Ver. 2.6.2 Mass Classification fails to classify events

[jamisonmaxwell]

I have tried this on two separate installs with the latest version, but I can't seem to get mass classification to function again. I am more than willing to provide any logs, but don't really know where to start.

[jthoel]

We are seeing the same problem, and I can send a debug log directly to a dev if it would help.

[miketanderson]

I just upgraded to 2.6.2 and am seeing the same problem. Let me know if I can provide anything to help debug.

[joshuah]

I am having the same issue. Also having issues classifying search results.

[ardevd]

Same issue here.. Classifications in general are not working very well.

[gehrhorn]

Can anyone validate that this was working in 2.6.1? (To put it better, what is the last version where this was working?)

[jthoel]

Yes.. it was working fine and dandy on 2.6.1

[gehrhorn]

Between 2.6.1 and 2.6.2 the only files that changed were

ChangeLog.md                             |   12 ++++
 Gemfile.lock                             |    2 -
 README.md                                |   15 +----
 app/views/page/_graph_signature.html.erb |    2 +-
 app/views/saved_searches/view.html.erb   |    7 +-
 app/views/sensors/index.js.erb           |   14 ++++-
 lib/snorby/jobs/cache_helper.rb          |   14 ++++
 lib/snorby/search.rb                     |  100 ++++++++++++++++++++++++++++--
 lib/snorby/version.rb                    |    2 +-
 lib/snorby/worker.rb                     |    2 +-
 public/assets/snorby.css                 |    2 +-
 public/assets/snorby.css.gz              |  Bin 16624 -> 16634 bytes
 public/assets/snorby.js                  |    2 +-
 public/assets/snorby.js.gz               |  Bin 143058 -> 143100 bytes
 public/javascripts/snorby.js             |   12 ++++
 public/stylesheets/snorby.css            |   12 +++-

I think it's most likely that the culprit is in one of

 app/views/page/_graph_signature.html.erb |    2 +-
 app/views/saved_searches/view.html.erb   |    7 +-
 app/views/sensors/index.js.erb           |   14 ++++-
 lib/snorby/jobs/cache_helper.rb          |   14 ++++
 lib/snorby/search.rb                     |  100 ++++++++++++++++++++++++++++--
 lib/snorby/version.rb                    |    2 +-
 lib/snorby/worker.rb                     |    2 +-
 public/assets/snorby.js                  |    2 +-
 public/javascripts/snorby.js             |   12 ++++

and probably not the first two. I'm going to poke around these files.

[gehrhorn]

@miketanderson and I are working on this and we think the problem may be in events_controller.rb

# This is in def mass_action, which starts on line 182
    sql = Snorby::Search.build("true", true, options)
    ids = Event.get_collection_id_string(sql)
    if params[:jobqueue]
         Delayed::Job.enqueue(Snorby::Jobs::MassClassification.new(ids, params[:classification_id], User.current_user.id))
     else
          Event.update_classification(ids, params[:classification_id], User.current_user.id)
      end

I don't think that ids variable is getting set correctly. We think that the search function may not be working correctly, perhaps from the edits to search.rb

if column == :classification && value.to_i == 0
  if operator == :is
    operator = :isnull
  else
    operator = :notnull
  end
  value = "NULL"
end

if column == :has_note
  if value.to_i == 1
    case operator
    when :is
      operator = :gt
      value = 0
    when :is_not
      operator = :lt
      value = 1
    end

  else
    case operator
    when :is
      operator = :lt
      value = 1
    when :is_not
      operator = :gt
      value = 0
    end

  end
end

tmp_sql = "#{COLUMN[column][x]} #{OPERATOR[operator]}"

[miketanderson]

It appears the SQL query for mass classification is inverting the classification IS NOT NULL vs IS NULL.

Specifically the two instances of this snippet:

  if operator == :is
    operator = :isnull
  else
    operator = :notnull
  end

I switched both instances of this to

  if operator == :is
    operator = :notnull
  else
    operator = :isnull
  end

and mass classification worked again.

I do not know if this would break any of the new functionality, but this appears to be the source of the mass classification bug.

[jthoel]

And this is in the file 'events_controller.rb'?

[miketanderson]

I was tacking on to the report by @gehrhorn - the file is lib/snorby/search.rb starting on line 338 and again on line 390.

[jthoel]

Awesome.. I'll test it here. and update.

UPDATE - Seems to work great. Thanks guys!

[joshuah]

@miketanderson Your fix seems to work for me.