Skip to content

Check threshold and filter keywords against attributes#412

Open
inqrphl wants to merge 7 commits into
mainfrom
check-threshold-and-filter-keywords-against-attributes
Open

Check threshold and filter keywords against attributes#412
inqrphl wants to merge 7 commits into
mainfrom
check-threshold-and-filter-keywords-against-attributes

Conversation

@inqrphl

@inqrphl inqrphl commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

add two sanity functions to check:

checkThresholdKeywordsAgainstAttributeNames -> this prints to log about keywords that are used in thresholds, but are not defined in check attributes. they are not fatal to the check, as thresholds can work on perfdata metric labels as well

checkFilterKeywordsAgainstAttributeNames -> this does the same against filter now, afaik filters only work on attribute names, so using a wrong keyword means a user problem. this is fatal for the check, prevents it from working and returns critical.

call these two functions after parsing the arguments of a check, after security check, and before running it. only called if chk.argsPassthrough is false

other fixes:

switch to using ConditionList.GetListOfKeywords in CheckData.GetAllThresholdKeywords. no need to use helper function when the ConditionList class has a member function, or whatever they are called in golang

fix ConditionList.GetListOfKeywords adding empty keywords, group conditions have empty keywords

add 'temperature' to the attribute list of check_temperature. it was already being added to entry, but was not written in the check definition, it uses a default filter 'temperature != 0 and temperature != 1' and tests were failing since 'temperature' is not in attribute list

Ahmet Oeztuerk added 4 commits July 14, 2026 18:11
checkThresholdKeywordsAgainstAttributeNames -> this prints to log about keywords that are used in thresholds, but are not defined in check attributes. they are not fatal to the check, as thresholds can work on perfdata metric labels as well

checkFilterKeywordsAgainstAttributeNames -> this does the same against filter now, afaik filters only work on attribute names, so using a wrong keyword means a user problem. this is fatal for the check

call these two functions after parsing the arguments of a check, and before running it

other fixes:

switch to using ConditionList.GetListOfKeywords in CheckData.GetAllThresholdKeywords

fix ConditionList.GetListOfKeywords adding empty keywords, group conditions have empty keywords
it was already being added to entry, but was not written in the check definition.

it uses a default filter 'temperature != 0 and temperature != 1' and tests were failing since 'temperature' is not in attribute list
…ly perform them if chk.argsPassthrough is false

this means security checks are done first, then semantic checks.

also fixes some of the failing tests
@inqrphl

inqrphl commented Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Some examples:

./snclient -vvv --logfile stdout run check_drivesize filter="(localised_remote_path eq asd) or (size eq asdasd) or (path like adasdsa)" filter="(total_used gt 100)"
UNKNOWN - filter condition uses keyword(s) not present in the attributes, run with --help to get a list of attributes, extra keywords: path
./snclient -vvv --logfile stdout run check_files path=. filter="path like adasdsa" filter="directoryname eq pkg

UNKNOWN - filter condition uses keyword(s) not present in the attributes, run with --help to get a list of attributes, extra keywords: directoryname
./snclient -vvv --logfile stdout run check_process filter="commandline regexp '*apache*'"
UNKNOWN - filter condition uses keyword(s) not present in the attributes, run with --help to get a list of attributes, extra keywords: commandline

@lgmu

lgmu commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

I like this, but maybe we can slightly adjust the output, e.g.:
UNKNOWN - filter condition uses unknown attribute 'path', run with --help to get a list of attributes
UNKNOWN - filter condition uses undefined attribute 'path', run with --help to get a list of attributes
UNKNOWN - filter condition uses nonexistent attribute 'path', run with --help to get a list of attributes

Same for ok/warning/ critical condition

@sni

sni commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

i guess this currently won't work with some checks, ex.:

  • check_wmi does not has a fixed set of attribute names.
  • check_logfile has this columnN attribute

I like the idea, but this potentially breaks some checks if we are not careful. Might be a good idea to add tests somehow, which test if there are elements in the dataList which are
not present in the attribute list.
Also maybe the attribute check could support wildcards. Then we can document this cases better, so we can add a doc entry in check_wmi having something like * as attribute name.

Ahmet Oeztuerk added 3 commits July 15, 2026 10:50
…amed attributes can be defined using regex.

use these in conjunction with fixed attribute names when checking for keywords in the condition string

add extra filter args to check_logfile 'column*' and check_wmi '.*'
check_drivesize: flags, letter, opts
check_logfile: column (adjusted regex)
check_memory: physical, swap, committed, virtual
check_os_updates: old_version, repository, arch, prefix
check_pdf: name
@inqrphl

inqrphl commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Added a regex list called extraFilterAttributes to the checkData, which stores regexes.

CheckFilterKeywordsAgainstAttributeNames now appends the attribute names and extraFilterAttributes to a regex list, and then checks the keywords against it. If it doesnt match any regex, it is considered extra.

Then I used AI to discover unfixed, dynamically added attributes to the list. These are generally not documented, mostly because they are specific to a platform. It would be nice to document them, since we instruct user to run with --help, then they would be printed out. If they are specific to a platform, the description can mention it.

The problem is, I am unsure if the AI pass added everything.

check_drivesize: flags, letters, opts
check_logfile: column.*
check_memory: physical, swap, committed, virtual
check_os_updates: old_version, repository, arch, prefix
check_pdh: name.*
check_temperature: temperature (added to fix attributes already in PR)
check_wmi: .*

Also adjusted the output, shows the first wrong keyword like @lgmu wanted:

./snclient -vvv --logfile stdout run check_process filter="commandline regexp '*apache*'"
UNKNOWN - filter condition uses unknown attribute 'commandline', run with --help to get a list of attributes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants