@oneuptime/common 11.5.9 → 11.5.10

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -47,6 +47,10 @@ import MonitorType from "../../../Types/Monitor/MonitorType";
 import { CheckOn, CriteriaFilter } from "../../../Types/Monitor/CriteriaFilter";
 import OneUptimeDate from "../../../Types/Date";
 import { JSONObject } from "../../../Types/JSON";
+import Dictionary from "../../../Types/Dictionary";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import MetricQueryConfigData from "../../../Types/Metrics/MetricQueryConfigData";
+import MetricExplorerUrl from "../../../Utils/Metrics/MetricExplorerUrl";
 import Typeof from "../../../Types/Typeof";
 import ReturnResult from "../../../Types/IsolatedVM/ReturnResult";
 import URL from "../../../Types/API/URL";
@@ -1330,23 +1334,23 @@ ${contextBlock}
     }
 
     /*
-     * Metric explorer expects a JSON-encoded `metricQueries` param plus
-     * optional start/end times. The shape is documented by
-     * MetricExplorer.getMetricQueriesFromQuery(): it reads metricName,
-     * attributes, and aggregationType (correctly spelled, unlike the
-     * internal persisted field).
+     * The explorer URL schema (metricQueries/startTime/endTime params)
+     * is owned by MetricExplorerUrl — the same module the explorer uses
+     * for its own URL round-trip — so this deep link can never drift
+     * from what the explorer parses.
      */
-    const aggregationType: string | undefined =
-      input.ctx.aggregationType || undefined;
-
-    const query: {
-      metricName: string;
-      attributes: JSONObject;
-      aggregationType?: string;
-    } = {
-      metricName: input.ctx.metricName,
-      attributes: input.ctx.filterAttributes || {},
-      ...(aggregationType ? { aggregationType } : {}),
+    const queryConfig: MetricQueryConfigData = {
+      metricQueryData: {
+        filterData: {
+          metricName: input.ctx.metricName,
+          attributes: MetricExplorerUrl.sanitizeAttributes(
+            input.ctx.filterAttributes,
+          ),
+          ...(input.ctx.aggregationType
+            ? { aggegationType: input.ctx.aggregationType }
+            : {}),
+        },
+      },
     };
 
     // Time window: breach moment +- 15 minutes (or fall back to last hour).
@@ -1359,10 +1363,18 @@ ${contextBlock}
       ? OneUptimeDate.addRemoveMinutes(breachTime, 15)
       : now;
 
+    const urlParams: Dictionary<string> =
+      MetricExplorerUrl.buildQueryParamsFromMetricViewData({
+        queryConfigs: [queryConfig],
+        formulaConfigs: [],
+        startAndEndDate: new InBetween(startTime, endTime),
+      });
+
     const params: URLSearchParams = new URLSearchParams();
-    params.set("metricQueries", JSON.stringify([query]));
-    params.set("startTime", OneUptimeDate.toString(startTime));
-    params.set("endTime", OneUptimeDate.toString(endTime));
+
+    for (const paramName in urlParams) {
+      params.set(paramName, urlParams[paramName] as string);
+    }
 
     /*
      * The route that actually reads these URL params is the metric

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -36,6 +36,9 @@ import ServiceService from "../../Services/ServiceService";
 import IncidentSeverityService from "../../Services/IncidentSeverityService";
 import IncidentStateTimelineService from "../../Services/IncidentStateTimelineService";
 import IncidentMemberService from "../../Services/IncidentMemberService";
+import NetworkDeviceOwnerUserService, {
+  NetworkDeviceOwners,
+} from "../../Services/NetworkDeviceOwnerUserService";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
@@ -358,6 +361,15 @@ export default class MonitorIncident {
         ? input.matchesPerSeries
         : [undefined];
 
+    /*
+     * Owners of the network device this monitor watches (if any), resolved
+     * lazily on first incident creation and reused for the rest of the
+     * evaluation — the device is configured per monitor step, so it is
+     * constant across the criteria/series loops below. Merged into every
+     * created incident's owners alongside the criteria-configured ones.
+     */
+    let networkDeviceOwners: NetworkDeviceOwners | null = null;
+
     for (const criteriaIncident of input.criteriaInstance.data?.incidents ||
       []) {
       for (const seriesMatch of seriesToProcess) {
@@ -654,16 +666,38 @@ export default class MonitorIncident {
           },
         });
 
-        // Add owner teams and users after incident creation
-        if (
-          criteriaIncident.ownerTeamIds?.length ||
-          criteriaIncident.ownerUserIds?.length
-        ) {
+        /*
+         * Add owner teams and users after incident creation. Owners
+         * configured on the criteria template are merged (deduped) with the
+         * owners of the network device this monitor watches, so device
+         * ownership flows into the incidents its monitor raises.
+         */
+        if (networkDeviceOwners === null) {
+          networkDeviceOwners =
+            await NetworkDeviceOwnerUserService.getDeviceOwnersForMonitor({
+              monitor: input.monitor,
+              monitorStepId: (
+                input.dataToProcess as ProbeMonitorResponse
+              ).monitorStepId?.toString(),
+            });
+        }
+
+        const ownerUserIds: Array<ObjectID> = this.mergeOwnerIds(
+          criteriaIncident.ownerUserIds || [],
+          networkDeviceOwners.ownerUserIds,
+        );
+
+        const ownerTeamIds: Array<ObjectID> = this.mergeOwnerIds(
+          criteriaIncident.ownerTeamIds || [],
+          networkDeviceOwners.ownerTeamIds,
+        );
+
+        if (ownerTeamIds.length || ownerUserIds.length) {
           await IncidentService.addOwners(
             input.monitor.projectId!,
             createdIncident.id!,
-            criteriaIncident.ownerUserIds || [],
-            criteriaIncident.ownerTeamIds || [],
+            ownerUserIds,
+            ownerTeamIds,
             true, // notify owners
             {
               isRoot: true,
@@ -728,6 +762,36 @@ export default class MonitorIncident {
     }
   }
 
+  /*
+   * Merges two owner id lists, deduping by string value. Criteria-authored
+   * ids can arrive as plain strings from stored JSON, so normalise through
+   * toString() for both the comparison and the returned ObjectIDs.
+   */
+  private static mergeOwnerIds(
+    primary: Array<ObjectID>,
+    additional: Array<ObjectID>,
+  ): Array<ObjectID> {
+    const seenIds: Set<string> = new Set<string>();
+    const mergedIds: Array<ObjectID> = [];
+
+    for (const ownerId of [...primary, ...additional]) {
+      if (!ownerId) {
+        continue;
+      }
+
+      const ownerIdAsString: string = ownerId.toString();
+
+      if (!ownerIdAsString || seenIds.has(ownerIdAsString)) {
+        continue;
+      }
+
+      seenIds.add(ownerIdAsString);
+      mergedIds.push(new ObjectID(ownerIdAsString));
+    }
+
+    return mergedIds;
+  }
+
   /*
    * Pull every host / docker-host / k8s-cluster / proxmox-cluster /
    * ceph-cluster / service identifier out of the series labels and

package/Server/Utils/Monitor/MonitorMetricUtil.ts

@@ -18,6 +18,7 @@ import HttpPhaseTimings from "../../../Types/Monitor/HttpPhaseTimings";
 import MonitorMetricType from "../../../Types/Monitor/MonitorMetricType";
 import PingMonitorResponse from "../../../Types/Monitor/PingMonitor/PingMonitorResponse";
 import SnmpInterface from "../../../Types/Monitor/SnmpMonitor/SnmpInterface";
+import { SnmpOidResponse } from "../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import SyntheticMonitorResponse from "../../../Types/Monitor/SyntheticMonitors/SyntheticMonitorResponse";
@@ -976,6 +977,62 @@ export default class MonitorMetricUtil {
       }
     }
 
+    /*
+     * Polled OID values (vendor-template CPU/memory/temperature and custom
+     * OIDs). Without this the values users poll every check can gate
+     * criteria but can never be charted or evaluated over time. One series
+     * per OID, keyed by the oid/oidName attributes; non-numeric values
+     * (strings, OIDs, MACs) are skipped — they carry no chartable signal.
+     */
+    const snmpOidResponses: Array<SnmpOidResponse> | undefined = (
+      data.dataToProcess as ProbeMonitorResponse
+    ).snmpResponse?.oidResponses;
+
+    if (snmpOidResponses && snmpOidResponses.length > 0) {
+      // Same unbounded-write cap rationale as the interface block above.
+      const oidResponsesToEmit: Array<SnmpOidResponse> = snmpOidResponses.slice(
+        0,
+        50,
+      );
+
+      if (oidResponsesToEmit.length < snmpOidResponses.length) {
+        logger.warn(
+          `Monitor ${data.monitorId.toString()}: emitting metrics for first ${oidResponsesToEmit.length} of ${snmpOidResponses.length} SNMP OID responses`,
+        );
+      }
+
+      for (const oidResponse of oidResponsesToEmit) {
+        const numericValue: number | undefined =
+          typeof oidResponse.value === "number" && isFinite(oidResponse.value)
+            ? oidResponse.value
+            : undefined;
+
+        if (numericValue === undefined) {
+          continue;
+        }
+
+        await this.pushMonitorMetric({
+          projectId: data.projectId,
+          monitorId: data.monitorId,
+          monitorName: data.monitorName,
+          probeName: data.probeName,
+          metricName: MonitorMetricType.SnmpOidValue,
+          value: numericValue,
+          description: "Value of a polled SNMP OID",
+          unit: "",
+          extraAttributes: {
+            probeId: (
+              data.dataToProcess as ProbeMonitorResponse
+            ).probeId.toString(),
+            oid: oidResponse.oid,
+            oidName: oidResponse.name || oidResponse.oid,
+          },
+          metricRows: metricRows,
+          metricNameServiceNameMap: metricNameServiceNameMap,
+        });
+      }
+    }
+
     if ((data.dataToProcess as ProbeMonitorResponse).httpTimings) {
       const httpTimings: HttpPhaseTimings = (
         data.dataToProcess as ProbeMonitorResponse

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -15,6 +15,10 @@ import SyntheticMonitorResponse from "../../../Types/Monitor/SyntheticMonitors/S
 import SnmpMonitorResponse, {
   SnmpOidResponse,
 } from "../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
+import SnmpInterface from "../../../Types/Monitor/SnmpMonitor/SnmpInterface";
+import SnmpTrap, {
+  SnmpTrapVarbind,
+} from "../../../Types/Monitor/SnmpMonitor/SnmpTrap";
 import DnsMonitorResponse, {
   DnsRecordResponse,
 } from "../../../Types/Monitor/DnsMonitor/DnsMonitorResponse";
@@ -277,6 +281,96 @@ export default class MonitorTemplateUtil {
             }
           }
         }
+
+        /*
+         * Interface walk results (populated when interface monitoring is
+         * enabled on the monitor step). Counts follow the same semantics as
+         * NetworkInventoryUtil: administratively disabled interfaces are
+         * intentionally down and never count as failures, so
+         * `interfacesDown` / `downInterfaces` only cover interfaces that are
+         * admin-up but oper-down. Lets templates say
+         * "{{downInterfaces.0.name}} on {{sysName}} is down".
+         */
+        if (snmpResponse?.interfaces && snmpResponse.interfaces.length > 0) {
+          const interfaces: Array<SnmpInterface> = snmpResponse.interfaces;
+
+          const downInterfaces: Array<SnmpInterface> = interfaces.filter(
+            (snmpInterface: SnmpInterface) => {
+              return (
+                snmpInterface.isAdministrativelyUp &&
+                !snmpInterface.isOperationallyUp
+              );
+            },
+          );
+
+          storageMap["interfacesTotal"] = interfaces.length;
+          storageMap["interfacesUp"] = interfaces.filter(
+            (snmpInterface: SnmpInterface) => {
+              return (
+                snmpInterface.isAdministrativelyUp &&
+                snmpInterface.isOperationallyUp
+              );
+            },
+          ).length;
+          storageMap["interfacesDown"] = downInterfaces.length;
+          storageMap["downInterfaces"] = downInterfaces.map(
+            (snmpInterface: SnmpInterface) => {
+              return {
+                name: snmpInterface.name,
+                alias: snmpInterface.alias || "",
+                interfaceIndex: snmpInterface.interfaceIndex,
+              };
+            },
+          );
+        }
+
+        if (snmpResponse?.interfaceWalkFailure) {
+          storageMap["interfaceWalkFailure"] =
+            snmpResponse.interfaceWalkFailure;
+        }
+
+        /*
+         * Device system identity (SNMPv2 system group), when collected.
+         * Missing fields default to "" so templates render blank instead of
+         * a raw {{placeholder}} — but never clobber a value the user already
+         * exposed via a custom OID named sysName/sysDescr/etc. above.
+         */
+        if (snmpResponse?.systemInfo) {
+          const systemInfoFields: Array<[string, string | undefined]> = [
+            ["sysName", snmpResponse.systemInfo.sysName],
+            ["sysDescr", snmpResponse.systemInfo.sysDescr],
+            ["sysObjectId", snmpResponse.systemInfo.sysObjectId],
+            ["sysLocation", snmpResponse.systemInfo.sysLocation],
+          ];
+
+          for (const [fieldName, fieldValue] of systemInfoFields) {
+            if (fieldValue || storageMap[fieldName] === undefined) {
+              storageMap[fieldName] = fieldValue || "";
+            }
+          }
+        }
+
+        /*
+         * Trap payload — only present when this check was triggered by an
+         * SNMP trap received by a probe's trap receiver (rather than a
+         * scheduled poll).
+         */
+        const snmpTrapResponse: SnmpTrap | undefined = (
+          data.dataToProcess as ProbeMonitorResponse
+        ).snmpTrapResponse;
+
+        if (snmpTrapResponse) {
+          storageMap["trapOid"] = snmpTrapResponse.trapOid;
+          storageMap["trapSourceIp"] = snmpTrapResponse.sourceIpAddress;
+          storageMap["trapVarbinds"] = snmpTrapResponse.varbinds.map(
+            (varbind: SnmpTrapVarbind) => {
+              return {
+                oid: varbind.oid,
+                value: varbind.value,
+              };
+            },
+          );
+        }
       }
 
       if (data.monitorType === MonitorType.DNS) {

package/Server/Utils/Monitor/NetworkDeviceHydrationUtil.ts

@@ -130,6 +130,21 @@ export default class NetworkDeviceHydrationUtil {
    * snmpV3* columns (the current storage), falling back to the deprecated
    * snmpV3Auth JSON column so devices created before the columns existed keep
    * working. Returns undefined when no v3 username is configured.
+   *
+   * The protocol columns are passed through as stored, on purpose. It is
+   * tempting to validate them here with SnmpSecurityLevelUtil /
+   * SnmpAuthProtocolUtil / SnmpPrivProtocolUtil, but this runs server-side
+   * inside the probe's monitor-list request, and that request claims its
+   * monitors — advancing nextPingAt — before hydration runs. A throw here
+   * would 500 the whole batch, so one malformed row would stall up to a
+   * hundred unrelated monitors of every type, every cycle, with nothing
+   * recorded against them.
+   *
+   * The probe validates instead, in SnmpMonitor.buildV3User, where a bad value
+   * fails exactly one monitor and shows up as its failure cause. Parsing here
+   * would defeat that by folding an unreadable value into undefined, which the
+   * probe cannot tell from "never configured" — and would therefore poll with
+   * a silently defaulted algorithm.
    */
   private static buildSnmpV3Auth(
     device: NetworkDevice,

package/Server/Utils/Monitor/NetworkInventoryUtil.ts

@@ -1,4 +1,5 @@
 import Monitor from "../../../Models/DatabaseModels/Monitor";
+import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
 import NetworkInterface from "../../../Models/DatabaseModels/NetworkInterface";
 import NetworkDeviceService from "../../Services/NetworkDeviceService";
 import NetworkInterfaceService from "../../Services/NetworkInterfaceService";
@@ -6,6 +7,10 @@ import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import MonitorStep from "../../../Types/Monitor/MonitorStep";
 import SnmpInterface from "../../../Types/Monitor/SnmpMonitor/SnmpInterface";
 import LldpNeighbor from "../../../Types/Monitor/SnmpMonitor/LldpNeighbor";
+import CdpNeighbor from "../../../Types/Monitor/SnmpMonitor/CdpNeighbor";
+import SnmpSystemInfo from "../../../Types/Monitor/SnmpMonitor/SnmpSystemInfo";
+import SnmpEntityInfo from "../../../Types/Monitor/SnmpMonitor/SnmpEntityInfo";
+import SnmpVendorTemplateUtil from "../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import ObjectID from "../../../Types/ObjectID";
 import OneUptimeDate from "../../../Types/Date";
@@ -41,21 +46,63 @@ export default class NetworkInventoryUtil {
     }
 
     const deviceId: ObjectID = new ObjectID(deviceIdAsString);
+
+    /*
+     * The device id is read from the monitor's step JSON, which a user can
+     * set to any UUID through the Monitor API (the dashboard dropdown is
+     * scoped, but the API is not). Confirm the device actually belongs to
+     * this monitor's project before writing anything with isRoot — without
+     * this guard a crafted step could point at another project's device and
+     * overwrite its inventory (or spawn interfaces under it).
+     */
+    const ownedDevice: NetworkDevice | null =
+      await NetworkDeviceService.findOneBy({
+        query: {
+          _id: deviceId,
+          projectId: data.monitor.projectId,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!ownedDevice) {
+      return;
+    }
+
     const walkedInterfaces: Array<SnmpInterface> =
       data.dataToProcess.snmpResponse?.interfaces || [];
-    const systemInfo:
-      | { sysDescr?: string | undefined; sysName?: string | undefined }
-      | undefined = data.dataToProcess.snmpResponse?.systemInfo;
+    const systemInfo: SnmpSystemInfo | undefined =
+      data.dataToProcess.snmpResponse?.systemInfo;
+    const entityInfo: SnmpEntityInfo | undefined =
+      data.dataToProcess.snmpResponse?.entityInfo;
     const lldpNeighbors: Array<LldpNeighbor> | undefined =
       data.dataToProcess.snmpResponse?.lldpNeighbors;
+    const cdpNeighbors: Array<CdpNeighbor> | undefined =
+      data.dataToProcess.snmpResponse?.cdpNeighbors;
 
     const now: Date = OneUptimeDate.getCurrentDate();
 
+    /*
+     * lastSeenAt is "last time the device actually answered", not "last time
+     * we tried": the device list's status pill and the topology map both
+     * derive up/down from its freshness, so bumping it on a failed poll
+     * would paint an unreachable device green. A poll where the probe could
+     * not reach the device reports isOnline === false; treat anything else
+     * (reachable, or a monitor type that reports no reachability) as seen.
+     */
+    const isDeviceReachable: boolean = data.dataToProcess.isOnline !== false;
+
     try {
       // --- Device enrichment + cached counts ---
-      const deviceUpdate: Record<string, unknown> = {
-        lastSeenAt: now,
-      };
+      const deviceUpdate: Record<string, unknown> = {};
+
+      if (isDeviceReachable) {
+        deviceUpdate["lastSeenAt"] = now;
+      }
 
       if (systemInfo?.sysDescr) {
         deviceUpdate["sysDescr"] = systemInfo.sysDescr.substring(0, 500);
@@ -63,15 +110,66 @@ export default class NetworkInventoryUtil {
       if (systemInfo?.sysName) {
         deviceUpdate["sysName"] = systemInfo.sysName.substring(0, 100);
       }
+      if (systemInfo?.sysObjectId) {
+        deviceUpdate["sysObjectId"] = systemInfo.sysObjectId.substring(0, 100);
+      }
+      if (systemInfo?.sysLocation) {
+        deviceUpdate["sysLocation"] = systemInfo.sysLocation.substring(0, 100);
+      }
+      if (systemInfo?.sysContact) {
+        deviceUpdate["sysContact"] = systemInfo.sysContact.substring(0, 100);
+      }
+      if (systemInfo?.sysUpTimeSeconds !== undefined) {
+        deviceUpdate["lastRebootedAt"] = new Date(
+          now.getTime() - systemInfo.sysUpTimeSeconds * 1000,
+        );
+      }
+
+      /*
+       * Vendor: ENTITY-MIB manufacturer when the device implements it,
+       * otherwise fingerprinted from the sysObjectID enterprise arc.
+       */
+      const vendor: string | undefined =
+        entityInfo?.manufacturer ||
+        SnmpVendorTemplateUtil.getVendorNameBySysObjectId(
+          systemInfo?.sysObjectId,
+        );
+      if (vendor) {
+        deviceUpdate["vendor"] = vendor.substring(0, 100);
+      }
+      if (entityInfo?.model) {
+        deviceUpdate["deviceModel"] = entityInfo.model.substring(0, 100);
+      }
+      if (entityInfo?.serialNumber) {
+        deviceUpdate["serialNumber"] = entityInfo.serialNumber.substring(
+          0,
+          100,
+        );
+      }
+      if (entityInfo?.firmwareVersion) {
+        deviceUpdate["firmwareVersion"] = entityInfo.firmwareVersion.substring(
+          0,
+          100,
+        );
+      }
+      if (entityInfo?.softwareVersion) {
+        deviceUpdate["softwareVersion"] = entityInfo.softwareVersion.substring(
+          0,
+          100,
+        );
+      }
 
       /*
        * Store the LLDP snapshot (capped) whenever the walk ran, even if it
        * found nothing — clearing stale neighbors is as important as adding
-       * new ones for keeping the topology accurate.
+       * new ones for keeping the topology accurate. Same for CDP.
        */
       if (lldpNeighbors !== undefined) {
         deviceUpdate["lldpNeighbors"] = lldpNeighbors.slice(0, 256);
       }
+      if (cdpNeighbors !== undefined) {
+        deviceUpdate["cdpNeighbors"] = cdpNeighbors.slice(0, 256);
+      }
 
       if (walkedInterfaces.length > 0) {
         deviceUpdate["interfacesTotal"] = walkedInterfaces.length;
@@ -87,13 +185,16 @@ export default class NetworkInventoryUtil {
         ).length;
       }
 
-      await NetworkDeviceService.updateOneById({
-        id: deviceId,
-        data: deviceUpdate as any,
-        props: {
-          isRoot: true,
-        },
-      });
+      // An unreachable poll with no walk data leaves nothing worth writing.
+      if (Object.keys(deviceUpdate).length > 0) {
+        await NetworkDeviceService.updateOneById({
+          id: deviceId,
+          data: deviceUpdate as any,
+          props: {
+            isRoot: true,
+          },
+        });
+      }
 
       if (walkedInterfaces.length === 0) {
         return;
@@ -138,6 +239,10 @@ export default class NetworkInventoryUtil {
         const interfaceData: Record<string, unknown> = {
           name: (walked.name || "").substring(0, 100),
           alias: walked.alias ? walked.alias.substring(0, 100) : null,
+          macAddress: walked.macAddress
+            ? walked.macAddress.substring(0, 100)
+            : null,
+          interfaceType: walked.interfaceType ?? null,
           isOperationallyUp: walked.isOperationallyUp,
           isAdministrativelyUp: walked.isAdministrativelyUp,
           speedInMbps:
@@ -174,6 +279,12 @@ export default class NetworkInventoryUtil {
           if (walked.alias) {
             newInterface.alias = walked.alias.substring(0, 100);
           }
+          if (walked.macAddress) {
+            newInterface.macAddress = walked.macAddress.substring(0, 100);
+          }
+          if (walked.interfaceType !== undefined) {
+            newInterface.interfaceType = walked.interfaceType;
+          }
           newInterface.isMonitored = true;
           newInterface.isOperationallyUp = walked.isOperationallyUp;
           newInterface.isAdministrativelyUp = walked.isAdministrativelyUp;