Alerts not sent for Inverted matches on process

Help
1

Hi, apologies for incorrectly starting this as a github issue, as requested discussing here

I’ve setup an alert rule for monitoring if a process is running:

Inverted processes.command LIKE '%/usr/sbin/mysqld%'

This works as intended and triggers if mysqld is stopped, however I never get alert emails, and see the following in the log:

Could not issue critical alert for rule ‘Check MySQL is running’ to transport ‘mail’ Error: You must provide at least one recipient email address.

Looking into this it looks like the contacts for the alert aren’t being populated in alerts.inc.php (line 584):

if (empty($alert['query'])) {
          $alert['query'] = GenSQL($alert['rule'], $alert['builder']);
}
$sql = $alert['query'];
$qry = dbFetchRows($sql, array($alert['device_id']));
$alert['details']['contacts'] = GetContacts($qry);

For my inverted process match $sql is:

SELECT * FROM devices,processes WHERE (devices.device_id = ? AND devices.device_id = processes.device_id) AND processes.command LIKE '%/usr/sbin/mysqld%'

which of course returns no rows, so GetContacts returns nothing.

I have tested fixing this by just passing in array('device_id' => $alert['device_id']) if it’s an inverted match and $qry is empty but I’m not sure if that’s the right approach (will this be a problem for other inverted rules or will it just be a problem with processes)?

If you can provide some guidance I’m happy to do a pull request.

Thanks

Ed