/**
* Describe Alert
* @param array $alert Alert-Result from DB
* @return array
*/
function DescribeAlert($alert)
{
$obj = array();
$i = 0;
$device = dbFetchRow('SELECT hostname FROM devices WHERE device_id = ?', array($alert['device_id']));
$tpl = dbFetchRow('SELECT `template`,`title`,`title_rec` FROM `alert_templates` JOIN `alert_template_map` ON `alert_template_map`.`alert_templates_id`=`alert_templates`.`id` WHERE `alert_template_map`.`alert_rule_id`=?', array($alert['rule_id']));
$default_tpl = "%title\r\nSeverity: %severity\r\n{if %state == 0}Time elapsed: %elapsed\r\n{/if}Timestamp: %timestamp\r\nUnique-ID: %uid\r\nRule: {if %name}%name{else}%rule{/if}\r\n{if %faults}Faults:\r\n{foreach %faults} #%key: %value.string\r\n{/foreach}{/if}Alert sent to: {foreach %contacts}%value <%key> {/foreach}";
$obj['hostname'] = $device['hostname'];
$obj['device_id'] = $alert['device_id'];
$extra = $alert['details'];
if (!isset($tpl['template'])) {
$obj['template'] = $default_tpl;
} else {
$obj['template'] = $tpl['template'];
}
if ($alert['state'] >= 1) {
if (!empty($tpl['title'])) {
$obj['title'] = $tpl['title'];
} else {
$obj['title'] = 'Alert for device ' . $device['hostname'] . ' - ' . ($alert['name'] ? $alert['name'] : $alert['rule']);
}
if ($alert['state'] == 2) {
$obj['title'] .= ' got acknowledged';
} elseif ($alert['state'] == 3) {
$obj['title'] .= ' got worse';
} elseif ($alert['state'] == 4) {
$obj['title'] .= ' got better';
}
foreach ($extra['rule'] as $incident) {
$i++;
$obj['faults'][$i] = $incident;
foreach ($incident as $k => $v) {
if (!empty($v) && $k != 'device_id' && (stristr($k, 'id') || stristr($k, 'desc') || stristr($k, 'msg')) && substr_count($k, '_') <= 1) {
$obj['faults'][$i]['string'] .= $k . ' => ' . $v . '; ';
}
}
}
$obj['elapsed'] = TimeFormat(time() - strtotime($alert['time_logged']));
if (!empty($extra['diff'])) {
$obj['diff'] = $extra['diff'];
}
} elseif ($alert['state'] == 0) {
$id = dbFetchRow('SELECT alert_log.id,alert_log.time_logged,alert_log.details FROM alert_log WHERE alert_log.state != 2 && alert_log.state != 0 && alert_log.rule_id = ? && alert_log.device_id = ? && alert_log.id < ? ORDER BY id DESC LIMIT 1', array($alert['rule_id'], $alert['device_id'], $alert['id']));
if (empty($id['id'])) {
return false;
}
$extra = json_decode(gzuncompress($id['details']), true);
if (!empty($tpl['title_rec'])) {
$obj['title'] = $tpl['title_rec'];
} else {
$obj['title'] = 'Device ' . $device['hostname'] . ' recovered from ' . ($alert['name'] ? $alert['name'] : $alert['rule']);
}
$obj['elapsed'] = TimeFormat(strtotime($alert['time_logged']) - strtotime($id['time_logged']));
$obj['id'] = $id['id'];
$obj['faults'] = false;
} else {
return 'Unknown State';
}
//end if
$obj['uid'] = $alert['id'];
$obj['severity'] = $alert['severity'];
$obj['rule'] = $alert['rule'];
$obj['name'] = $alert['name'];
$obj['timestamp'] = $alert['time_logged'];
$obj['contacts'] = $extra['contacts'];
$obj['state'] = $alert['state'];
if (strstr($obj['title'], '%')) {
$obj['title'] = RunJail('$ret = "' . populate(addslashes($obj['title'])) . '";', $obj);
}
return $obj;
}
/**
* Format Alert
* @param string $tpl Template
* @param array $obj Alert-Array
* @return string
*/
function FormatAlertTpl($tpl, $obj)
{
$msg = '$ret .= "' . str_replace(array('{else}', '{/if}', '{/foreach}'), array('"; } else { $ret .= "', '"; } $ret .= "', '"; } $ret .= "'), addslashes($tpl)) . '";';
$parsed = $msg;
$s = strlen($msg);
$x = $pos = -1;
$buff = '';
$if = $for = false;
while (++$x < $s) {
if ($msg[$x] == '{' && $buff == '') {
$buff .= $msg[$x];
} else {
if ($buff == '{ ') {
$buff = '';
} else {
if ($buff != '') {
$buff .= $msg[$x];
}
}
}
if ($buff == '{if') {
$pos = $x;
$if = true;
} else {
if ($buff == '{foreach') {
$pos = $x;
$for = true;
}
}
if ($pos != -1 && $msg[$x] == '}') {
$orig = $buff;
$buff = '';
$pos = -1;
if ($if) {
$if = false;
$o = 3;
$native = array('"; if( ', ' ) { $ret .= "');
} else {
if ($for) {
$for = false;
$o = 8;
$native = array('"; foreach( ', ' as $key=>$value) { $ret .= "');
} else {
continue;
}
}
$cond = trim(populate(substr($orig, $o, -1), false));
$native = $native[0] . $cond . $native[1];
$parsed = str_replace($orig, $native, $parsed);
unset($cond, $o, $orig, $native);
}
//end if
}
//end while
$parsed = populate($parsed);
return RunJail($parsed, $obj);
}