4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	8eae3d3825	feat(syslog): pattern alerts: telling phrases counted per source each minute for alert rules, storage-trouble presets (#6001) ... A pattern (phrases, a severity, a source, a window) is counted every minute into plugin_metrics as lines_matching_<key> per added source, zero included, so an ordinary alert rule fires on a match and clears once the window passes. Each count reads only the lines stored since the last, by line id; a new or changed pattern reads its window once. Patterns page with ready-made storage-trouble presets and "Alert on it", which opens the rule form aimed at the count. Source names are kept unique, and a rename moves its counts and the rules on them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 06:22:54 -04:00
bvandeusenandClaude Opus 5.5	dadec4e355	feat(syslog): a source's lines to read and search, on its page, its host's and its SNMP device's, and over MCP (#6000) ... - /plugins/syslog/sources/<id>: the lines newest first, loading as you scroll, filtered by severity and worse, app, text and time, with day dividers and times to the second in the reader's zone. - The Syslog page links each source and shows its lines in the last hour. - A Syslog panel on a host's page and an SNMP device's: the newest lines of the sources bound to it or at its address. - MCP: list_syslog_sources and search_syslog (source, host, text, severity and worse, app, range, paging by next_before). - Shared: escape_like moves to steward/core/like.py and cut_middle to the MCP shaping module, replacing four inline copies; |when takes seconds=. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 06:05:52 -04:00
bvandeusenandClaude Opus 5.5	6ff9cffed4	fix(syslog): word its audit actions, list its tables for backups, mark its page top-level, reach its modules as loaded (#5999) ... - Audit: syslog.source_* worded, and a Syslog filter area. - Backups keep syslog_sources (added, named, ignored; what it last sent isn't compared) and leave syslog_lines out, as logs. - The integration test reaches the plugin as loaded (#5775), so its tables aren't defined twice; ruff E741. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 23:12:59 -04:00
bvandeusenandClaude Opus 5.5	51892a02c0	feat(syslog): a syslog receiver: UDP and TCP, senders offered before they're kept, each source's lines in a ring (#5999) ... - plugins/syslog: RFC 5424 and RFC 3164 parsing, RFC 6587 TCP framing. - Lines are queued as they arrive and stored every 5 s through a Holding, so a storage stall delays them rather than losing them. - A new sender is an offered source, counted and not kept, until an admin adds it on the Syslog page (name, host); it can be ignored instead. - The listener follows the plugin's settings (port, UDP, TCP), rebinding within seconds of a save; a port it can't open is said on the page. - Hourly ring per source: age window and byte cap from Settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 23:09:07 -04:00