Fix Alert diff, Add new AlertStatus changed, Fix AlertLog UI not showing the correct details (librenms#16313)

* Fix alert diff and add new status changed

* Fix for styleci

* Fix for styleci2

* Fix PHP Static Analysis

* Fix for styleci3

* Fix PHP Static 2

* Typo

* Fix the UI as it wouldn't fetch the correct details

* Fix the UI for clear/resolved

* Ignore PHPStan as dbFetchRows is already in use in this file and some improvements for the eventlog UI variable names

* Typo

* A more robust method of comparison

* Fix styleci

* Fix rename missing

* Fix PHP Static Analysis

* Fix typo when AlertState Better

* Add failsafe and improve diffBetweenFaults

* Fix style & PHP Static Analysis

* Add back the default $state

* Remove the else as we need to let go a "not changed"

* Change UI "title" for the modifications

* Fix doc

* Fix merge conflict

* Fake rollback for conflict

* Update again for conflict

* Update again for conflict

* Rename "got changed" to "changed"

* Some language changes

---------

Co-authored-by: Neil Lathwood <[email protected]>

Author: Calvario

LibreNMS/Alert/RunAlerts.php

@@ -141,6 +141,8 @@ public function describeAlert($alert)
                 $obj['title'] .= ' Has worsened';
             } elseif ($alert['state'] == AlertState::BETTER) {
                 $obj['title'] .= ' Has improved';
+            } elseif ($alert['state'] == AlertState::CHANGED) {
+                $obj['title'] .= ' changed';
             }
 
             foreach ($extra['rule'] as $incident) {
@@ -308,28 +310,45 @@ public function runFollowUp()
                 }
                 $chk = dbFetchRows($alert['query'], [$alert['device_id']]);
                 //make sure we can json_encode all the datas later
-                $cnt = count($chk);
-                for ($i = 0; $i < $cnt; $i++) {
+                $current_alert_count = count($chk);
+                for ($i = 0; $i < $current_alert_count; $i++) {
                     if (isset($chk[$i]['ip'])) {
                         $chk[$i]['ip'] = inet6_ntop($chk[$i]['ip']);
                     }
                 }
                 $alert['details']['rule'] ??= []; // if details.rule is missing, set it to an empty array
-                $o = count($alert['details']['rule']);
-                $n = count($chk);
                 $ret = 'Alert #' . $alert['id'];
                 $state = AlertState::CLEAR;
-                if ($n > $o) {
-                    $ret .= ' Worsens';
+
+                // Get the added and resolved items
+                [$added_diff, $resolved_diff] = $this->diffBetweenFaults($alert['details']['rule'], $chk);
+                $previous_alert_count = count($alert['details']['rule']);
+
+                if (! empty($added_diff) && ! empty($resolved_diff)) {
+                    $ret .= ' Changed';
+                    $state = AlertState::CHANGED;
+                    $alert['details']['diff'] = ['added' => $added_diff, 'resolved' => $resolved_diff];
+                } elseif (! empty($added_diff)) {
+                    $ret .= ' Worse';
                     $state = AlertState::WORSE;
-                    $alert['details']['diff'] = array_diff($chk, $alert['details']['rule']);
-                } elseif ($n < $o) {
-                    $ret .= ' Betters';
+                    $alert['details']['diff'] = ['added' => $added_diff];
+                } elseif (! empty($resolved_diff)) {
+                    $ret .= ' Better';
                     $state = AlertState::BETTER;
-                    $alert['details']['diff'] = array_diff($alert['details']['rule'], $chk);
+                    $alert['details']['diff'] = ['resolved' => $resolved_diff];
+                // Failsafe if the diff didn't return any results
+                } elseif ($current_alert_count > $previous_alert_count) {
+                    $ret .= ' Worse';
+                    $state = AlertState::WORSE;
+                    Eventlog::log('Alert got worse but the diff was not, ensure that a "id" or "_id" field is available for rule ' . $alert['name'], $alert['device_id'], 'alert', Severity::Warning);
+                // Failsafe if the diff didn't return any results
+                } elseif ($current_alert_count < $previous_alert_count) {
+                    $ret .= ' Better';
+                    $state = AlertState::BETTER;
+                    Eventlog::log('Alert got better but the diff was not, ensure that a "id" or "_id" field is available for rule ' . $alert['name'], $alert['device_id'], 'alert', Severity::Warning);
                 }
 
-                if ($state > AlertState::CLEAR && $n > 0) {
+                if ($state > AlertState::CLEAR && $current_alert_count > 0) {
                     $alert['details']['rule'] = $chk;
                     if (dbInsert([
                         'state' => $state,
@@ -340,12 +359,83 @@ public function runFollowUp()
                         dbUpdate(['state' => $state, 'open' => 1, 'alerted' => 1], 'alerts', 'rule_id = ? && device_id = ?', [$alert['rule_id'], $alert['device_id']]);
                     }
 
-                    echo $ret . ' (' . $o . '/' . $n . ")\r\n";
+                    echo $ret . ' (' . $previous_alert_count . '/' . $current_alert_count . ")\r\n";
                 }
             }
         }
     }
 
+    /**
+     * Extract the fields that are used to identify the elements in the array of a "fault"
+     *
+     * @param  array  $element
+     * @return array
+     */
+    private function extractIdFieldsForFault($element)
+    {
+        return array_filter(array_keys($element), function ($key) {
+            // Exclude location_id as it is not relevant for the comparison
+            return ($key === 'id' || strpos($key, '_id')) !== false && $key !== 'location_id';
+        });
+    }
+
+    /**
+     * Generate a comparison key for an element based on the fields that identify it for a "fault"
+     *
+     * @param  array  $element
+     * @param  array  $idFields
+     * @return string
+     */
+    private function generateComparisonKeyForFault($element, $idFields)
+    {
+        $keyParts = [];
+        foreach ($idFields as $field) {
+            $keyParts[] = isset($element[$field]) ? $element[$field] : '';
+        }
+
+        return implode('|', $keyParts);
+    }
+
+    /**
+     * Find new elements in the array for faults
+     * PHP array_diff is not working well for it
+     *
+     * @param  array  $array1
+     * @param  array  $array2
+     * @return array [$added, $removed]
+     */
+    private function diffBetweenFaults($array1, $array2)
+    {
+        $array1_keys = [];
+        $added_elements = [];
+        $removed_elements = [];
+
+        // Create associative array for quick lookup of $array1 elements
+        foreach ($array1 as $element1) {
+            $element1_ids = $this->extractIdFieldsForFault($element1);
+            $element1_key = $this->generateComparisonKeyForFault($element1, $element1_ids);
+            $array1_keys[$element1_key] = $element1;
+        }
+
+        // Iterate through $array2 and determine added elements
+        foreach ($array2 as $element2) {
+            $element2_ids = $this->extractIdFieldsForFault($element2);
+            $element2_key = $this->generateComparisonKeyForFault($element2, $element2_ids);
+
+            if (! isset($array1_keys[$element2_key])) {
+                $added_elements [] = $element2;
+            } else {
+                // Remove matched elements
+                unset($array1_keys[$element2_key]);
+            }
+        }
+
+        // Remaining elements in $array1_keys are the removed elements
+        $removed_elements = array_values($array1_keys);
+
+        return [$added_elements, $removed_elements];
+    }
+
     public function loadAlerts($where)
     {
         $alerts = [];
@@ -439,7 +529,7 @@ public function runAlerts()
                     }
                 }
 
-                if (in_array($alert['state'], [AlertState::ACTIVE, AlertState::WORSE, AlertState::BETTER]) && ! empty($rextra['count']) && ($rextra['count'] == -1 || $alert['details']['count']++ < $rextra['count'])) {
+                if (in_array($alert['state'], [AlertState::ACTIVE, AlertState::WORSE, AlertState::BETTER, AlertState::CHANGED]) && ! empty($rextra['count']) && ($rextra['count'] == -1 || $alert['details']['count']++ < $rextra['count'])) {
                     // We don't want -1 alert rule count alarms to get muted because of the current alert count
                     if ($alert['details']['count'] < $rextra['count'] || $rextra['count'] == -1) {
                         $noacc = true;
@@ -556,6 +646,7 @@ public function alertLog($result, $obj, $transport)
             AlertState::ACKNOWLEDGED => 'acknowledgment',
             AlertState::WORSE => 'worsened',
             AlertState::BETTER => 'improved',
+            AlertState::CHANGED => 'changed',
         ];
 
         $severity = match ($obj['state']) {

LibreNMS/Alert/Transport.php

@@ -92,6 +92,7 @@ public static function getColorForState($state)
             AlertState::ACKNOWLEDGED => Config::get('alert_colour.acknowledged'),
             AlertState::WORSE => Config::get('alert_colour.worse'),
             AlertState::BETTER => Config::get('alert_colour.better'),
+            AlertState::CHANGED => Config::get('alert_colour.changed'),
         ];
 
         return isset($colors[$state]) ? $colors[$state] : '#337AB7';

LibreNMS/Enum/AlertState.php

@@ -32,5 +32,6 @@ abstract class AlertState
     const ACKNOWLEDGED = 2;
     const WORSE = 3;
     const BETTER = 4;
+    const CHANGED = 5;
     const RECOVERED = 0;
 }

app/Http/Controllers/Widgets/AlertsController.php

@@ -70,6 +70,7 @@ public function getSettingsView(Request $request)
             'acknowledged' => '2',
             'worse' => '3',
             'better' => '4',
+            'changed' => '5',
         ];
 
         return view('widgets.settings.alerts', $data);

doc/API/Alerts.md

@@ -45,7 +45,7 @@ Route: `/api/v0/alerts/:id`
 
 - id is the alert id, you can obtain a list of alert ids from [`list_alerts`](#list_alerts).
 - note is the note to add to the alert
-- until_clear is a boolean and if set to false, the alert will re-alert if it worsens/betters.
+- until_clear is a boolean and if set to false, the alert will re-alert if it gets worse/better or changes.
 
 Input:
 

doc/Alerting/Transports.md

@@ -870,7 +870,7 @@ websrv08.dc4.eu.corp.example.net gets shortened to websrv08.dc4.eu.cen).
 - Sensu will reject rules with special characters - the Transport will attempt
 to fix up rule names, but it's best to stick to letters, numbers and spaces
 - The transport only deals in absolutes - it ignores the got worse/got better
-states
+/changed states
 - The agent will buffer alerts, but LibreNMS will not - if your agent is
 offline, alerts will be dropped
 - There is no backchannel between Sensu and LibreNMS - if you make changes in

doc/Alerting/index.md

@@ -36,8 +36,8 @@ alerts. Click this icon to acknowledge the alert.
 until the alert clears. Click this icon to un-acknowledge the alert.
 
 ![unack alert until fault worsens](img/nunack.png) This alert is
-currently acknowledged until the alert worsens or gets
-better, at which stage it will be automatically unacknowledged and
+currently acknowledged until the alert worsens, gets
+better or changes, at which stage it will be automatically unacknowledged and
 alerts will resume. Click this icon to un-acknowledge the alert.
 
 ### Notes

includes/html/common/alert-log.inc.php

@@ -25,6 +25,7 @@
     //    'Acknowledged' => 2,
     'Worse' => 3,
     'Better' => 4,
+    'Changed' => 5,
 ];
 
 $alert_severities = [
@@ -124,6 +125,7 @@
                <option value="1">Alert</option> \
                <option value="3">Worse</option> \
                <option value="4">Better</option> \
+               <option value="5">Changed</option> \
                </select> \
                </div> \
                <div class="form-group"> \

includes/html/common/alerts.inc.php

@@ -22,6 +22,7 @@
     'acknowledged' => 2,
     'worse' => 3,
     'better' => 4,
+    'changed' => 5,
 ];
 
 $alert_severities = [