Re: [PATCH 3/5] Set zabbix_pending flag when storing new event in DB

[Michael Tremer <michael.tremer@ipfire.org>]

Hello,

The same goes here. Let the database do what it is doing well.

Instead of figuring out whether Zabbix is enabled or not, you could simply change the “DEFAULT” of the field to “true” and leave the INSERT statement unmodified. If someone enables Zabbix afterwards, the downside would be to receive all events from the past. I am not sure if that is a big disadvantage?!

I am thinking towards the future where we could have many more monitoring solutions added here, so for each of them we would have to query the status and adjust the statement. That could become somewhat expensive.

-Michael

> On 30 Jul 2026, at 20:15, Robin Roevens <robin.roevens@disroot.org> wrote:
> 
> When sending to zabbix is enabled, we need to set the zabbix_pending flag set 
> on each new event written to the database.
> 
> Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
> ---
> src/suricata-reporter.in | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/src/suricata-reporter.in b/src/suricata-reporter.in
> index 83e4e97..78bb04d 100644
> --- a/src/suricata-reporter.in
> +++ b/src/suricata-reporter.in
> @@ -314,9 +314,14 @@ class Reporter(object):
> """
> Writes a single event to the database
> """
> + # Determine whether this event should be marked for Zabbix delivery
> + zabbix_pending = 1 if self.config.getboolean('zabbix', 'enabled', fallback=False) else 0
> +
> # Write the event to the database
> - self.db.execute("INSERT INTO alerts(timestamp, event) VALUES(?, ?)",
> - (event.timestamp.timestamp(), event.json))
> + self.db.execute(
> + "INSERT INTO alerts(timestamp, event, zabbix_pending) VALUES(?, ?, ?)",
> + (event.timestamp.timestamp(), event.json, zabbix_pending)
> + )
> 
> # Commit it straight away
> self.db.commit()
> -- 
> 2.54.0
> 
> 
> -- 
> Dit bericht is gescanned op virussen en andere gevaarlijke
> inhoud door MailScanner en lijkt schoon te zijn.
> 
>