updated default values for tevent_rule, new tokens for correlated alerts

This commit is contained in:
fbsanchez 2019-11-21 17:47:21 +01:00
parent 66035a8b67
commit 362837f856
5 changed files with 14 additions and 3 deletions

View File

@ -8,6 +8,9 @@ INSERT INTO `ttipo_modulo` VALUES
(36,'remote_cmd_string', 10, 'Remote execution, alphanumeric data', 'mod_remote_cmd_string.png'), (36,'remote_cmd_string', 10, 'Remote execution, alphanumeric data', 'mod_remote_cmd_string.png'),
(37,'remote_cmd_inc', 10, 'Remote execution, incremental data', 'mod_remote_cmd_inc.png'); (37,'remote_cmd_inc', 10, 'Remote execution, incremental data', 'mod_remote_cmd_inc.png');
ALTER TABLE `tevent_rule` MODIFY COLUMN `event_type` enum('','unknown','alert_fired','alert_recovered','alert_ceased','alert_manual_validation','recon_host_detected','system','error','new_agent','going_up_warning','going_up_critical','going_down_warning','going_down_normal','going_down_critical','going_up_normal') default '';
ALTER TABLE `tevent_rule` MODIFY COLUMN `criticity` int(4) unsigned NOT NULL default '99';
ALTER TABLE `tevent_rule` ADD COLUMN `log_content` TEXT; ALTER TABLE `tevent_rule` ADD COLUMN `log_content` TEXT;
ALTER TABLE `tevent_rule` ADD COLUMN `log_source` TEXT; ALTER TABLE `tevent_rule` ADD COLUMN `log_source` TEXT;
ALTER TABLE `tevent_rule` ADD COLUMN `log_agent` TEXT; ALTER TABLE `tevent_rule` ADD COLUMN `log_agent` TEXT;

View File

@ -580,7 +580,8 @@ ALTER TABLE `tevent_rule` ADD COLUMN `operator_id_tag` text COMMENT 'Operator fo
ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_content` text COMMENT 'Operator for log_content'; ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_content` text COMMENT 'Operator for log_content';
ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_source` text COMMENT 'Operator for log_source'; ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_source` text COMMENT 'Operator for log_source';
ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_agent` text COMMENT 'Operator for log_agent'; ALTER TABLE `tevent_rule` ADD COLUMN `operator_log_agent` text COMMENT 'Operator for log_agent';
ALTER TABLE `tevent_rule` MODIFY COLUMN `event_type` enum('','unknown','alert_fired','alert_recovered','alert_ceased','alert_manual_validation','recon_host_detected','system','error','new_agent','going_up_warning','going_up_critical','going_down_warning','going_down_normal','going_down_critical','going_up_normal') default '';
ALTER TABLE `tevent_rule` MODIFY COLUMN `criticity` int(4) unsigned NOT NULL default '99';
-- ----------------------------------------------------- -- -----------------------------------------------------
-- Table `tevent_alert` -- Table `tevent_alert`

View File

@ -2774,10 +2774,10 @@ CREATE TABLE IF NOT EXISTS `tevent_rule` (
`id_usuario` varchar(100) NOT NULL default '', `id_usuario` varchar(100) NOT NULL default '',
`id_grupo` mediumint(4) NOT NULL default '0', `id_grupo` mediumint(4) NOT NULL default '0',
`evento` text NOT NULL default '', `evento` text NOT NULL default '',
`event_type` enum('','unknown','alert_fired','alert_recovered','alert_ceased','alert_manual_validation','recon_host_detected','system','error','new_agent','going_up_warning','going_up_critical','going_down_warning','going_down_normal','going_down_critical','going_up_normal') default 'unknown', `event_type` enum('','unknown','alert_fired','alert_recovered','alert_ceased','alert_manual_validation','recon_host_detected','system','error','new_agent','going_up_warning','going_up_critical','going_down_warning','going_down_normal','going_down_critical','going_up_normal') default '',
`module` text default '', `module` text default '',
`alert` text default '', `alert` text default '',
`criticity` int(4) unsigned NOT NULL default '0', `criticity` int(4) unsigned NOT NULL default '99',
`user_comment` text NOT NULL, `user_comment` text NOT NULL,
`id_tag` integer(10) unsigned NOT NULL default '0', `id_tag` integer(10) unsigned NOT NULL default '0',
`name` text default '', `name` text default '',

View File

@ -457,6 +457,9 @@ event_window 3600
log_window 3600 log_window 3600
# Pre-load windows on start with available information. (PANDORA FMS ENTERPRISE ONLY).
#preload_windows 0
# If set to 1, an alert will not be fired if the last event it generated is in 'in-process' status. # If set to 1, an alert will not be fired if the last event it generated is in 'in-process' status.
event_inhibit_alerts 0 event_inhibit_alerts 0

View File

@ -304,6 +304,7 @@ sub pandora_load_config {
$pa_config->{"eventserver"} = 1; # 4.0 $pa_config->{"eventserver"} = 1; # 4.0
$pa_config->{"event_window"} = 3600; # 4.0 $pa_config->{"event_window"} = 3600; # 4.0
$pa_config->{"log_window"} = 3600; # 7.741 $pa_config->{"log_window"} = 3600; # 7.741
$pa_config->{"preload_windows"} = 0; # 7.741
$pa_config->{"icmpserver"} = 0; # 4.0 $pa_config->{"icmpserver"} = 0; # 4.0
$pa_config->{"icmp_threads"} = 3; # 4.0 $pa_config->{"icmp_threads"} = 3; # 4.0
$pa_config->{"snmpserver"} = 0; # 4.0 $pa_config->{"snmpserver"} = 0; # 4.0
@ -984,6 +985,9 @@ sub pandora_load_config {
elsif ($parametro =~ m/^log_window\s+([0-9]*)/i) { elsif ($parametro =~ m/^log_window\s+([0-9]*)/i) {
$pa_config->{'log_window'}= clean_blank($1); $pa_config->{'log_window'}= clean_blank($1);
} }
elsif ($parametro =~ m/^preload_windows\s+([0-9]*)/i) {
$pa_config->{'preload_windows'}= clean_blank($1);
}
elsif ($parametro =~ m/^snmp_threads\s+([0-9]*)/i) { elsif ($parametro =~ m/^snmp_threads\s+([0-9]*)/i) {
$pa_config->{'snmp_threads'}= clean_blank($1); $pa_config->{'snmp_threads'}= clean_blank($1);
} }