diff mbox series

[3/5] Set zabbix_pending flag when storing new event in DB

Message ID 20260730195148.3278295-4-robin.roevens@disroot.org
State New
Headers
Series Add Zabbix functionality to suricata-reporter |

Commit Message

Robin Roevens 30 Jul 2026, 7:15 p.m. UTC 
When sending to zabbix is enabled, we need to set the zabbix_pending flag set 
on each new event written to the database.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
---
 src/suricata-reporter.in | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

Comments

Michael Tremer 31 Jul 2026, 10:24 a.m. UTC | #1 
Hello,

The same goes here. Let the database do what it is doing well.

Instead of figuring out whether Zabbix is enabled or not, you could simply change the “DEFAULT” of the field to “true” and leave the INSERT statement unmodified. If someone enables Zabbix afterwards, the downside would be to receive all events from the past. I am not sure if that is a big disadvantage?!

I am thinking towards the future where we could have many more monitoring solutions added here, so for each of them we would have to query the status and adjust the statement. That could become somewhat expensive.

-Michael

> On 30 Jul 2026, at 20:15, Robin Roevens <robin.roevens@disroot.org> wrote:
> 
> When sending to zabbix is enabled, we need to set the zabbix_pending flag set 
> on each new event written to the database.
> 
> Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
> ---
> src/suricata-reporter.in | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/src/suricata-reporter.in b/src/suricata-reporter.in
> index 83e4e97..78bb04d 100644
> --- a/src/suricata-reporter.in
> +++ b/src/suricata-reporter.in
> @@ -314,9 +314,14 @@ class Reporter(object):
> """
> Writes a single event to the database
> """
> + # Determine whether this event should be marked for Zabbix delivery
> + zabbix_pending = 1 if self.config.getboolean('zabbix', 'enabled', fallback=False) else 0
> +
> # Write the event to the database
> - self.db.execute("INSERT INTO alerts(timestamp, event) VALUES(?, ?)",
> - (event.timestamp.timestamp(), event.json))
> + self.db.execute(
> + "INSERT INTO alerts(timestamp, event, zabbix_pending) VALUES(?, ?, ?)",
> + (event.timestamp.timestamp(), event.json, zabbix_pending)
> + )
> 
> # Commit it straight away
> self.db.commit()
> -- 
> 2.54.0
> 
> 
> -- 
> Dit bericht is gescanned op virussen en andere gevaarlijke
> inhoud door MailScanner en lijkt schoon te zijn.
> 
>
diff mbox series

Patch

diff --git a/src/suricata-reporter.in b/src/suricata-reporter.in
index 83e4e97..78bb04d 100644
--- a/src/suricata-reporter.in
+++ b/src/suricata-reporter.in
@@ -314,9 +314,14 @@  class Reporter(object):
 		"""
 			Writes a single event to the database
 		"""
+		# Determine whether this event should be marked for Zabbix delivery
+		zabbix_pending = 1 if self.config.getboolean('zabbix', 'enabled', fallback=False) else 0
+
 		# Write the event to the database
-		self.db.execute("INSERT INTO alerts(timestamp, event) VALUES(?, ?)",
-			(event.timestamp.timestamp(), event.json))
+		self.db.execute(
+			"INSERT INTO alerts(timestamp, event, zabbix_pending) VALUES(?, ?, ?)",
+			(event.timestamp.timestamp(), event.json, zabbix_pending)
+		)
 
 		# Commit it straight away
 		self.db.commit()