Allow empty fields in Syscollector

[juan70]

Hi, Team,

This PR fixes the issue #2716.

Bug description

When a record is going to be inserted in the table sys_hwinfo with the field cpu_mhz containing 0, an error is thrown, because of a constraint in the schema of the table. Namely: cpu_mhz REAL CHECK (cpu_mhz > 0); the accepted values must be > 0.

The error is reproduced in the issue: #2716 (comment).

Solution

Check the value in the Syscollector decoder. Allow the value cpu_mhz to be 0, and send an empty field in this case.

Testing

See below.

[juan70]

Testing

First of all, check that syscollector and hardware are enabled in ossec.conf (they are enabled by default):

  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>1h</interval>
    <scan_on_start>yes</scan_on_start>
    <hardware>yes</hardware>
    <os>yes</os>
    <network>yes</network>
    <packages>yes</packages>
    <ports all="no">yes</ports>
    <processes>yes</processes>
  </wodle>

Using netcat (package openbsd-netcat), simulate a hardware event, with all the values empty (strings) or zero (numbers):

# echo 'd:syscollector:{"type":"hardware","ID":0,"timestamp":"","inventory":{"board_serial":"","cpu_name":"","cpu_cores":0,"cpu_MHz":0,"ram_total":0,"ram_free":0,"ram_usage":0}}' | nc -Uu /var/ossec/queue/ossec/queue

Restart the manager (or maybe wait for the next scan).

Check the result:

# sqlite3 /var/ossec/queue/db/000.db '.headers on' 'select * from sys_hwinfo'
scan_id|scan_time|board_serial|cpu_name|cpu_cores|cpu_mhz|ram_total|ram_free|ram_usage
0||||||||

No errors thrown. OK.

As a control, with non-empty arbitrary values:

# echo 'd:syscollector:{"type":"hardware","ID":890,"timestamp":"Just for today","inventory":{"board_serial":"321","cpu_name":"The name of the CPU","cpu_cores":6,"cpu_MHz":12,"ram_total":240,"ram_free":139,"ram_usage":13}}' | nc -Uu /var/ossec/queue/ossec/queue

# sqlite3 /var/ossec/queue/db/000.db '.headers on' 'select * from sys_hwinfo'
scan_id|scan_time|board_serial|cpu_name|cpu_cores|cpu_mhz|ram_total|ram_free|ram_usage
890|Just for today|321|The name of the CPU|6|12.0|240|139|13

The values are stored in the table. OK.

[chemamartinez]

LGTM!