Enhance SQL templates to prevent duplicate notifications for 'Down Reconnected' devices in event section

This commit is contained in:
Jokob @NetAlertX
2026-03-18 09:57:20 +00:00
parent b311113575
commit d7c7bd2cd2
2 changed files with 25 additions and 5 deletions

View File

@@ -83,15 +83,22 @@ SQL_TEMPLATES = {
"down_reconnected": """
SELECT
devName,
eveMac,
reconnected_devices.eveMac,
devVendor,
eveIp,
eveDateTime,
eveEventType,
reconnected_devices.eveIp,
reconnected_devices.eveDateTime,
reconnected_devices.eveEventType,
devComments
FROM Events_Devices AS reconnected_devices
WHERE reconnected_devices.eveEventType = 'Down Reconnected'
AND reconnected_devices.evePendingAlertEmail = 1
AND NOT EXISTS (
SELECT 1 FROM Events AS newer
WHERE newer.eveMac = reconnected_devices.eveMac
AND newer.eveEventType = 'Down Reconnected'
AND newer.evePendingAlertEmail = 1
AND newer.eveDateTime > reconnected_devices.eveDateTime
)
ORDER BY reconnected_devices.eveDateTime
""",
"events": """
@@ -105,7 +112,7 @@ SQL_TEMPLATES = {
devComments
FROM Events_Devices
WHERE evePendingAlertEmail = 1
AND eveEventType IN ('Connected', 'Down Reconnected', 'Disconnected','IP Changed') {condition}
AND eveEventType IN ({event_types}) {condition}
ORDER BY eveDateTime
""",
"plugins": """

View File

@@ -198,6 +198,14 @@ def get_notifications(db):
format_vars = {"condition": safe_condition}
if section == "down_devices":
format_vars["alert_down_minutes"] = alert_down_minutes
if section == "events":
# 'Down Reconnected' has its own dedicated section; exclude it
# from events when that section is also active to prevent the
# same device appearing twice with different IP sources.
if "down_reconnected" in sections:
format_vars["event_types"] = "'Connected', 'Disconnected','IP Changed'"
else:
format_vars["event_types"] = "'Connected', 'Down Reconnected', 'Disconnected','IP Changed'"
sqlQuery = template.format(**format_vars)
except Exception as e:
@@ -205,6 +213,11 @@ def get_notifications(db):
fallback_vars = {"condition": ""}
if section == "down_devices":
fallback_vars["alert_down_minutes"] = alert_down_minutes
if section == "events":
if "down_reconnected" in sections:
fallback_vars["event_types"] = "'Connected', 'Disconnected','IP Changed'"
else:
fallback_vars["event_types"] = "'Connected', 'Down Reconnected', 'Disconnected','IP Changed'"
sqlQuery = template.format(**fallback_vars)
parameters = {}