unresolved-original_hostname for better traceability * Group host discovery options together * Allow for no DNS option to be disabled Allow for the check against cacti to continue * Fix logic issue when dns lookup is disabled --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 4e546ac commit 9510330

2 files changed

Lines changed: 97 additions & 21 deletions

File tree

‎functions.php‎

Lines changed: 80 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1495,7 +1495,7 @@ function syslog_process_alert($alert, $sql, $params, $count, $hostname = '') {
14951495
/**
14961496
* Open a ticket if this options have been selected.
14971497
*/
1498-
$command = read_config_option('syslog_ticket_command');
1498+
$command = read_config_option('syslog_ticket_command');
14991499

15001500
if ($command != '') {
15011501
$command = trim($command);
@@ -1765,6 +1765,46 @@ function syslog_strip_incoming_domains($uniqueID) {
17651765
}
17661766
}
17671767

1768+
1769+
1770+
1771+
/**
1772+
* Check if the hostname is in the cacti hosts table
1773+
* Some devices only send IP addresses in syslog messages, and may not be in the DNS
1774+
* however they may be in the cacti hosts table as monitored devices.
1775+
*
1776+
* @param (string) The hostname to check
1777+
* @param (int) The unique id for syslog_incoming messages to process
1778+
*
1779+
* @return (bool) True if the host exists in the Cacti database, false otherwise
1780+
*/
1781+
1782+
function syslog_check_cacti_hosts($host, $uniqueID) {
1783+
global $syslogdb_default;
1784+
1785+
if (empty($host)) {
1786+
return false;
1787+
}
1788+
1789+
// Check if the host exists in cacti by hostname and get the description
1790+
$cacti_host = db_fetch_row_prepared('SELECT DISTINCT description
1791+
FROM host
1792+
WHERE hostname = ?
1793+
LIMIT 1',
1794+
array($host));
1795+
1796+
if (cacti_sizeof($cacti_host) && !empty($cacti_host['description'])) {
1797+
syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . '`.`syslog_incoming`
1798+
SET host = ?
1799+
WHERE host = ?
1800+
AND `status` = ?',
1801+
array($cacti_host['description'], $host, $uniqueID));
1802+
1803+
return true;
1804+
}
1805+
1806+
return false;
1807+
}
17681808
/**
17691809
* syslog_update_reference_tables - There are many values in the syslog plugin
17701810
* that for the purposes of reducing the size of the syslog table are normalized
@@ -1784,20 +1824,45 @@ function syslog_update_reference_tables($uniqueID) {
17841824
syslog_debug('-------------------------------------------------------------------------------------');
17851825
syslog_debug('Updating Reference Tables from New Syslog Records');
17861826

1787-
/* correct for invalid hosts */
1788-
if (read_config_option('syslog_validate_hostname') == 'on') {
1789-
$hosts = syslog_db_fetch_assoc('SELECT DISTINCT host
1790-
FROM `' . $syslogdb_default . '`.`syslog_incoming`');
1791-
1792-
foreach($hosts as $host) {
1793-
if ($host['host'] == gethostbyname($host['host'])) {
1794-
syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
1795-
SET host = 'invalid_host'
1796-
WHERE host = ?",
1797-
array($host['host']));
1798-
}
1799-
}
1800-
}
1827+
/* Validate and resolve hostnames - check DNS first, then Cacti, then mark invalid */
1828+
if (read_config_option('syslog_resolve_hostname') == 'on') {
1829+
$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
1830+
FROM `' . $syslogdb_default . '`.`syslog_incoming`
1831+
WHERE `status` = ?',
1832+
array($uniqueID));
1833+
1834+
foreach($hosts as $host) {
1835+
if (!isset($host['host']) || empty($host['host'])) {
1836+
continue;
1837+
}
1838+
1839+
$resolved = false;
1840+
1841+
// Check if hostname resolves via DNS (only if DNS is enabled)
1842+
if (read_config_option('syslog_no_dns') != 'on') {
1843+
if ($host['host'] != gethostbyname($host['host'])) {
1844+
// DNS resolved successfully
1845+
$resolved = true;
1846+
}
1847+
}
1848+
1849+
// Check if hostname exists in Cacti hosts table (only if not already resolved via DNS)
1850+
if (!$resolved) {
1851+
$resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
1852+
}
1853+
1854+
// If not resolved via DNS or found in Cacti, prefix the hostname
1855+
if (!$resolved) {
1856+
$unresolved_host = 'unresolved-' . $host['host'];
1857+
cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as '" . $unresolved_host . "'", false, 'SYSLOG');
1858+
syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
1859+
SET host = ?
1860+
WHERE host = ?
1861+
AND `status` = ?",
1862+
array($unresolved_host, $host['host'], $uniqueID));
1863+
}
1864+
}
1865+
}
18011866

18021867
syslog_db_execute_prepared('INSERT INTO `' . $syslogdb_default . '`.`syslog_programs`
18031868
(program, last_updated)

‎setup.php‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1138,12 +1138,6 @@ function syslog_config_settings() {
11381138
'size' => 80,
11391139
'max_length' => 255,
11401140
),
1141-
'syslog_validate_hostname' => array(
1142-
'friendly_name' => __('Validate Hostnames', 'syslog'),
1143-
'description' => __('If this checkbox is set, all hostnames are validated. If the hostname is not valid. All records are assigned to a special host called \'invalidhost\'. This setting can impact syslog processing time on large systems. Therefore, use of this setting should only be used when other means are not in place to prevent this from happening.', 'syslog'),
1144-
'method' => 'checkbox',
1145-
'default' => ''
1146-
),
11471141
'syslog_refresh' => array(
11481142
'friendly_name' => __('Refresh Interval', 'syslog'),
11491143
'description' => __('This is the time in seconds before the page refreshes.', 'syslog'),
@@ -1173,6 +1167,23 @@ function syslog_config_settings() {
11731167
'size' => 80
11741168
),
11751169
'syslog_html_header' => array(
1170+
'friendly_name' => __('Host Discovery Options', 'syslog'),
1171+
'method' => 'spacer',
1172+
'collapsible' => 'true'
1173+
),
1174+
'syslog_resolve_hostname' => array(
1175+
'friendly_name' => __('Enable Hostname Resolution', 'syslog'),
1176+
'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first (If enabled). If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned a prefix \'unresolved-Original_hostname\'.', 'syslog'),
1177+
'method' => 'checkbox',
1178+
'default' => ''
1179+
),
1180+
'syslog_no_dns' => array(
1181+
'friendly_name' => __('Skip DNS Resolution for incoming hosts', 'syslog'),
1182+
'description' => __('If this checkbox is set, the system will not attempt to resolve hosts via DNS lookups. This is useful for environments where DNS resolution is not possible or not desired.', 'syslog'),
1183+
'method' => 'checkbox',
1184+
'default' => ''
1185+
),
1186+
'syslog_html_notification_header' => array(
11761187
'friendly_name' => __('HTML Notification Settings', 'syslog'),
11771188
'method' => 'spacer',
11781189
'collapsible' => 'true'

0 commit comments

Comments
 (0)