I’m trying to create an alert rule that would copy the “Devices unpolled” frontend message’s functionality, so that I would be notified by transport instead of a message in frontend.
I was wondering, how are the alert rules processed, in particular, what is the purpose of builder and query entries in the database?
For example, I have an array of alert rules from previous versions of LibreNMS where builder field is completely empty - they work fine. This may indicate that builder is not necessary at all in order to process an alert rule.
Knowing this, I try to create an alert rule with the same query as frontend does:
SELECT * FROM devices WHERE last_polled <= DATE_ADD(NOW(), INTERVAL - 15 minute) AND ignore = 0 AND disabled = 0 AND status = 1;
This one fires for every device I have, which is logical - there are 4 unpolled devices in my network and every poller processes finds a match, mapping an alert to a device it has polled. Guessing if it is possible to resolve with builder criteria, but I lack understanding what is it used for…
Would be grateful for any hints on how to proceed with the particular case and explanation on builder and query of the alert rule.