44 lines
2 KiB
MySQL
44 lines
2 KiB
MySQL
|
-- Phase 4.3 — LogLift event-log ingestion pipeline.
|
||
|
|
--
|
||
|
|
-- Extends rmm_executions to support B2-uploaded payloads (separate transport
|
||
|
|
-- from Overshell stdout) and rmm_settings to cache the LogLift component uid.
|
||
|
|
--
|
||
|
|
-- transport='overshell_stdout' (default for existing rows) — payload comes
|
||
|
|
-- back via Datto getJobResults stdout. The Phase 4.2 path.
|
||
|
|
-- transport='b2_upload' — collector script uploads gzipped JSON to B2 and
|
||
|
|
-- POSTs a webhook; Pulse downloads + parses asynchronously.
|
||
|
|
|
||
|
|
ALTER TABLE rmm_executions
|
||
|
|
ADD COLUMN IF NOT EXISTS transport TEXT NOT NULL DEFAULT 'overshell_stdout'
|
||
|
|
CHECK (transport IN ('overshell_stdout','b2_upload')),
|
||
|
|
ADD COLUMN IF NOT EXISTS evidence_object_key TEXT,
|
||
|
|
ADD COLUMN IF NOT EXISTS run_id TEXT;
|
||
|
|
|
||
|
|
-- Used to correlate inbound webhooks to a Pulse-dispatched execution.
|
||
|
|
CREATE UNIQUE INDEX IF NOT EXISTS ux_rmm_executions_run_id
|
||
|
|
ON rmm_executions (run_id) WHERE run_id IS NOT NULL;
|
||
|
|
|
||
|
|
CREATE INDEX IF NOT EXISTS ix_rmm_executions_object_key
|
||
|
|
ON rmm_executions (evidence_object_key) WHERE evidence_object_key IS NOT NULL;
|
||
|
|
|
||
|
|
ALTER TABLE rmm_settings
|
||
|
|
ADD COLUMN IF NOT EXISTS loglift_component_uid TEXT,
|
||
|
|
ADD COLUMN IF NOT EXISTS loglift_component_name TEXT,
|
||
|
|
ADD COLUMN IF NOT EXISTS loglift_discovered_at TIMESTAMPTZ;
|
||
|
|
|
||
|
|
COMMENT ON COLUMN rmm_executions.transport IS
|
||
|
|
'overshell_stdout (default) — Phase 4.2 path; payload arrives in Datto job stdout. '
|
||
|
|
'b2_upload — Phase 4.3 LogLift; collector uploads gzipped JSON to Backblaze B2 '
|
||
|
|
'and POSTs a webhook. Pulse downloads + parses async.';
|
||
|
|
|
||
|
|
COMMENT ON COLUMN rmm_executions.evidence_object_key IS
|
||
|
|
'B2 object key for transport=b2_upload rows. Format: '
|
||
|
|
'{datto_site_uid}/{computer_name}/eventlogs_{timestamp}.json.gz. '
|
||
|
|
'Full payload stays in B2 (encrypted, signed-URL access only); '
|
||
|
|
'parsed_evidence holds a slimmed view.';
|
||
|
|
|
||
|
|
COMMENT ON COLUMN rmm_executions.run_id IS
|
||
|
|
'Collector-supplied correlation token. Used by the receiver to match an '
|
||
|
|
'inbound webhook to a Pulse-dispatched execution. NULL for out-of-band '
|
||
|
|
'collector runs.';
|