Problem with Alerts and Telegram

Tags: #<Tag:0x00007fdeebb387c0>

Hi Guys!!

I am receiving alerts in telegram with the following format.

Severity: %severity
{if %state == 0}Time elapsed: %elapsed
{/if}Timestamp: %timestamp
Unique-ID: %uid
Rule: {if %name}%name{else}%rule{/if}
{if %faults}Faults:
{foreach %faults} #%key: %value.string
{/foreach}{/if}Alert sent to: {foreach %contacts}%value <%key> {/foreach}

This is configured as MARKDOWN, on Alert Transport Config.
With HTTP mode I do not receive messages in telegram and the following error in the event log.

Could not issue critical alert for rule ‘Devices up/down’ to transport ‘telegram’ Error: HTTP Status code 400
Any suggestions??

Component Version
LibreNMS 1.48.1-78-g5d3a28683
DB Schema 2019_02_10_220000_add_dates_to_fdb (132)
PHP 7.2.15-0ubuntu0.18.04.1
MySQL 10.1.38-MariaDB-0ubuntu0.18.04.1
RRDTool 1.7.0


[OK] Composer Version: 1.8.4
[OK] Dependencies up-to-date.
[OK] Database connection successful
[OK] Database schema correct

Thanks @TheGreatDoc.
I’ve update all templates, but I still receive this error on event log.

Could not issue critical alert for rule ‘Devices up/down’ to transport ‘telegram’ Error: HTTP Status code 400

I made a debug with “test-alert.php”, and de result is:

SQL[SELECT device_id FROM devices WHERE hostname = ? [“”] 0.38ms]

SQL[SELECT, alerts.device_id, alerts.rule_id, alerts.state, alerts.note, FROM alerts WHERE alerts.device_id = 55 && alerts.rule_id = 4 [] 0.33ms]

SQL[SELECT,alert_log.rule_id,alert_log.device_id,alert_log.state,alert_log.details,alert_log.time_logged,alert_rules.rule,alert_rules.severity,alert_rules.extra,,alert_rules.builder FROM alert_log,alert_rules WHERE alert_log.rule_id = && alert_log.device_id = ? && alert_log.rule_id = ? && alert_rules.disabled = 0 ORDER BY DESC LIMIT 1 [55,4] 0.43ms]

SQL[SELECT DISTINCT a.* FROM alert_rules a
LEFT JOIN alert_device_map d ON
LEFT JOIN alert_group_map g ON
LEFT JOIN device_group_device dg ON g.group_id=dg.device_group_id
WHERE a.disabled = 0 AND ((d.device_id IS NULL AND g.group_id IS NULL) OR d.device_id=? OR dg.device_id=?) [55,55] 0.28ms]

SQL[SELECT attrib_value FROM devices_attribs WHERE attrib_type = “disable_notify” && device_id = ? [55] 0.25ms]

SQL[SELECT hostname, sysName, sysDescr, sysContact, os, type, ip, hardware, version, purpose, notes, uptime, status, status_reason, locations.location FROM devices LEFT JOIN locations ON = devices.location_id WHERE device_id = ? [55] 0.27ms]

SQL[SELECT * FROM devices_attribs WHERE device_id = ? [55] 0.27ms]

SQL[select * from device_perf where device_id = ? order by timestamp desc limit 1 [55] 0.18ms]

SQL[select * from alert_templates where exists (select * from alert_template_map where = alert_template_map.alert_templates_id and alert_rule_id = ?) limit 1 [4] 0.17ms]

SQL[select * from alert_templates where name = ? limit 1 [“Default Alert Template”] 0.18ms]

Issuing Alert-UID #169/1:
SQL[SELECT rule_id FROM alerts WHERE id=? [94] 0.17ms]

SQL[SELECT b.transport_id, b.transport_type, b.transport_name FROM alert_transport_map AS a LEFT JOIN alert_transports AS b ON b.transport_id=a.transport_or_group_id WHERE a.target_type=‘single’ AND a.rule_id=? UNION DISTINCT SELECT d.transport_id, d.transport_type, d.transport_name FROM alert_transport_map AS a LEFT JOIN alert_transport_groups AS b ON a.transport_or_group_id=b.transport_group_id LEFT JOIN transport_group_transport AS c ON b.transport_group_id=c.transport_group_id LEFT JOIN alert_transports AS d ON c.transport_id=d.transport_id WHERE a.target_type=‘group’ AND a.rule_id=? [4,4] 0.22ms]
:: Transport telegram => SQL[SELECT transport_config FROM alert_transports WHERE transport_id=? [2] 0.22ms]

string(21) “API ‘’ returned Error”
string(8) "Params: "
string(145) “Return: {“ok”:false,“error_code”:400,“description”:“Bad Request: can’t parse entities: Can’t find end of the entity starting at byte offset 233”}”
ERROR: HTTP Status code 400
SQL[SELECT devices.*, location, lat, lng FROM devices LEFT JOIN locations ON WHERE device_id = ? [55] 1.3ms]

SQL[SELECT * FROM devices_attribs WHERE device_id = ? [55] 0.94ms]

SQL[SELECT * FROM vrf_lite_cisco WHERE device_id = ? [55] 0.33ms]

SQL[INSERT IGNORE INTO eventlog (device_id,reference,type,datetime,severity,message,username) VALUES (:device_id,:reference,:type,:datetime,:severity,:message,:username) {“device_id”:55,“reference”:null,“type”:“error”,“datetime”:“2019-02-24 21:06:21”,“severity”:5,“message”:“Could not issue critical alert for rule ‘Check Ping Status’ to transport ‘telegram’ Error: HTTP Status code 400”,“username”:""} 2.91ms]

If see, the probles is in telegram transport, when try to use de API.
The test button on Transport Alert secction, works fine, and I receive “This is a test alert” message, so I think de Transport configuration is well.


Do you mind posting your template here?

Error 400 usually happens (or it happened to me) with a malformed template.

here is the template:

{{ $alert->title }}\r\n
Severity: {{ $alert->severity }}\r\n
 @if ($alert->state == 0) Time elapsed: {{ $alert->elapsed }} @endif 
Timestamp: {{ $alert->timestamp }}
Unique-ID: {{ $alert->uid }}
Rule:  @if ($alert->name) {{ $alert->name }} @else {{ $alert->rule }} @endif \r\n
 @if ($alert->faults) Faults:\r\n
 @foreach ($alert->faults as $key => $value)\r\n
#{{ $key }}: {{ $value['string'] }}\r\n
Port: {{ $value['ifName'] }}\r\n
Port Name: {{ $value['ifAlias'] }}\r\n
Port Status: {{ $value['message'] }}\r\n
 @endforeach \r\n

And a screenshot of my rule.

Remove all the \r\n from the template.

Also, I’ve edited your post to set the correct format. Instead <code><\code> use ``` codehere ```

I’ve remove all \r\n from the all templates. But I still receive the message Could not issue critical alert for rule ‘Devices up/down’ to transport ‘telegram’ Error: HTTP Status code 400
Also, I’ve create a new alert from collections, but the problem persist.

Thanks again

The alert rule is not the issue, the issue is in the template. As you used MARKDOWN in the transport, try this:

{{ $alert->title }}
` Host     : {{ $alert->hostname }}`
` Fecha    : {{ $alert->timestamp }}`
` Estado   : @if ($alert->state == 0)✅ @endif @if ($alert->state == 1)⚠ Warning @endif`
@if ($alert->state == 0)⏳ Time elapsed:  {{ $alert->elapsed }} @endif 
@if ($alert->faults)
@foreach ($alert->faults as $key => $value)
`   ⭗ {{ $value['ifName'] }}`
`   Descripción: {{ $value['ifAlias'] }}`
`   Estado     : {{ $value['ifOperStatus'] }}`
@if ($alert->alert_notes)
✍ *Notas:* 

Its in spanish, so you may want to translate it :wink:

Thanks @TheGreateDoc for your help!! very useful.
The new Template works fine. Now I will check the diferences between both templates.

Thanks again.

Hi, I have the same problem, but I can’t solve it. I try the same template with no luck.

string(21) "API '' returned Error"
string(8) "Params: "
string(145) "Return: {"ok":false,"error_code":400,"description":"Bad Request: can't parse 
entities: Can't find end of the entity starting at byte offset 565"}"
ERROR: HTTP Status code 400

any ideas?

Thanks in advance!