I did some more looking and testing and ran it with the test-alert.php with the -d flag. On a box with no sysContact I see this:
SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = "disable_notify" && device_id = '984']
SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = 'override_sysContact_bool' AND device_id = '984']
SQL[SELECT user_id FROM devices_perms WHERE access_level >= 0 AND device_id = '984']
Issuing Alert-UID #55015/1: pagerduty => OKSQL[SELECT * FROM `vrf_lite_cisco` WHERE `device_id` = '984']
SQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('984','984','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'pagerduty\'','')]
; ; mail => ERROR: You must provide at least one recipient email address.
SQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('984','984','NULL','error',NOW(),'5','Could not issue critical alert for rule \'Device down\' to transport \'mail\' Error: You must provide at least one recipient email address.','')]
; ; ; ; ; ; ; ; ; ; slack => OKSQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('984','984','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'slack\'','')]
; ; ; syslog => OKSQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('984','984','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'syslog\'','')]
; ; ; ;
And on a box that does have it filled in:
SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = "disable_notify" && device_id = '1000']
SQL[SELECT 1 FROM information_schema.COLUMNS WHERE TABLE_NAME = 'devices' && COLUMN_NAME = 'device_id']
SQL[SELECT * FROM devices WHERE (devices.device_id = '1000') && (((devices.status = 0 && ((devices.disabled = 0 && devices.ignore = 0)))) = "1" && devices.status_reason = "icmp" )]
SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = 'override_sysContact_bool' AND device_id = '1000']
SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = 'override_sysContact_string' AND device_id = '1000']
SQL[SELECT user_id FROM devices_perms WHERE access_level >= 0 AND device_id = '1000']
SQL[SELECT hostname, sysName, sysDescr, hardware, version, location, purpose, notes, uptime FROM devices WHERE device_id = '1000']
SQL[SELECT `template`,`title`,`title_rec` FROM `alert_templates` JOIN `alert_template_map` ON `alert_template_map`.`alert_templates_id`=`alert_templates`.`id` WHERE `alert_template_map`.`alert_rule_id`='1']
Issuing Alert-UID #55014/1: pagerduty => OKSQL[SELECT * FROM `devices` WHERE `device_id` = '1000']
SQL[SELECT * FROM `vrf_lite_cisco` WHERE `device_id` = '1000']
SQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('1000','1000','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'pagerduty\'','')]
; ; mail => OKSQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('1000','1000','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'mail\'','')]
; ; ; ; ; ; ; ; ; ; slack => OKSQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('1000','1000','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'slack\'','')]
; ; ; syslog => OKSQL[INSERT INTO `eventlog` (`host`,`device_id`,`reference`,`type`,`datetime`,`severity`,`message`,`username`) VALUES ('1000','1000','NULL','alert',NOW(),'1','Issued critical alert for rule \'Device down\' to transport \'syslog\'','')]
; ; ; ;
It doesn’t look like it’s got enough in the debug to show what it’s trying to when it gets to this point in the alerts.inc.php:
# Send email to default contact if no other contact found
if ((count($tmp_contacts) == 0) && ($config['alert']['default_if_none']) && (!empty($config['alert']['default_mail']))) {
$tmp_contacts[$config['alert']['default_mail']] = 'NOC';
}
Checking in the global settings I can see that default_if_none is set:
And default_mail as well (intentionally cut off after the @):
:
