@oneuptime/common 12.0.32 → 12.0.34

package/Server/Utils/Monitor/NetworkInventoryUtil.ts

@@ -20,25 +20,39 @@ import SnmpVendorTemplateUtil, {
 } from "../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
 import ObjectID from "../../../Types/ObjectID";
 import OneUptimeDate from "../../../Types/Date";
+import { NetworkDeviceMonitoringMethodUtil } from "../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+import { NetworkDevicePollMode } from "./NetworkDeviceHydrationUtil";
 import logger from "../Logger";
 
 /*
  * Keeps the NetworkDevice / NetworkInterface inventory in sync with each
- * device walk, then prunes the in-flight response down to MONITORED
+ * device poll, then prunes the in-flight response down to MONITORED
  * interfaces so criteria and metrics only consider ports the user cares
  * about. Inventory rows always reflect every walked interface; the
  * isMonitored flag is user-owned and never overwritten here.
  *
  * Called from the device polling pipeline (NetworkDeviceWalkUtil): the
- * device's assigned probe walks it on the device's own schedule, so this
- * runs for every registered device — no Monitor required.
+ * device's assigned probe pings it on the device's own schedule - and walks
+ * it over SNMP as well when it has credentials - so this runs for every
+ * registered device, credentials or not, and no Monitor is required.
  */
 export default class NetworkInventoryUtil {
   public static async updateFromWalk(data: {
     projectId: ObjectID;
     deviceId: ObjectID;
+    /*
+     * The SNMP walk, when one ran (success or failure). Undefined on a
+     * ping-only poll - never a synthesized failure.
+     */
     snmpResponse: SnmpMonitorResponse | undefined;
+    // Device reachability: answered ping OR the walk succeeded.
     isOnline: boolean | undefined;
+    /*
+     * How the probe polled. Absent from callers that predate ping-first
+     * polling (the ingest processor stamps "snmp" for an old probe's walk),
+     * and read as "snmp" when absent.
+     */
+    pollMode?: NetworkDevicePollMode | undefined;
   }): Promise<void> {
     const deviceId: ObjectID = data.deviceId;
 
@@ -61,6 +75,8 @@ export default class NetworkInventoryUtil {
           autoApplyVendorHealthTemplate: true,
           snmpOids: true,
           oidTemplateId: true,
+          // For the monitor-backed guard on the poll columns below.
+          monitoringMethod: true,
         },
         props: {
           isRoot: true,
@@ -71,27 +87,70 @@ export default class NetworkInventoryUtil {
       return;
     }
 
-    const walkedInterfaces: Array<SnmpInterface> =
-      data.snmpResponse?.interfaces || [];
-    const systemInfo: SnmpSystemInfo | undefined =
-      data.snmpResponse?.systemInfo;
-    const entityInfo: SnmpEntityInfo | undefined =
-      data.snmpResponse?.entityInfo;
-    const lldpNeighbors: Array<LldpNeighbor> | undefined =
-      data.snmpResponse?.lldpNeighbors;
-    const cdpNeighbors: Array<CdpNeighbor> | undefined =
-      data.snmpResponse?.cdpNeighbors;
-    const arpEntries: Array<ArpEntry> | undefined =
-      data.snmpResponse?.arpEntries;
-    const fdbEntries: Array<FdbEntry> | undefined =
-      data.snmpResponse?.fdbEntries;
+    /*
+     * A monitor-backed device (monitoringMethod "Monitor") is never meant to
+     * be walked: nothing polls it and its bound Monitor's status owns
+     * isReachable. But claimDevicesForPolling only excludes such rows at
+     * CLAIM time, so a device claimed as SNMP and switched to Monitor before
+     * its walk result arrived still lands here. Writing the poll verdict
+     * then would overwrite the monitor's reachability with the last thing a
+     * probe found before it stopped asking, and the two would fight on the
+     * device list until the next status change. The poll and interface-count
+     * columns are therefore withheld for such a row; everything else the
+     * walk learned (system group, vendor, neighbors, interfaces, endpoints)
+     * is still recorded, because it is inventory rather than health.
+     */
+    const isMonitorBacked: boolean =
+      NetworkDeviceMonitoringMethodUtil.isMonitorBacked(
+        ownedDevice.monitoringMethod,
+      );
+
+    if (isMonitorBacked) {
+      logger.warn(
+        `Network device ${deviceId.toString()} is monitor-backed (monitoringMethod "Monitor") but a poll result arrived for it - most likely it was switched off probe polling while a poll was in flight. Its bound monitor owns reachability, so lastPolledAt, isReachable, lastSeenAt, isSnmpReachable, lastSnmpSeenAt and the interface counts from this poll are not written.`,
+      );
+    }
+
+    const pollMode: NetworkDevicePollMode = data.pollMode ?? "snmp";
+
+    /*
+     * Did a walk run, and did it succeed? Two separate questions, because a
+     * ping-only poll runs no walk at all and must not read as a failed one:
+     * the walk columns below go NULL for it, not false.
+     *
+     * A walk where the probe could not open the SNMP session reports
+     * isOnline === false; treat anything else (success, or a walk that
+     * reports no verdict at all) as succeeded - the same convention
+     * isDeviceReachable uses further down.
+     */
+    const walkRan: boolean = data.snmpResponse !== undefined;
+    const walkSucceeded: boolean =
+      data.snmpResponse !== undefined && data.snmpResponse.isOnline !== false;
+
+    /*
+     * Inventory comes ONLY from a successful walk. A failed walk carries no
+     * system group, no neighbours and no interfaces, and reading whatever a
+     * malformed failure did carry would let it clear the LLDP snapshot or
+     * rewrite sysName off a session that never really opened.
+     */
+    const walk: SnmpMonitorResponse | undefined = walkSucceeded
+      ? data.snmpResponse
+      : undefined;
+
+    const walkedInterfaces: Array<SnmpInterface> = walk?.interfaces || [];
+    const systemInfo: SnmpSystemInfo | undefined = walk?.systemInfo;
+    const entityInfo: SnmpEntityInfo | undefined = walk?.entityInfo;
+    const lldpNeighbors: Array<LldpNeighbor> | undefined = walk?.lldpNeighbors;
+    const cdpNeighbors: Array<CdpNeighbor> | undefined = walk?.cdpNeighbors;
+    const arpEntries: Array<ArpEntry> | undefined = walk?.arpEntries;
+    const fdbEntries: Array<FdbEntry> | undefined = walk?.fdbEntries;
 
     const now: Date = OneUptimeDate.getCurrentDate();
 
     /*
-     * A poll where the probe could not reach the device reports
-     * isOnline === false; treat anything else (reachable, or a walk that
-     * reports no reachability at all) as answered.
+     * A poll where the probe could not reach the device (no ping answer AND
+     * no walk) reports isOnline === false; treat anything else (reachable,
+     * or a poll that reports no reachability at all) as answered.
      */
     const isDeviceReachable: boolean = data.isOnline !== false;
 
@@ -115,12 +174,39 @@ export default class NetworkInventoryUtil {
        *   lastSeenAt   - when the device last ANSWERED. Only moves on a
        *                  successful walk, so it stays honest as "last
        *                  contact" and never paints a dead device green.
+       *
+       * Under ping-first polling the three answer for the DEVICE - "did it
+       * answer ping or SNMP" - which is what the status pill shows. The
+       * walk gets its own pair:
+       *
+       *   isSnmpReachable - the verdict of the last WALK: true/false when
+       *                     one ran, NULL when none did (a ping-only poll)
+       *                     or the device was never polled. NULL is the
+       *                     whole point: a credential-less device is not
+       *                     "SNMP down", it is "not walked".
+       *   lastSnmpSeenAt  - when the walk last SUCCEEDED. Only moves on a
+       *                     good walk, like lastSeenAt for the device.
+       *
+       * An old probe (no pollMode) only ever walked, and the processor
+       * stamps its walk verdict as the device verdict, so both columns
+       * carry the same value for it - never NULL for a credentialed device.
+       *
+       * None of the five is written for a monitor-backed device - see the
+       * guard above the try.
        */
-      deviceUpdate["lastPolledAt"] = now;
-      deviceUpdate["isReachable"] = isDeviceReachable;
+      if (!isMonitorBacked) {
+        deviceUpdate["lastPolledAt"] = now;
+        deviceUpdate["isReachable"] = isDeviceReachable;
+
+        if (isDeviceReachable) {
+          deviceUpdate["lastSeenAt"] = now;
+        }
 
-      if (isDeviceReachable) {
-        deviceUpdate["lastSeenAt"] = now;
+        deviceUpdate["isSnmpReachable"] = walkRan ? walkSucceeded : null;
+
+        if (walkSucceeded) {
+          deviceUpdate["lastSnmpSeenAt"] = now;
+        }
       }
 
       if (systemInfo?.sysDescr) {
@@ -232,24 +318,45 @@ export default class NetworkInventoryUtil {
         deviceUpdate["cdpNeighbors"] = cdpNeighbors.slice(0, 256);
       }
 
-      if (walkedInterfaces.length > 0) {
-        deviceUpdate["interfacesTotal"] = walkedInterfaces.length;
-        deviceUpdate["interfacesUp"] = walkedInterfaces.filter(
-          (walked: SnmpInterface) => {
-            return walked.isAdministrativelyUp && walked.isOperationallyUp;
-          },
-        ).length;
-        deviceUpdate["interfacesDown"] = walkedInterfaces.filter(
-          (walked: SnmpInterface) => {
-            return walked.isAdministrativelyUp && !walked.isOperationallyUp;
-          },
-        ).length;
+      /*
+       * The cached interface counts are health columns too (the device list
+       * and the site overview read interfacesDown), so a monitor-backed
+       * device keeps them out for the same reason as the poll columns.
+       *
+       * On a ping-only poll they go NULL rather than staying put: a device
+       * whose credentials were removed would otherwise keep showing the
+       * interface counts of its last walk indefinitely, and the list would
+       * read "3 interfaces down" on a device nothing is walking any more.
+       * A failed walk in snmp mode, by contrast, leaves them alone - the
+       * last good counts are the best estimate until the next good walk,
+       * exactly as the lastWalkLog baseline is kept across failed polls.
+       */
+      if (!isMonitorBacked) {
+        if (pollMode === "ping") {
+          deviceUpdate["interfacesTotal"] = null;
+          deviceUpdate["interfacesUp"] = null;
+          deviceUpdate["interfacesDown"] = null;
+        } else if (walkedInterfaces.length > 0) {
+          deviceUpdate["interfacesTotal"] = walkedInterfaces.length;
+          deviceUpdate["interfacesUp"] = walkedInterfaces.filter(
+            (walked: SnmpInterface) => {
+              return walked.isAdministrativelyUp && walked.isOperationallyUp;
+            },
+          ).length;
+          deviceUpdate["interfacesDown"] = walkedInterfaces.filter(
+            (walked: SnmpInterface) => {
+              return walked.isAdministrativelyUp && !walked.isOperationallyUp;
+            },
+          ).length;
+        }
       }
 
       /*
-       * Always non-empty now: even a walk that reached nothing has to
-       * record that we tried, or the staleness backstop cannot tell a
-       * failing device from an unpolled one.
+       * Always non-empty for a probe-polled device: even a poll that
+       * reached nothing has to record that we tried, or the staleness
+       * backstop cannot tell a failing device from an unpolled one. Only
+       * the monitor-backed case above can leave it empty, and then there
+       * is genuinely nothing to write.
        */
       if (Object.keys(deviceUpdate).length > 0) {
         await NetworkDeviceService.updateOneById({

package/Server/Utils/Monitor/SeriesContextEnricher.ts

@@ -0,0 +1,304 @@
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import { JSONObject } from "../../../Types/JSON";
+import MonitorType from "../../../Types/Monitor/MonitorType";
+import SeriesDebugHints from "../../../Types/Monitor/SeriesContext/SeriesDebugHints";
+import SeriesLabelDisplay, {
+  DisplaySeriesLabel,
+} from "../../../Types/Monitor/SeriesContext/SeriesLabelDisplay";
+
+/*
+ * Make a per-series alert or incident say WHICH pod, container, node or
+ * mount it is about.
+ *
+ * A grouped metric monitor raises one alert per breaching series and
+ * stores that series' identity in `seriesLabels`. Until now the identity
+ * stopped there: the title came from the criteria template, which is one
+ * fixed string shared by every series, so a cluster with fifty saturated
+ * pods produced fifty alerts whose titles were character-for-character
+ * identical. The identity was reachable - in a table, at the bottom of
+ * the alert detail page - but the alert list, the Slack message, the
+ * email and the phone notification all showed the same undifferentiated
+ * line.
+ *
+ * This enricher runs at creation time, after the criteria template has
+ * been rendered, and appends the series identity to the title and a
+ * resource + first-commands block to the description.
+ *
+ * Two properties matter and are covered by tests:
+ *
+ *   - It never fights the user's own template. A title that already
+ *     names the series (because the user wrote `{{resource.k8s.pod.name}}`
+ *     into it, or because the new `{{seriesResourceSuffix}}` variable
+ *     expanded there) is left exactly as the user wrote it. The check is
+ *     on the VALUES, not on the placeholders, so it works the same
+ *     whether the identity arrived from a template variable or was typed
+ *     literally.
+ *
+ *   - It is a no-op for whole-monitor alerts. A monitor with no group-by
+ *     has no series identity, and nothing is appended.
+ */
+
+/*
+ * Hoisted rather than written inline at its single use site: two lint
+ * rules disagree about parenthesising a regex literal in an expression
+ * and `--fix` oscillates between them (ESLintCircularFixesWarning). A
+ * named constant sidesteps the argument and reads better anyway.
+ */
+const WordCharacterPattern: RegExp = /[A-Za-z0-9]/;
+
+export default class SeriesContextEnricher {
+  /**
+   * The `title` column's own limit, taken from the schema rather than
+   * restated as a number - `Alert.title` and `Incident.title` are both
+   * `ColumnType.LongText`.
+   */
+  private static readonly MaxTitleLength: number = ColumnLength.LongText;
+
+  /**
+   * Shortest label value that may be matched as a bare substring.
+   *
+   * Ceph pool ids and Proxmox vmids are one or two characters, and
+   * "does the title contain 3?" is answered `true` by any title with a
+   * threshold in it ("Restarts > 3"). Below this length only this
+   * module's own `Name: value` rendering counts as a mention, which
+   * keeps idempotency without letting a coincidence swallow the
+   * identity.
+   */
+  private static readonly MinimumMatchableValueLength: number = 4;
+
+  /**
+   * What counts as "part of the same word" when deciding whether a
+   * value found in the text is really a mention of it.
+   *
+   * Deliberately narrower than `\w`: `-`, `.`, `/` and `_` all appear
+   * inside the values themselves (pod names, mountpoints, Ceph daemon
+   * ids), so treating them as word characters would make a value that
+   * IS present look like part of a longer token.
+   */
+  private static isWordCharacter(character: string): boolean {
+    if (character === "") {
+      return false;
+    }
+
+    return WordCharacterPattern.test(character);
+  }
+
+  /**
+   * Whether `text` already names this label's value.
+   *
+   * Two ways to be already-named, and both matter:
+   *
+   *   - This module's own rendering (`"Pod: web-1"`) is matched exactly.
+   *     That is what makes the enricher idempotent, whatever the value
+   *     looks like.
+   *
+   *   - A distinctive value appearing anywhere on a token boundary. That
+   *     is the user's own template - `{{resource.k8s.pod.name}}` has
+   *     already expanded by the time this runs, so the check has to be
+   *     on the VALUE, not on the placeholder. The boundary requirement
+   *     stops a pod called `web` from counting as mentioned because the
+   *     title happens to contain the word "website".
+   */
+  private static isValueMentioned(input: {
+    text: string;
+    label: DisplaySeriesLabel;
+  }): boolean {
+    const { text, label } = input;
+
+    if (text.includes(`${label.name}: ${label.value}`)) {
+      return true;
+    }
+
+    if (
+      label.value.length < SeriesContextEnricher.MinimumMatchableValueLength
+    ) {
+      return false;
+    }
+
+    let searchFrom: number = 0;
+
+    for (;;) {
+      const index: number = text.indexOf(label.value, searchFrom);
+
+      if (index === -1) {
+        return false;
+      }
+
+      const before: string = index > 0 ? text.charAt(index - 1) : "";
+      const after: string = text.charAt(index + label.value.length);
+
+      if (
+        !SeriesContextEnricher.isWordCharacter(before) &&
+        !SeriesContextEnricher.isWordCharacter(after)
+      ) {
+        return true;
+      }
+
+      searchFrom = index + 1;
+    }
+  }
+
+  /*
+   * The identity labels not already present in `text`.
+   *
+   * Deliberately per-label rather than all-or-nothing: a title that
+   * mentions the pod by name but not the namespace still gets the
+   * namespace appended, because dropping the rest whenever a user's
+   * template happened to mention one identifier would lose exactly the
+   * context this exists to add.
+   */
+  private static getUnmentionedLabels(input: {
+    text: string;
+    seriesLabels: JSONObject | undefined;
+  }): Array<DisplaySeriesLabel> {
+    const labels: Array<DisplaySeriesLabel> =
+      SeriesLabelDisplay.getDisplayLabels(input.seriesLabels);
+
+    if (labels.length === 0) {
+      return [];
+    }
+
+    const text: string = input.text || "";
+
+    return labels.filter((label: DisplaySeriesLabel) => {
+      return !SeriesContextEnricher.isValueMentioned({ text, label });
+    });
+  }
+
+  /*
+   * `title` with the series identity appended, or `title` unchanged when
+   * there is no identity to add or the title already carries it.
+   */
+  public static enrichTitle(input: {
+    title: string;
+    seriesLabels: JSONObject | undefined;
+  }): string {
+    const title: string = input.title || "";
+
+    const unmentioned: Array<DisplaySeriesLabel> =
+      SeriesContextEnricher.getUnmentionedLabels({
+        text: title,
+        seriesLabels: input.seriesLabels,
+      });
+
+    if (unmentioned.length === 0) {
+      return title;
+    }
+
+    /*
+     * Rebuild a label map from just the unmentioned labels so the
+     * shared formatter still applies its own ordering and title cap
+     * rather than this module reimplementing either.
+     */
+    const remaining: JSONObject = {};
+
+    for (const label of unmentioned) {
+      remaining[label.key] = label.value;
+    }
+
+    const suffix: string = SeriesLabelDisplay.buildTitleSuffix(remaining);
+
+    if (!suffix) {
+      return title;
+    }
+
+    /*
+     * `Alert.title` and `Incident.title` are LongText, i.e. 500
+     * characters. Overflowing the column does not produce a shortened
+     * title - it fails the INSERT, and the alert does not exist at all.
+     * That would turn a labelling improvement into dropped pages, so the
+     * appended identity is bounded here as well as per-value inside
+     * SeriesLabelDisplay.
+     *
+     * A base title that is ALREADY at or over the limit is returned
+     * untouched: it was going to fail with or without this enricher, and
+     * silently truncating what the user wrote is not this module's call
+     * to make.
+     */
+    if (title.length >= SeriesContextEnricher.MaxTitleLength) {
+      return title;
+    }
+
+    const room: number = SeriesContextEnricher.MaxTitleLength - title.length;
+
+    if (suffix.length <= room) {
+      return `${title}${suffix}`;
+    }
+
+    return `${title}${suffix.slice(0, room)}`;
+  }
+
+  /*
+   * `description` with an "Affected resource" block and the read-only
+   * commands worth running first appended.
+   *
+   * The description is what reaches Slack, email and the mobile push, so
+   * this is where the full identity goes - the title only has room for
+   * the top few labels.
+   */
+  public static enrichDescription(input: {
+    description: string;
+    seriesLabels: JSONObject | undefined;
+    monitorType: MonitorType | undefined;
+  }): string {
+    const description: string = input.description || "";
+
+    const labels: Array<DisplaySeriesLabel> =
+      SeriesLabelDisplay.getDisplayLabels(input.seriesLabels);
+
+    if (labels.length === 0) {
+      return description;
+    }
+
+    const sections: Array<string> = [];
+
+    /*
+     * Only skip the resource block when the description already names
+     * EVERY label. A description mentioning the pod but not the node is
+     * still missing the thing the engineer needs.
+     */
+    const unmentioned: Array<DisplaySeriesLabel> =
+      SeriesContextEnricher.getUnmentionedLabels({
+        text: description,
+        seriesLabels: input.seriesLabels,
+      });
+
+    const block: string = SeriesLabelDisplay.buildMarkdownBlock(
+      input.seriesLabels,
+    );
+
+    /*
+     * The exact-block check is the idempotency guarantee. Per-label
+     * matching alone cannot provide it: a one-character label value
+     * (a Ceph pool id, a Proxmox vmid) is deliberately not matched as a
+     * bare substring, so a second pass would append the block again.
+     */
+    if (unmentioned.length > 0 && block && !description.includes(block)) {
+      sections.push(block);
+    }
+
+    const commandsBlock: string = SeriesDebugHints.buildMarkdownBlock({
+      monitorType: input.monitorType,
+      seriesLabels: input.seriesLabels,
+    });
+
+    /*
+     * The commands embed the label values, so a description that
+     * already carries them would otherwise get a near-duplicate block
+     * appended on top of a user's own runbook snippet.
+     */
+    if (commandsBlock && !description.includes(commandsBlock)) {
+      sections.push(commandsBlock);
+    }
+
+    if (sections.length === 0) {
+      return description;
+    }
+
+    if (!description.trim()) {
+      return sections.join("\n\n");
+    }
+
+    return `${description}\n\n${sections.join("\n\n")}`;
+  }
+}

package/Server/Utils/NetworkDevice/DeviceHealthAggregation.ts

@@ -27,12 +27,12 @@ import { DeviceHealthState } from "../../../Utils/NetworkSite/SiteStatusRollupUt
  *
  * So the rule does not move. What moves is the DATA REDUCTION.
  *
- * `deviceHealthState` is a pure function of six facts about a row, and five of
- * them are already booleans or three-state flags. Group the table by those
- * facts in SQL and 80,000 rows collapse into at most a few per site — one
- * bucket per distinct combination that actually occurs. Then hand each bucket
- * back to the REAL classifier once and multiply its verdict by the bucket's
- * count.
+ * `deviceHealthState` is a pure function of seven facts about a row, and six
+ * of them are already booleans, three-state flags or a column that only ever
+ * holds two values. Group the table by those facts in SQL and 80,000 rows
+ * collapse into at most a few per site — one bucket per distinct combination
+ * that actually occurs. Then hand each bucket back to the REAL classifier
+ * once and multiply its verdict by the bucket's count.
  *
  * One rule, one implementation, and the wire carries buckets instead of rows.
  *
@@ -121,20 +121,26 @@ const DEVICE_HEALTH_DISCRIMINATOR_COLUMNS: Array<AggregateColumn> = [
    * The column only ever holds a handful of distinct values, so the raw form
    * costs nothing in bucket count.
    *
-   * Note carefully WHO reads it: `deviceHealthState` never receives it (it is
-   * not part of `DeviceHealthStateInput`, and `deviceHealthInputForGroup` does
-   * not emit it), so the per-site health rollups are indifferent to it. Its
-   * one consumer is the Overview's fleet tally, which re-attaches it and calls
-   * `DeviceReachabilityUtil` directly — and a tally that dropped it would
-   * report every ping-only device as Pending forever (issue #3392, one level
-   * up).
+   * Every consumer of a bucket reads it. `deviceHealthInputForGroup` and
+   * `deviceRollupStateForGroup` carry it into the classifier inputs, where
+   * the shared reachability rule uses it to decide whether the poll facts
+   * beside it mean anything. On a monitor-backed device they do not: its
+   * `isReachable` mirrors the bound monitor (NULL when nothing is bound) and
+   * its `lastSeenAt` is whatever a probe last found before it stopped asking
+   * — so an unstamped monitor-backed bucket has to classify as "unknown",
+   * not as whatever those leftovers happen to say, or the site card and the
+   * device list under it describe two different networks. The Overview's
+   * fleet tally reads it for the same reason one level up (issue #3392: a
+   * tally that dropped it reported every ping-only device as Pending
+   * forever).
    *
-   * It therefore costs the rollup path a discriminator it does not use. On a
-   * real fleet that costs nothing, because `monitoringMethod` is almost
+   * Dropping it from the group keys would therefore not be a harmless
+   * simplification: a bucket that mixed probe-polled and monitor-backed devices with
+   * the same poll facts would classify all of them by the poll rule. On a
+   * real fleet it also costs nothing, because `monitoringMethod` is almost
    * perfectly correlated with whether the device carries a stamped monitor
    * status — which is already a group key — so it splits no bucket that
-   * `currentMonitorStatusId` had not split anyway. Keeping one discriminator
-   * set is worth more than saving that.
+   * `currentMonitorStatusId` had not split anyway.
    */
   {
     expression: column("monitoringMethod"),
@@ -270,7 +276,7 @@ export interface DeviceHealthGroup {
   monitorStatusId: string | null;
   /*
    * Null for rows written before the column existed, which
-   * `NetworkDeviceMonitoringMethodUtil.parse` reads as SNMP.
+   * `NetworkDeviceMonitoringMethodUtil.parse` reads as Probe.
    */
   monitoringMethod: string | null;
   isReachable: boolean | null;
@@ -373,6 +379,11 @@ export function deviceHealthInputForGroup(data: {
      * the synthetic dates above are placed relative to.
      */
     pollingIntervalInMinutes: undefined,
+    /*
+     * Carried verbatim — the classifier parses it, and NULL reads as Probe
+     * there. See the discriminator column for why a bucket cannot drop it.
+     */
+    monitoringMethod: group.monitoringMethod,
     interfacesDown: group.hasDownInterfaces ? 1 : 0,
   };
 }
@@ -422,6 +433,8 @@ export function deviceRollupStateForGroup(data: {
     lastSeenAt: group.hasBeenSeen ? contactAt : null,
     // See deviceHealthInputForGroup — staleness is already applied.
     pollingIntervalInMinutes: undefined,
+    // ...and for why this rides along with the poll facts it qualifies.
+    monitoringMethod: group.monitoringMethod,
     deviceCount: group.deviceCount,
   };
 }