mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
Neil LathwoodandGitHub
03076c4025
* feature: Added new alert rule builder UI * Updated to export sql queries * More updates * more changes * removed debug * fix scrut * Updated to include import options + various other fixes * fix rule * Populate name from collection rules. * Fix default rule import Allow new and old style rules in the collection. Don't add new yet as I'm not sure GenSQL() is working. * Fix GenSQL call * Extract filter building to class so it is nicely contained in one place * moved schema * some fixes and tweaks * travis fixes * Some more features / updates * Fix up my mistakes when adding default rules * Use a modal for new alert (Incomplete) Larger dialog!! Remove page loading stuff. Working: Loading rules, resetting dialog, importing from collection. Not working yet: select width device limited rule access? don't know what this is... Lots of unused stuff to delete... * reload "table" after save * fixed editing rule * Auto select2 width * Reload window on save * Restore per-device alert. Remove debug. * Small cleanups. Rule Name first. * Restore button to button type. Rename schema. * Fixes: wrong command to reload window, remove extra attributes, rule is never passed * Fixed old rule editing * some small updates for old imports * travis update to use trusty * maybe travis fix * Ability to set alert rule mappings on the rule edit screen * pip installs one line, no quiet for deploy * update schema def * Fix style and some copyright headers * fix docs missing file * Allow new versions of snmpsim and libraries * Parser WIP * Fix default rules insert * reorganize * Legacy import first draft done * Implement saving Skip translation to sql for now * Working on glues * small rule collection fix * Working on glues * Working on glues * Docs updates + small UI changes * Parser WIP * reorganize * Legacy import first draft done * Implement saving Skip translation to sql for now * Working on glues * Working on glues * Working on glues * Add table mapping, should move to it's own class * WIP * Glue working!! * Extract Schema class * Some final touches. revert alerts_rules.json for now. * Finish up initial implementation Needs more tests * Fix a few places * small doc updates * Fix finding tables in grouped rules. * remove unused code * code format fixes * Some quick tests for Schema Simplified output for findRelationshipPath. Always includes start and target in the result. This simplifies a lot of code in QueryBuilderParser.php This also always loads the target table data now (which we want) * Make bill_id the PRIMARY index for the bills table * Load macros from a json file in misc instead of the database. * Fix whitespace and wrong key for collection. * Handle IN properly when generating SQL * Fix glue (devices.device_id = ports.port_id) is incorrect :D Show ALL tables we can resolve relationships for in the query builder filter. * Remove all macros from the database Remove insert statements, leave updates to update user's existing rules.
85 lines
4.1 KiB
Markdown
85 lines
4.1 KiB
Markdown
source: Alerting/Rules.md
|
|
|
|
# Rules
|
|
Rules are defined using a logical language.
|
|
|
|
The GUI provides a simple way of creating rules.
|
|
|
|
Creating more complicated rules which may include maths calculations and MySQL queries can be done using [macros](Macros.md)
|
|
|
|
#### Video on how the alert rules work in LibreNMS
|
|
[Alert Rules](https://youtu.be/ryv0j8GEkhM)
|
|
#### Video on how to use alert rule with wildcards
|
|
[Alert Rules wildcard](https://youtu.be/eYYioFNcrAk)
|
|
|
|
## Syntax
|
|
Rules must consist of at least 3 elements: An __Entity__, a __Condition__ and a __Value__.
|
|
Rules can contain braces and __Glues__.
|
|
__Entities__ are provided from Table and Field from the database. For Example: `ports.ifOperStatus`.
|
|
|
|
__Conditions__ can be any of:
|
|
|
|
- Equals `=`
|
|
- Not Equals `!=`
|
|
- In `IN`
|
|
- Not In `NOT IN`
|
|
- Begins with `LIKE ('%...')`
|
|
- Doesn't begin with `NOT LIKE ('%...')`
|
|
- Contains `LIKE ('%...%')`
|
|
- Doesn't Contain `NOT LIKE ('%...%')`
|
|
- Ends with `LIKE ('...%')`
|
|
- Doesn't end with `NOT LIKE ('...%')`
|
|
- Between `BETWEEN`
|
|
- Not Between `NOT BETWEEN`
|
|
- Is Empty `= ''`
|
|
- Is Not Empty `!= '''`
|
|
- Is Null `IS NULL`
|
|
- Is Not Null `IS NOT NULL`
|
|
- Greater `>`
|
|
- Greater or Equal `>=`
|
|
- Less `<`
|
|
- Less or Equal `<=`
|
|
- Regex `REGEXP`
|
|
|
|
__Values__ can be an entity or any data.
|
|
|
|
__Note__: Regex supports MySQL Regular expressions
|
|
|
|
Arithmetics are allowed as well.
|
|
|
|
# Options
|
|
|
|
Here are some of the other options available when adding an alerting rule:
|
|
|
|
- Rule name: The name associated with the rule.
|
|
- Severity: How "important" the rule is.
|
|
- Max alerts: The maximum number of alerts sent for the event. `-1` means unlimited.
|
|
- Delay: The amount of time in seconds to wait after a rule is matched before sending an alert out transport.
|
|
- Interval: The interval of time in seconds between alerts for an event until Max alert is reached.
|
|
- Mute alerts: Disables sending alert rule through alert transport. But will still show the alert in the Web UI.
|
|
- Invert match: Invert the matching rule (ie. alert on items that _don't_ match the rule).
|
|
|
|
## Procedure
|
|
You can associate a rule to a procedure by giving the URL of the procedure when creating the rule. Only links like "http://" are supported, otherwise an error will be returned. Once configured, procedure can be opened from the Alert widget through the "Open" button, which can be shown/hidden from the widget configuration box.
|
|
|
|
## Examples
|
|
|
|
Alert when:
|
|
|
|
- Device goes down: `devices.status = 1`
|
|
- Any port changes: `ports.ifOperStatus != 'up'`
|
|
- Root-directory gets too full: `storage.storage_descr = '/' AND storage.storage_perc >= '75'`
|
|
- Any storage gets fuller than the 'warning': `storage.storage_perc >= storage_perc_warn`
|
|
- If device is a server and the used storage is above the warning level, but ignore /boot partitions: `storage.storage_perc > storage.storage_perc_warn AND devices.type = "server" AND storage.storage_descr != "/boot"`
|
|
- VMware LAG is not using "Source ip address hash" load balancing: `devices.os = "vmware" AND ports.ifType = "ieee8023adLag" AND ports.ifDescr REGEXP "Link Aggregation .*, load balancing algorithm: Source ip address hash"`
|
|
- Syslog, authentication failure during the last 5m: `syslog.timestamp >= macros.past_5m AND syslog.msg REGEXP ".*authentication failure.*"`
|
|
- High memory usage: `macros.device_up = 1 AND mempools.mempool_perc >= 90 AND mempools.mempool_descr REGEXP "Virtual.*"`
|
|
- High CPU usage(per core usage, not overall): `macros.device_up = 1 AND processors.processor_usage >= 90`
|
|
- High port usage, where description is not client & ifType is not softwareLoopback: `macros.port_usage_perc >= 80 AND port.port_descr_type != "client" AND ports.ifType != "softwareLoopback"`
|
|
- Alert when mac address is located on your network `ipv4_mac.mac_address = "2c233a756912"`
|
|
|
|
### Alert Rules Collection
|
|
You can also select Alert Rule from the Alerts Collection. These Alert Rules are submitted by users in the community :)
|
|
If would like to submit your alert rules to the collection, please submit them here [Alert Rules Collection](https://github.com/librenms/librenms/blob/master/misc/alert_rules.json)
|
|
|