@oneuptime/common 12.0.30 → 12.0.32

package/Server/Services/NetworkDeviceService.ts

@@ -26,6 +26,13 @@ import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
 import { SiteAssignmentRuleRunResult } from "../../Types/NetworkAutomation/RuleRunResult";
 import { NetworkDeviceMonitoringMethodUtil } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
+import NetworkDeviceOidTemplate from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
+import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
+import SnmpOid from "../../Types/Monitor/SnmpMonitor/SnmpOid";
+import SnmpOidListUtil, {
+  MAX_DEVICE_SPECIFIC_OIDS,
+  MAX_EFFECTIVE_OIDS_PER_DEVICE,
+} from "../../Types/Monitor/SnmpMonitor/SnmpOidListUtil";
 import { EntityManager } from "typeorm";
 import ModelPermission from "../Types/Database/Permissions/Index";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -106,6 +113,30 @@ function readSiteIdFromData(data: Record<string, unknown>): ObjectID | null {
 // Both spellings of "the monitor that reports this device's health".
 const MONITOR_KEYS: Array<string> = ["monitorId", "monitor"];
 
+/*
+ * Both spellings of "the OID Collection Template this device collects". The
+ * settings page posts the `oidTemplate` relation and the bulk action posts
+ * the `oidTemplateId` column, so a guard that watched only one of them would
+ * be trivially bypassable from the UI.
+ */
+const OID_TEMPLATE_KEYS: Array<string> = ["oidTemplateId", "oidTemplate"];
+
+function readOidTemplateIdFromData(
+  data: Record<string, unknown>,
+): ObjectID | null {
+  /*
+   * readConsistent, not read: a payload that writes BOTH spellings with
+   * different ids would otherwise have one of them validated and the other
+   * persisted, which turns the cross-project guard below into something a
+   * caller can steer. It refuses the contradiction instead of picking.
+   */
+  return RelationIdUtil.readConsistent(
+    data,
+    OID_TEMPLATE_KEYS,
+    "OID Collection Template",
+  );
+}
+
 function readMonitorIdFromData(data: Record<string, unknown>): ObjectID | null {
   return RelationIdUtil.read(data, MONITOR_KEYS);
 }
@@ -838,6 +869,50 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * Same hole as siteId, and it matters more here: the FK behind
+   * oidTemplateId only requires the row to exist, not that it belongs to the
+   * device's project. Tenant scoping is applied to the ROOT query only, so a
+   * device pointed at another project's template would leak that template's
+   * name and OID list through every nested `select: { oidTemplate: ... }` the
+   * dashboard makes - and the poll would ship those OIDs to this project's
+   * probe. Refuse the link at the point it is written, rather than auditing
+   * it afterwards at poll time.
+   */
+  private async assertOidTemplateBelongsToProject(data: {
+    oidTemplateId: ObjectID;
+    projectId: ObjectID | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const oidTemplate: NetworkDeviceOidTemplate | null =
+      await NetworkDeviceOidTemplateService.findOneById({
+        id: data.oidTemplateId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!oidTemplate) {
+      throw new BadDataException("OID Collection Template not found.");
+    }
+
+    if (
+      oidTemplate.projectId &&
+      oidTemplate.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "OID Collection Template must belong to the same project.",
+      );
+    }
+  }
+
   /*
    * onBeforeUpdate runs before DatabaseService permission-checks the query,
    * so reading the raw client query as root would hand the hook rows from
@@ -877,6 +952,30 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    const createOidTemplateId: ObjectID | null = readOidTemplateIdFromData(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (createOidTemplateId) {
+      await this.assertOidTemplateBelongsToProject({
+        oidTemplateId: createOidTemplateId,
+        projectId: createBy.data.projectId,
+      });
+    }
+
+    if (createBy.data.snmpOids !== undefined) {
+      // Same budget rule as onBeforeUpdate: the tight cap is what linking costs.
+      createBy.data.snmpOids = SnmpOidListUtil.validateOidList(
+        createBy.data.snmpOids,
+        {
+          max: createOidTemplateId
+            ? MAX_DEVICE_SPECIFIC_OIDS
+            : MAX_EFFECTIVE_OIDS_PER_DEVICE,
+          label: "Device-Specific Health OIDs",
+        },
+      );
+    }
+
     if (
       NetworkDeviceMonitoringMethodUtil.isMonitorBacked(
         createBy.data.monitoringMethod,
@@ -1098,8 +1197,34 @@ export class Service extends DatabaseService<Model> {
         return dataKeys.includes(column);
       },
     );
+    /*
+     * The OID writes have to get past this return too, and that is the whole
+     * reason they are named here.
+     *
+     * The early return exists so a write that changes neither site nor
+     * identity skips a read it does not need — but linking a template and
+     * editing snmpOids are EXACTLY such writes, so a guard placed below the
+     * return would be dead code on the only path it exists for. Both need the
+     * read: the tenancy check needs each matched device's projectId, and the
+     * OID cap needs to know whether the device is linked to a template.
+     *
+     * `!== undefined` rather than truthiness for the OID list: every poll
+     * writes device columns through this path (NetworkInventoryUtil), and an
+     * explicit empty array is a legitimate "collect nothing device-specific"
+     * edit.
+     */
+    const isOidTemplateChange: boolean = RelationIdUtil.isWritten(
+      dataKeys,
+      OID_TEMPLATE_KEYS,
+    );
+    const isDeviceOidsChange: boolean = updateBy.data.snmpOids !== undefined;
 
-    if (!isSiteChange && !isIdentityChange) {
+    if (
+      !isSiteChange &&
+      !isIdentityChange &&
+      !isOidTemplateChange &&
+      !isDeviceOidsChange
+    ) {
       return { updateBy, carryForward: null };
     }
 
@@ -1112,6 +1237,9 @@ export class Service extends DatabaseService<Model> {
         hostname: true,
         name: true,
         sysName: true,
+        // Decide which OID budget applies below, and whether a link would truncate.
+        oidTemplateId: true,
+        snmpOids: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -1143,6 +1271,86 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    const newOidTemplateId: ObjectID | null = readOidTemplateIdFromData(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
+
+    /*
+     * Same shape as the site guard above: one check per distinct project in
+     * the matched set, because a single updateBy can span devices from more
+     * than one project when a root caller issues it.
+     */
+    if (newOidTemplateId) {
+      const checkedTemplateProjectIds: Set<string> = new Set();
+
+      for (const previousDevice of previousDevices) {
+        if (
+          !previousDevice.projectId ||
+          checkedTemplateProjectIds.has(previousDevice.projectId.toString())
+        ) {
+          continue;
+        }
+        checkedTemplateProjectIds.add(previousDevice.projectId.toString());
+
+        await this.assertOidTemplateBelongsToProject({
+          oidTemplateId: newOidTemplateId,
+          projectId: previousDevice.projectId,
+        });
+      }
+    }
+
+    /*
+     * How many OIDs a device may carry of its own.
+     *
+     * The tight budget is a consequence of ADOPTING a template, not a
+     * retroactive limit on every device that already exists. A device with no
+     * template collects only its own list, so its ceiling is the full
+     * per-device budget; the moment it links to one, template plus
+     * device-specific has to fit inside that same ceiling, and the
+     * device-specific half is what gives.
+     *
+     * Enforcing the tight budget unconditionally would have been hostile in
+     * exactly the wrong direction: a device that predates this feature, with a
+     * long hand-built list, could no longer save ANY polling setting — the
+     * fleet in issue #3507 being the likeliest example.
+     */
+    /*
+     * Linking a device whose STORED list already exceeds the device-specific
+     * budget would leave the merge over the effective ceiling, and truncation
+     * drops from the end — so the operator's own OIDs would silently stop
+     * being polled, on a write that never mentioned them. Refuse the link and
+     * say what to trim, rather than accepting it and losing data at poll time.
+     */
+    if (isOidTemplateChange && newOidTemplateId && !isDeviceOidsChange) {
+      for (const previousDevice of previousDevices) {
+        const storedOidCount: number = (previousDevice.snmpOids || []).length;
+
+        if (storedOidCount > MAX_DEVICE_SPECIFIC_OIDS) {
+          throw new BadDataException(
+            `This device has ${storedOidCount} device-specific Health OIDs, and a device linked to an OID Collection Template may keep at most ${MAX_DEVICE_SPECIFIC_OIDS} of its own. Remove ${storedOidCount - MAX_DEVICE_SPECIFIC_OIDS} of them - or move them onto the template - before linking it.`,
+          );
+        }
+      }
+    }
+
+    if (isDeviceOidsChange) {
+      const becomesLinked: boolean = isOidTemplateChange
+        ? Boolean(newOidTemplateId)
+        : previousDevices.some((previousDevice: Model) => {
+            return Boolean(previousDevice.oidTemplateId);
+          });
+
+      updateBy.data.snmpOids = SnmpOidListUtil.validateOidList(
+        updateBy.data.snmpOids as Array<SnmpOid>,
+        {
+          max: becomesLinked
+            ? MAX_DEVICE_SPECIFIC_OIDS
+            : MAX_EFFECTIVE_OIDS_PER_DEVICE,
+          label: "Device-Specific Health OIDs",
+        },
+      );
+    }
+
     return {
       updateBy,
       carryForward: {

package/Server/Services/OnCallDutyPolicyLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyLabelRuleEngineServiceClass {
   @CaptureSpan()
@@ -32,10 +34,16 @@ class OnCallDutyPolicyLabelRuleEngineServiceClass {
             onCallDutyPolicyDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyLabelRule",
+        projectId: onCallDutyPolicy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/OnCallDutyPolicyOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyOwnerRuleEngineServiceClass {
   @CaptureSpan()
@@ -38,10 +40,16 @@ class OnCallDutyPolicyOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyOwnerRule",
+        projectId: onCallDutyPolicy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/OnCallDutyPolicyScheduleLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyScheduleLabelRuleEngineServiceClass {
   @CaptureSpan()
@@ -32,10 +34,16 @@ class OnCallDutyPolicyScheduleLabelRuleEngineServiceClass {
             onCallDutyPolicyScheduleDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyScheduleLabelRule",
+        projectId: schedule.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/OnCallDutyPolicyScheduleOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyScheduleOwnerRuleEngineServiceClass {
   @CaptureSpan()
@@ -38,10 +40,16 @@ class OnCallDutyPolicyScheduleOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyScheduleOwnerRule",
+        projectId: schedule.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/PodmanHostLabelRuleEngineService.ts

@@ -9,6 +9,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class PodmanHostLabelRuleEngineServiceClass {
   /**
@@ -38,10 +40,16 @@ class PodmanHostLabelRuleEngineServiceClass {
             podmanHostDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "PodmanHostLabelRule",
+        projectId: podmanHost.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/PodmanHostOwnerRuleEngineService.ts

@@ -13,6 +13,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class PodmanHostOwnerRuleEngineServiceClass {
   /**
@@ -45,10 +47,16 @@ class PodmanHostOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "PodmanHostOwnerRule",
+        projectId: podmanHost.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/ProjectService.ts

@@ -34,6 +34,7 @@ import IncidentStateService from "./IncidentStateService";
 import IncidentRoleService from "./IncidentRoleService";
 import MailService from "./MailService";
 import MonitorStatusService from "./MonitorStatusService";
+import NetworkDeviceRoleService from "./NetworkDeviceRoleService";
 import NetworkSiteTypeService from "./NetworkSiteTypeService";
 import NotificationService from "./NotificationService";
 import PromoCodeService from "./PromoCodeService";
@@ -79,6 +80,11 @@ import IncidentRole from "../../Models/DatabaseModels/IncidentRole";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import NetworkSiteType from "../../Models/DatabaseModels/NetworkSiteType";
 import DefaultNetworkSiteType from "../../Types/NetworkSite/DefaultNetworkSiteType";
+import NetworkDeviceRole from "../../Models/DatabaseModels/NetworkDeviceRole";
+import {
+  DEFAULT_NETWORK_DEVICE_ROLES,
+  DefaultNetworkDeviceRole,
+} from "../../Types/NetworkDevice/DefaultNetworkDeviceRole";
 import Model from "../../Models/DatabaseModels/Project";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import PromoCode from "../../Models/DatabaseModels/PromoCode";
@@ -1444,6 +1450,7 @@ These are no longer recorded against the project and have to be cancelled by han
       this.addDefaultAlertState(createdItem),
       this.addDefaultIncidentRoles(createdItem),
       this.addDefaultNetworkSiteTypes(createdItem),
+      this.addDefaultNetworkDeviceRoles(createdItem),
     ]);
 
     if (createdItem.createdOwnerEmail) {
@@ -2007,6 +2014,84 @@ These are no longer recorded against the project and have to be cancelled by han
     return createdItem;
   }
 
+  /**
+   * Seeds the per-project network device role lookup table.
+   *
+   * Device roles used to be a fixed union with the label, the silhouette and
+   * the "is this a core device?" flag hardcoded in three different modules.
+   * They are now a configurable per-project table, so a project can rename
+   * "Wireless AP" to "Access Point", draw firewalls as something else, or add
+   * a role of its own - which means every project needs its own seeded copy of
+   * the defaults.
+   *
+   * Public for the same reason addDefaultNetworkSiteTypes is: the
+   * BackfillNetworkDeviceRoles data migration calls it to seed roles into
+   * projects that existed before the table did, so the defaults are defined
+   * once and cannot drift between project creation and the backfill.
+   *
+   * The key is passed explicitly rather than derived from the name. It has to
+   * be exactly what the SNMP classifier emits - "wirelessAccessPoint", which
+   * no derivation from "Wireless AP" would produce - or a classified access
+   * point would match no row.
+   */
+  @CaptureSpan()
+  public async addDefaultNetworkDeviceRoles(
+    createdItem: Model,
+  ): Promise<Model> {
+    const projectId: ObjectID = createdItem.id!;
+
+    // Idempotent - see getExistingProjectScopedNames.
+    const existingNames: Set<string | undefined> =
+      await this.getExistingProjectScopedNames(
+        NetworkDeviceRoleService,
+        projectId,
+      );
+
+    /*
+     * Also guarded on the key, not just the name: a project that renamed the
+     * seeded "Router" to "Edge Router" must not get a second row called
+     * "Router" the next time this runs, and the key is the identity that
+     * survives the rename.
+     */
+    const existingKeys: Set<string> =
+      await NetworkDeviceRoleService.getKeysInProject(projectId);
+
+    for (
+      let index: number = 0;
+      index < DEFAULT_NETWORK_DEVICE_ROLES.length;
+      index++
+    ) {
+      const defaultRole: DefaultNetworkDeviceRole =
+        DEFAULT_NETWORK_DEVICE_ROLES[index]!;
+
+      if (
+        existingNames.has(defaultRole.name) ||
+        existingKeys.has(defaultRole.key)
+      ) {
+        continue;
+      }
+
+      const networkDeviceRole: NetworkDeviceRole = new NetworkDeviceRole();
+      networkDeviceRole.name = defaultRole.name;
+      networkDeviceRole.key = defaultRole.key;
+      networkDeviceRole.description = defaultRole.description;
+      networkDeviceRole.topologyShape = defaultRole.topologyShape;
+      networkDeviceRole.isCoreLayer = defaultRole.isCoreLayer;
+      networkDeviceRole.isSnmpWalkable = defaultRole.isSnmpWalkable;
+      networkDeviceRole.projectId = projectId;
+      networkDeviceRole.order = index + 1;
+
+      await NetworkDeviceRoleService.create({
+        data: networkDeviceRole,
+        props: {
+          isRoot: true,
+        },
+      });
+    }
+
+    return createdItem;
+  }
+
   private async addDefaultProjectTeams(createdItem: Model): Promise<Model> {
     // add a team member.
 

package/Server/Services/ProxmoxClusterLabelRuleEngineService.ts

@@ -9,6 +9,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class ProxmoxClusterLabelRuleEngineServiceClass {
   /**
@@ -40,10 +42,16 @@ class ProxmoxClusterLabelRuleEngineServiceClass {
             proxmoxClusterDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "ProxmoxClusterLabelRule",
+        projectId: proxmoxCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/ProxmoxClusterOwnerRuleEngineService.ts

@@ -13,6 +13,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class ProxmoxClusterOwnerRuleEngineServiceClass {
   /**
@@ -47,10 +49,16 @@ class ProxmoxClusterOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "ProxmoxClusterOwnerRule",
+        projectId: proxmoxCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RumApplicationLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import RumApplicationService from "./RumApplicationService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RumApplicationLabelRuleEngineServiceClass {
   /**
@@ -37,10 +39,16 @@ class RumApplicationLabelRuleEngineServiceClass {
             descriptionRegexPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RumApplicationLabelRule",
+        projectId: rumApplication.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RumApplicationOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import RumApplicationService from "./RumApplicationService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RumApplicationOwnerRuleEngineServiceClass {
   /**
@@ -43,10 +45,16 @@ class RumApplicationOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RumApplicationOwnerRule",
+        projectId: rumApplication.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RunbookLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import RunbookService from "./RunbookService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RunbookLabelRuleEngineServiceClass {
   /**
@@ -35,10 +37,16 @@ class RunbookLabelRuleEngineServiceClass {
             runbookDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RunbookLabelRule",
+        projectId: runbook.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }