Skip to content

Remote collector support - #386

Merged
TheWitness merged 26 commits into
developfrom
remote_collector_support
Oct 6, 2026
Merged

TheWitness merged 26 commits into
developfrom
remote_collector_support

Conversation

@bmfmancini

Copy link
Copy Markdown
Member

Add support for remote collectors running syslog to process syslog alerts and send the messages back to the main syslog server for centralized viewing

if main syslog is offline remotes will continue to process , alarm and hold syslog events until main is back online
This follows the same model as the cacti remote collectors

Copilot AI balanced review requested due to automatic review settings October 6, 2026 18:35
@bmfmancini

Copy link
Copy Markdown
Member Author

@copilot resolve the merge conflicts in this pull request

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Fresh-install schema gaps, incomplete realm migration, dedicated-database incompatibility, and a parallel-transfer data-loss path must be addressed.

Review effort: Balanced
Findings: 4 High severity · 2 Medium severity · 4 Low severity

Open (10)
What changed in this PR

Adds durable remote-collector Syslog replication, centralized delivery, recovery, telemetry, and granular rule permissions.

Changes:

  • Adds remote replication outbox, recovery worker, central receipts, and status telemetry.
  • Splits rule viewing/editing permissions and strengthens mutation authorization.
  • Expands partition observability, schema migrations, localization, and tests.
File Description
functions.php Implements replication, recovery, telemetry, and rule authorization.
setup.php Adds schemas, settings, realms, and migrations.
syslog_process.php Triggers delivery and recovery after processing.
syslog_recovery.php Adds the recovery CLI worker.
syslog.php Displays replication and partition status.
syslog_alerts.php Enforces rule-edit permission.
syslog_removal.php Enforces rule-edit permission.
syslog_reports.php Enforces rule-edit permission.
syslog_device_rules.php Handles failed rule queries safely.
css/​search.css Styles new status tables.
locales/​po/​cacti.pot Updates translation template references.
INFO Bumps version to 4.6.
CHANGELOG.md Documents new functionality.
tests/​Unit/​ReplicationDeliveryTest.php Tests replication and recovery behavior.
tests/​Unit/​StatusTelemetryTest.php Tests maintenance telemetry history.
tests/​Unit/​MessageRuleLinksTest.php Updates permission-link coverage.
tests/​Unit/​DeviceRulePolicyTest.php Tests device-rule replication setup.
tests/​Security/​PartitionTableLockingTest.php Updates prepared-query expectations.
tests/​Security/​LogicalMessageSearchTest.php Verifies stable union projections.
tests/​regression/​rule_realm_upgrade_test.php Exercises realm migration behavior.
tests/​regression/​partition_observability_test.php Tests partition health summaries.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread functions.php Outdated
Comment thread functions.php Outdated
Comment thread setup.php
Comment thread setup.php Outdated
Comment thread functions.php Outdated
Comment thread setup.php Outdated
Comment thread CHANGELOG.md Outdated
Comment thread locales/po/cacti.pot Outdated
Comment thread syslog_recovery.php
Comment thread tests/Unit/ReplicationDeliveryTest.php Outdated

Copilot AI commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

@copilot resolve the merge conflicts in this pull request

Resolved the conflicts in merge commits f74259c and 485c786; 9892d0d adds the missing gettext entries. Publishing was rejected by branch protection, so these commits remain local.

bmfmancini and others added 12 commits October 6, 2026 15:02
While the main collector is offline, remote collectors retain processed records locally for normal viewing.
After confirmed delivery to the main collector, those temporary local syslog records are removed using tracked source identities.
If the admin enables the new option, remote records remain stored and recovery does not remove them.
Alerts, removal rules, and replication remain in the existing processing flow.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Updated the Syslog replication outbox feature to ensure processed events are delivered idempotently and retained through outages. Other features include Device Alert Rules and enhancements to the Syslog Status tab.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: bmfmancini <13388748+bmfmancini@users.noreply.github.com>
@bmfmancini
bmfmancini force-pushed the remote_collector_support branch from 23adb9e to 9eef41f Compare October 6, 2026 19:03
Co-authored-by: bmfmancini <13388748+bmfmancini@users.noreply.github.com>
bmfmancini and others added 5 commits October 6, 2026 15:41
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@TheWitness
TheWitness merged commit 1d67e1c into develop Oct 6, 2026
6 checks passed
@TheWitness
TheWitness deleted the remote_collector_support branch October 6, 2026 20:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants