Help with SQL Expression possibilities :)
jdcoats opened this issue · 6 comments
jdcoats commented
I need assistance with an expression for syslog. I have firewall syslog messages example:
Teardown TCP connection 1067175433 for inside:10.1.5.21/60506 to outside:35.184.35.160/443 duration 0:01:27 bytes 18844 TCP FINs from outside
The objective is to alert on bytes > 200000000 or some threshold.
This doesn't work but shows the spirit of the task anyway
select * from syslog.syslog_incoming where host = 'FTD-Primary' and message like '%bytes > 200000000%';
Is there a way to do this without the # being in a column of its own?
TheWitness commented
@jdcoats , I would do use the flowview plugin, and then with your help get those bad boys nailed down. Make sure you have space.
There is a ticket we've asked for help on. Where if the stream is coming from a FW, we can collect the client indpoint traffic if it relevant.
The issue then becomes, how to trigger an alert.
Syslog may be quicker...
TheWitness commented
If only my alerting plugin that has the capability to do SQL queries was available and QA'd for normal Cacti. It's specifically designed for RTM. It's out on GitHub but no guarantees that will work for this particular use case. It's called gridalarms.
TheWitness commented
It looks and feels a lot like thold but designed for either running scripts or queries.
TheWitness commented
jdcoats commented
it looks to be packaged as a whole new cacti install with a few new plugins in it. Doesn't seem like a simple plugin install.
jdcoats commented
That makes a mess
2024/08/23 11:18:46 - CMDPHP ERROR: debounce key was truncated from debounce_missing:plugins/RTM/include/fusioncharts/fusioncharts.js to debounce_missing:plugins/RTM/include/fusioncharts/ Backtrace: (/plugins.php[216]:top_header(), /lib/functions.php[4654]:include_once(), /include/top_header.php[34]:html_common_header(), /lib/html.php[2675]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:rtm_page_head(), /plugins/RTM/setup.php[45]:get_md5_include_js(), /lib/functions.php[6680]:get_include_relpath(), /lib/functions.php[6666]:debounce_run_notification(), /lib/functions.php[7383]:cacti_debug_backtrace())
2024/08/23 11:18:46 - CMDPHP PHP ERROR WARNING Backtrace: (/plugins.php[216]:top_header(), /lib/functions.php[4654]:include_once(), /include/top_header.php[34]:html_common_header(), /lib/html.php[2675]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:rtm_page_head(), /plugins/RTM/setup.php[42]:include_once(), /plugins/RTM/setup.php[42]:CactiErrorHandler())
2024/08/23 11:18:46 - ERROR PHP WARNING in Plugin 'RTM': include_once(): Failed opening '/var/www/localhost/htdocs/cacti/lib/rtm_functions.php' for inclusion (include_path='.:/usr/share/php7:/usr/share/php:/var/www/localhost/htdocs/cacti:/var/www/localhost/htdocs/cacti/') in file: /var/www/localhost/htdocs/cacti/plugins/RTM/setup.php on line: 42
2024/08/23 11:18:46 - CMDPHP PHP ERROR WARNING Backtrace: (/plugins.php[216]:top_header(), /lib/functions.php[4654]:include_once(), /include/top_header.php[34]:html_common_header(), /lib/html.php[2675]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:rtm_page_head(), /plugins/RTM/setup.php[42]:include_once(), /plugins/RTM/setup.php[42]:CactiErrorHandler())
2024/08/23 11:18:46 - ERROR PHP WARNING in Plugin 'RTM': include_once(/var/www/localhost/htdocs/cacti/lib/rtm_functions.php): Failed to open stream: No such file or directory in file: /var/www/localhost/htdocs/cacti/plugins/RTM/setup.php on line: 42
2024/08/23 10:19:53 - ERROR PHP DEPRECATED in Plugin 'grid': Optional parameter $apply_limits declared before required parameter $total_rows is implicitly treated as a required parameter in file: /var/www/localhost/htdocs/cacti/plugins/grid/lib/grid_functions.php on line: 11721
2024/08/23 10:19:53 - CMDPHP PHP ERROR Backtrace: (/plugins/syslog/syslog_process.php[25]:include(), /include/cli_check.php[45]:include(), /include/global.php[549]:include_once(), /include/global_arrays.php[2930]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:grid_config_arrays(), /plugins/grid/setup.php[6158]:include_once(), /plugins/grid/include/grid_constants.php[21]:include_once(), /plugins/grid/include/grid_constants.php[21]:CactiErrorHandler())
2024/08/23 10:19:53 - ERROR PHP DEPRECATED in Plugin 'grid': Optional parameter $apply_limits declared before required parameter $total_rows is implicitly treated as a required parameter in file: /var/www/localhost/htdocs/cacti/plugins/grid/lib/grid_functions.php on line: 11721
2024/08/23 10:19:53 - CMDPHP PHP ERROR Backtrace: (/plugins/hmib/poller_hmib.php[29]:include(), /include/cli_check.php[45]:include(), /include/global.php[549]:include_once(), /include/global_arrays.php[2930]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:grid_config_arrays(), /plugins/grid/setup.php[6158]:include_once(), /plugins/grid/include/grid_constants.php[21]:include_once(), /plugins/grid/include/grid_constants.php[21]:CactiErrorHandler())
2024/08/23 10:19:53 - ERROR PHP DEPRECATED in Plugin 'grid': Optional parameter $apply_limits declared before required parameter $rowsquery is implicitly treated as a required parameter in file: /var/www/localhost/htdocs/cacti/plugins/grid/lib/grid_functions.php on line: 10343
2024/08/23 10:19:53 - CMDPHP PHP ERROR Backtrace: (/plugins/syslog/syslog_process.php[25]:include(), /include/cli_check.php[45]:include(), /include/global.php[549]:include_once(), /include/global_arrays.php[2930]:api_plugin_hook(), /lib/plugins.php[95]:api_plugin_run_plugin_hook(), /lib/plugins.php[237]:grid_config_arrays(), /plugins/grid/setup.php[6158]:include_once(), /plugins/grid/include/grid_constants.php[21]:include_once(), /plugins/grid/include/grid_constants.php[21]:CactiErrorHandler())
2024/08/23 10:19:53 - ERROR PHP DEPRECATED in Plugin 'grid': Optional parameter $apply_limits declared before required parameter $rowsquery is implicitly treated as a required parameter in file: /var/www/localhost/htdocs/cacti/plugins/grid/lib/grid_functions.php on line: 10343
