Skip to content

Operational features round 1 - #371

Merged
TheWitness merged 6 commits into
developfrom
feature/operational-hardening
Sep 22, 2026
Merged

TheWitness merged 6 commits into
developfrom
feature/operational-hardening

Conversation

@bmfmancini

Copy link
Copy Markdown
Member
  • feature: Add a fail-safe for partition maintenance: when the partition metadata for the syslog or syslog_removed table is invalid or incomplete, or a required partition cannot be created, all partition creation and retention pruning stops, the dMaxValue safety partition is never dropped, and the blocked condition with its remediation step is logged and shown on the Syslog Status page
  • feature: Add bounded multi-day partition recovery: a new 'Partition Recovery Limit' setting caps how many missing partitions are created per table per poller run so large gaps heal over several cycles; retention pruning stays deferred until the future write horizon is restored, and each blocked run reports the remaining gap, the stop reason, and whether writes are accumulating in dMaxValue
  • feature: Add collector health metrics to the Syslog Status tab: last received log timestamp, oldest unprocessed incoming message age, current incoming backlog, records processed in the latest run, and a warning when data looks stale or the backlog exceeds the new 'Collector Staleness' and 'Collector Backlog Threshold' settings; unavailable metrics read as Unavailable instead of invented values
  • feature: Add per phase processing telemetry: the poller records start time, end time, duration, and processed count for partition maintenance, reference updates, removal rules, alert evaluation, incoming transfer, and report processing through the syslog_status table; the Syslog Status tab shows the latest phase timings and highlights the slowest phase
  • feature: Add a 'Test rule' action to the Alert and Removal rule editors: a read-only preview compiled through the existing QueryBuilder and parameterized SQL paths returns the matching count plus a bounded sample of escaped messages, without saving, enabling, deleting, alerting, emailing, executing commands, or altering any data; the action respects realms and CSRF protection

…ase telemetry, and rule preview

- Partition maintenance fail-safe: syslog_partition_manage() stops all
  partition actions when metadata is invalid or a required partition
  cannot be created; the dMaxValue safety partition is never dropped;
  blocked maintenance is logged with a remediation step and shown on
  the Syslog Status page.
- Bounded multi-day partition recovery: a new 'Partition Recovery
  Limit' setting caps partitions created per table per poller run;
  recovery runs sequentially for syslog and syslog_removed, retention
  pruning stays deferred until the future write horizon exists, and
  each blocked run reports the gap, stop reason, and dMaxValue risk.
- Collector health on Syslog Status: last received log timestamp,
  oldest unprocessed incoming age, incoming backlog, records processed
  in the latest run, and warnings driven by the new 'Collector
  Staleness' and 'Collector Backlog Threshold' settings; unavailable
  metrics read as Unavailable.
- Per-phase processing telemetry: partition maintenance, reference
  updates, removal rules, alert evaluation, incoming transfer, and
  report processing record start/end/duration/count through the
  syslog_status mechanism; Syslog Status shows phase timings and the
  slowest phase.
- Rule preview: a 'Test rule' action in the alert and removal editors
  compiles the rule through the existing QueryBuilder/parameterized
  paths and returns a bounded, escaped preview without any side
  effects; gated on realms and CSRF.

Tests: 142 passed (667 assertions) via Pest; php -l clean on all files;
standalone tests/regression scripts pass; locales/po/cacti.pot
regenerated with locales/build_gettext.sh
TheWitness
TheWitness previously approved these changes Sep 22, 2026
@TheWitness
TheWitness merged commit 35ba2f7 into develop Sep 22, 2026
7 checks passed
@TheWitness
TheWitness deleted the feature/operational-hardening branch September 22, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants