From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hBMdN2HvSz36VK for ; Fri, 31 Jul 2026 10:24:56 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hBMdB4v4Gz3785 for ; Fri, 31 Jul 2026 10:24:46 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hBMd21Trlz2sq; Fri, 31 Jul 2026 10:24:38 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1785493478; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WIU7swiDsXtGOqHbd++dQFS4W2Suy4qnyvu0P8SjZVI=; b=H5ELIcSY+Ypm+WRTsrQD7vjrxdbDwNjHNhzmkoqcYbK0thUi1ed+Ev7GunBcYCt32vAifd RVamhPODQ+OnFRAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1785493478; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WIU7swiDsXtGOqHbd++dQFS4W2Suy4qnyvu0P8SjZVI=; b=kmGkRCNuZXekq5avNsBj+m8URQtoDKu37QBISg5KQP3fNEYG1vO1DBD3mKXlbDVqerGiL3 UFgyKGMpYYQ/UfqzXqxzDKNJ51+Vfr9/eAwnb66oaxuSQgsW8z6KQ+Z8MujFHbfigRl9uY C3KxyYjwLYDT9IM1mzPzOMpYCeLebwEl9CCKh5vRIAkYJkFtry5MeCnHP74EqaePjlsiub +ihYYxI2b1yiARyNsBB0s6ChDhKiOyTGG9+jkiKM5yn8dwXyx8dlUR2+TcbHH3tNW3QeIW W0S1lqjH+UPUbUyN4q/Cnaw4s/jScanRYiCyhAuxLkxjb4dCLyiRGeJgUlQBww== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: [PATCH 3/5] Set zabbix_pending flag when storing new event in DB From: Michael Tremer In-Reply-To: <20260730195148.3278295-4-robin.roevens@disroot.org> Date: Fri, 31 Jul 2026 11:24:26 +0100 Cc: development@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: <326A4059-FE4A-4A4A-BB45-4A8C0A45EAA2@ipfire.org> References: <20260730195148.3278295-1-robin.roevens@disroot.org> <20260730195148.3278295-4-robin.roevens@disroot.org> To: Robin Roevens Hello, The same goes here. Let the database do what it is doing well. Instead of figuring out whether Zabbix is enabled or not, you could = simply change the =E2=80=9CDEFAULT=E2=80=9D of the field to =E2=80=9Ctrue=E2= =80=9D and leave the INSERT statement unmodified. If someone enables = Zabbix afterwards, the downside would be to receive all events from the = past. I am not sure if that is a big disadvantage?! I am thinking towards the future where we could have many more = monitoring solutions added here, so for each of them we would have to = query the status and adjust the statement. That could become somewhat = expensive. -Michael > On 30 Jul 2026, at 20:15, Robin Roevens = wrote: >=20 > When sending to zabbix is enabled, we need to set the zabbix_pending = flag set=20 > on each new event written to the database. >=20 > Signed-off-by: Robin Roevens > --- > src/suricata-reporter.in | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) >=20 > diff --git a/src/suricata-reporter.in b/src/suricata-reporter.in > index 83e4e97..78bb04d 100644 > --- a/src/suricata-reporter.in > +++ b/src/suricata-reporter.in > @@ -314,9 +314,14 @@ class Reporter(object): > """ > Writes a single event to the database > """ > + # Determine whether this event should be marked for Zabbix delivery > + zabbix_pending =3D 1 if self.config.getboolean('zabbix', 'enabled', = fallback=3DFalse) else 0 > + > # Write the event to the database > - self.db.execute("INSERT INTO alerts(timestamp, event) VALUES(?, ?)", > - (event.timestamp.timestamp(), event.json)) > + self.db.execute( > + "INSERT INTO alerts(timestamp, event, zabbix_pending) VALUES(?, ?, = ?)", > + (event.timestamp.timestamp(), event.json, zabbix_pending) > + ) >=20 > # Commit it straight away > self.db.commit() > --=20 > 2.54.0 >=20 >=20 > --=20 > Dit bericht is gescanned op virussen en andere gevaarlijke > inhoud door MailScanner en lijkt schoon te zijn. >=20 >=20