From 8603f003f948a21c93f9028f59360eabd1845606 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Tue, 30 Dec 2025 20:18:53 -0500
Subject: [PATCH 01/17] agents

---
 .../agents/code-quality.agent.md              | 39 +++++++++++
 .../agents/mysql-mariadb.agent.md             | 65 +++++++++++++++++++
 .../agents/php-devloper.agent.md              | 41 ++++++++++++
 .gitignore                                    |  1 -
 4 files changed, 145 insertions(+), 1 deletion(-)
 create mode 100644 .github/ISSUE_TEMPLATE/agents/code-quality.agent.md
 create mode 100644 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
 create mode 100644 .github/ISSUE_TEMPLATE/agents/php-devloper.agent.md

diff --git a/.github/ISSUE_TEMPLATE/agents/code-quality.agent.md b/.github/ISSUE_TEMPLATE/agents/code-quality.agent.md
new file mode 100644
index 0000000..0c93293
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/agents/code-quality.agent.md
@@ -0,0 +1,39 @@
+---
+description: "This Custom agent acts as a quality assurance specialist, focusing on code quality, best practices, and maintainability."
+name: "Code Quality Specialist"
+tools: ["search/codebase", "edit/editFiles", "web/githubRepo", "vscode/extensions", "execute/getTerminalOutput", "web"]
+model: "Claude Sonnet 4.5"
+---
+
+# Code Quality Specialist
+You are a Code Quality Specialist agent. Your role is to ensure that the codebase adheres to high standards of quality, best practices, and maintainability. You have access to various tools to help you perform your tasks effectively .
+
+The technology stack you will work with is a lamp stack (Linux, Apache, MySQL, PHP) along with JavaScript for frontend development.
+
+
+## Capabilities
+- **Code Review:** Analyze code for adherence to coding standards, best practices, and design patterns.
+- **Refactoring:** Suggest and implement code refactoring to improve readability, maintainability, and performance.
+- **Testing:** Ensure that code is well-tested, with appropriate unit tests, integration tests, and end-to-end tests.
+- **Documentation:** Verify that code is well-documented, with clear comments and comprehensive documentation.
+- **Performance Optimization:** Identify and address performance bottlenecks in the codebase.
+- **Security Best Practices:** Ensure that code follows security best practices to prevent vulnerabilities.
+- **Continuous Integration/Continuous Deployment (CI/CD):** Review and improve CI/CD pipelines to ensure smooth and reliable deployments.
+- **Code Metrics:** Utilize code metrics to assess code quality and identify areas for improvement.
+
+## Tools
+You have access to the following tools to assist you in your tasks:
+- **search/codebase:** Search through the codebase for relevant information or code snippets.
+- **edit/editFiles:** Edit code files to implement improvements or fixes.
+- **githubRepo:** Interact with the GitHub repository to manage issues, pull requests, and code reviews.
+- **extensions:** Utilize extensions that can enhance your capabilities in code quality assurance.
+- **web:** Access the web for additional resources, documentation, or best practices.
+
+
+## Instructions
+When assisting with tasks, follow these guidelines:
+1. **Understand the Request:** Clearly understand the user's request or issue before proceeding.
+2. **Gather Information:** Use the available tools to gather necessary information about the codebase, coding standards, and existing issues.
+3. **Provide Solutions:** Offer clear and actionable solutions or recommendations based on best practices and your expertise.
+4. **Communicate Clearly:** Ensure that your explanations are clear and easy to understand, especially for users who may not be code quality experts.
+5. **Follow Up:** If necessary, follow up on previous tasks to ensure that code quality issues have been resolved or improvements have been successfully implemented.
diff --git a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
new file mode 100644
index 0000000..4ab939b
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
@@ -0,0 +1,65 @@
+---
+description: "This custom agent assits with enhancements, troubleshooting, and management of MySQL and MariaDB databases."
+name: "MySQL/ MariaDB Database Administrator"
+tools: ["search/codebase", "edit/editFiles", "web/githubRepo", "vscode/extensions", "execute/getTerminalOutput", "web"]
+model: "Claude Sonnet 4.5"
+---
+
+# MySQL/ MariaDB Database Administrator
+
+You are a MySQL and MariaDB Database Administrator agent. Your role is to assist with enhancements, troubleshooting, and management of MySQL and MariaDB databases. You have access to various tools to help you perform your tasks effectively.
+
+## Capabilities
+- **Database Management:** Assist with database creation, configuration, optimization, and maintenance tasks.
+- **Query Optimization:** Analyze and optimize SQL queries for better performance.
+- **Troubleshooting:** Diagnose and resolve database-related issues, including connection problems, performance bottlenecks, and data integrity concerns.
+- **Backup and Recovery:** Provide guidance on backup strategies and recovery procedures.
+- **Security:** Advise on best practices for securing MySQL and MariaDB databases.
+- **Version Upgrades:** Assist with planning and executing database version upgrades.
+- **Monitoring:** Recommend tools and techniques for monitoring database performance and health.
+- **Scripting:** Help with writing and optimizing scripts for database automation tasks.
+
+## Tools
+You have access to the following tools to assist you in your tasks:
+- **search/codebase:** Search through the codebase for relevant information or code snippets.
+- **edit/editFiles:** Edit configuration files, scripts, or code as needed.
+- **githubRepo:** Interact with the GitHub repository to manage issues, pull requests, and code reviews.
+- **extensions:** Utilize extensions that can enhance your capabilities in managing databases.
+- **web:** Access the web for additional resources, documentation, or troubleshooting guides.
+
+## Instructions
+When assisting with tasks, follow these guidelines:
+1. **Understand the Request:** Clearly understand the user's request or issue before proceeding.
+2. **Gather Information:** Use the available tools to gather necessary information about the database environment, configurations, and any existing issues.
+3. **Provide Solutions:** Offer clear and actionable solutions or recommendations based on best practices and your expertise.
+4. **Communicate Clearly:** Ensure that your explanations are clear and easy to understand, especially for users who may not be database experts.
+5. **Follow Up:** If necessary, follow up on previous tasks to ensure that issues have been resolved or enhancements have been successfully implemented.
+
+
+## Sample design patternsHere are some common design patterns and best practices for MySQL and MariaDB database management:
+- **Normalization:** Ensure that database schemas are normalized to reduce redundancy and improve data integrity.
+- **Indexing:** Use appropriate indexing strategies to enhance query performance.
+- **Connection Pooling:** Implement connection pooling to manage database connections efficiently and improve application performance
+
+
+
+## Built in Cacti DB functions  are included from the cacti project. Here are some of the commonly used functions:
+## you can find the included file in the cacti project here:
+- [Cacti DB Functions](https://github.com/Cacti/cacti/blob/1.2.x/lib/database.php)
+- `db_fetch_row($result)`: Fetches a single row from the result set as an associative array.
+- `db_fetch_assoc($result)`: Fetches a single row from the result set as an associative array.
+- `db_query($query)`: Executes a SQL query and returns the result set.
+- `db_insert($table, $data)`: Inserts a new record into the specified table.
+- `db_update($table, $data, $where)`: Updates records in the specified table based on the given conditions.
+- `db_delete($table, $where)`: Deletes records from the specified table based on the given conditions.
+- `db_escape_string($string)`: Escapes special characters in a string for use in a SQL query.
+- `db_num_rows($result)`: Returns the number of rows in the result set.
+- `db_last_insert_id()`: Retrieves the ID of the last inserted record.
+
+
+##web documentation
+For additional information and best practices, refer to the official MySQL and MariaDB documentation:
+- [MySQL Documentation](https://dev.mysql.com/doc/)
+- [MariaDB Documentation](https://mariadb.com/kb/en/documentation/)
+
+Use your capabilities and tools effectively to assist users with their MySQL and MariaDB database needs.
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/agents/php-devloper.agent.md b/.github/ISSUE_TEMPLATE/agents/php-devloper.agent.md
new file mode 100644
index 0000000..1992350
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/agents/php-devloper.agent.md
@@ -0,0 +1,41 @@
+---
+description: "This custom agent acts as a PHP developer, assisting with PHP code development, debugging, and optimization."
+name: "PHP Developer"
+tools: ["search/codebase", "edit/editFiles", "web/githubRepo", "vscode/extensions", "execute/getTerminalOutput", "web"]
+model: "Claude Sonnet 4.5"
+---
+
+# PHP Developer
+You are a PHP Developer agent. Your role is to assist with PHP code development, debugging, and optimization. You have access to various tools to help you perform your tasks effectively.
+You are to focus on PHP PSR-12 coding standards and best practices supporting modern PHP versions (PHP 8.1 and above).
+Your other roles include:
+- **Code Review:** Analyze PHP code for adherence to coding standards, best practices, and design patterns.
+- **Debugging:** Identify and resolve bugs or issues in PHP code.
+- **Performance Optimization:** Suggest and implement optimizations to improve the performance of PHP applications.
+- **Testing:** Ensure that PHP code is well-tested, with appropriate unit tests and integration tests.
+- **Documentation:** Verify that PHP code is well-documented, with clear comments and comprehensive documentation.
+- **Security Best Practices:** Ensure that PHP code follows security best practices to prevent vulnerabilities.
+
+## Tools
+You have access to the following tools to assist you in your tasks:
+- **search/codebase:** Search through the codebase for relevant information or code snippets.
+- **edit/editFiles:** Edit PHP code files to implement improvements or fixes.
+- **githubRepo:** Interact with the GitHub repository to manage issues, pull requests, and code reviews.
+- **extensions:** Utilize extensions that can enhance your capabilities in PHP development.
+- **web:** Access the web for additional resources, documentation, or best practices.
+
+
+
+## The project in this repo calls on functions from the cacti project. You can find the cacti documentation and main github repo here:
+- [Cacti GitHub Repository](https://github.com/Cacti/cacti/tree/1.2.x)
+- [Cacti Documentation](https://www.github.com/Cacti/documentation)
+
+
+
+## Instructions
+When assisting with tasks, follow these guidelines:
+1. **Understand the Request:** Clearly understand the user's request or issue before proceeding.
+2. **Gather Information:** Use the available tools to gather necessary information about the PHP codebase, coding standards, and existing issues.
+3. **Provide Solutions:** Offer clear and actionable solutions or recommendations based on best practices and your expertise.
+4. **Communicate Clearly:** Ensure that your explanations are clear and easy to understand, especially for users who may not be PHP experts.
+5. **Follow Up:** If necessary, follow up on previous tasks to ensure that PHP code issues have been resolved or improvements have been successfully implemented.
diff --git a/.gitignore b/.gitignore
index ec5e85f..efca3d2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,7 +19,6 @@
 # | http://www.cacti.net/                                                   |
 # +-------------------------------------------------------------------------+
 
-.git*
 
 locales/po/*.mo
 config.php

From 75c5cd951afa40b60998a0965b4ea8246eeab2f0 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Tue, 30 Dec 2025 20:39:56 -0500
Subject: [PATCH 02/17] Update copilot-instructions.md

---
 .github/ISSUE_TEMPLATE/copilot-instructions.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/ISSUE_TEMPLATE/copilot-instructions.md b/.github/ISSUE_TEMPLATE/copilot-instructions.md
index ced1322..d89f764 100644
--- a/.github/ISSUE_TEMPLATE/copilot-instructions.md
+++ b/.github/ISSUE_TEMPLATE/copilot-instructions.md
@@ -11,6 +11,7 @@ This is the **Syslog Plugin** for Cacti, a PHP-based network monitoring and grap
   - **Critical:** ALWAYS use the `syslog_db_*` wrapper functions (defined in `database.php`) for all database operations. NEVER use standard Cacti `db_*` functions directly for syslog tables, as they will fail if a dedicated database is configured.
 - **Integration:** The plugin integrates with Cacti via hooks defined in `setup.php`.
 - **Poller Integration:** Background processes (`syslog_process.php`, `syslog_removal.php`) are triggered by Cacti's poller or run independently.
+- **Syslog Reception:** Syslog messages are directly inserted into `syslog_incoming` table syslog_process.php then processes them.
 
 ## Critical Developer Workflows
 
@@ -55,3 +56,8 @@ This is the **Syslog Plugin** for Cacti, a PHP-based network monitoring and grap
 - `config.php.dist`: Template for database configuration.
 - `functions.php`: Core logic and utility functions.
 - `syslog.php`: Main UI entry point.
+
+
+**Documentation & Resources**
+- [Cacti main repo](https://github.com/Cacti/cacti/tree/1.2.x)
+- [cacti documentation](https://www.github.com/Cacti/documentation)
\ No newline at end of file

From 9a98241d7850790cdd5f8e586a96af46d8278c4b Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 19:06:46 -0500
Subject: [PATCH 03/17] correct filename spelling

---
 .../agents/{php-devloper.agent.md => php-developer.agent.md}      | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/ISSUE_TEMPLATE/agents/{php-devloper.agent.md => php-developer.agent.md} (100%)

diff --git a/.github/ISSUE_TEMPLATE/agents/php-devloper.agent.md b/.github/ISSUE_TEMPLATE/agents/php-developer.agent.md
similarity index 100%
rename from .github/ISSUE_TEMPLATE/agents/php-devloper.agent.md
rename to .github/ISSUE_TEMPLATE/agents/php-developer.agent.md

From 946d244faf860a6df8518baea79cfe4c2a9fd485 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 22:44:50 -0500
Subject: [PATCH 04/17] Allow for resolving syslog device ip against cacti
 hosts table

Some devices dont send the device name as the hostname for syslog instead they send the IP
This feature will allow for resolving the IP against the cacti host table  as the device may not be in DNS
---
 functions.php | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++
 setup.php     |  6 +++++
 2 files changed, 73 insertions(+)

diff --git a/functions.php b/functions.php
index 5cb78ca..90452b7 100644
--- a/functions.php
+++ b/functions.php
@@ -1757,6 +1757,56 @@ function syslog_strip_incoming_domains($uniqueID) {
 	}
 }
 
+
+
+
+
+/**
+ * Check if the hostname is in the cacti hosts table
+ * Some devices only send IP addresses in syslog messages, and may not be in the DNS
+ * however they may be in the cacti hosts table as monitored devices.
+ * 
+ * @param  (string) The hostname to check
+ * @param  (int) The unique id for syslog_incoming messages to process
+ * 
+ * @return (bool) True if the host exists in the Cacti database, false otherwise
+ */
+
+function syslog_check_cacti_hosts($host, $uniqueID) {
+	global $syslogdb_default;
+
+	if (empty($host)) {
+		return false;
+	}
+
+	// Check if the host exists in cacti by hostname and get the description
+	$cacti_host = db_fetch_row_prepared('SELECT hostname, description
+		FROM host
+		WHERE hostname = ?
+		LIMIT 1',
+		array($host));
+
+	if (cacti_sizeof($cacti_host) && !empty($cacti_host['description'])) {
+		// Resolve the hostname to IP
+		$ip_address = gethostbyname($cacti_host['hostname']);
+		
+		// Update syslog_incoming: replace IP with description
+		syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
+			SET host = ?
+			WHERE host = ?
+			AND `status` = ?",
+			array($cacti_host['description'], $ip_address, $uniqueID));
+			
+		return true;
+	}
+
+	return false;
+}
+		
+
+
+
+
 /**
  * syslog_update_reference_tables - There are many values in the syslog plugin
  *   that for the purposes of reducing the size of the syslog table are normalized
@@ -1776,6 +1826,23 @@ function syslog_update_reference_tables($uniqueID) {
 	syslog_debug('-------------------------------------------------------------------------------------');
 	syslog_debug('Updating Reference Tables from New Syslog Records');
 
+	
+	if (read_config_option('syslog_use_cacti_hosts') == 'on') {
+		$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
+			FROM `' . $syslogdb_default . '`.`syslog_incoming`
+			WHERE `status` = ?',
+			array($uniqueID));
+
+		foreach($hosts as $host) {
+			if (!isset($host['host']) || empty($host['host'])) {
+				continue;
+			}
+			
+			syslog_check_cacti_hosts($host['host'], $uniqueID);
+		}
+	}
+
+
 	/* correct for invalid hosts */
 	if (read_config_option('syslog_validate_hostname') == 'on') {
 		$hosts = syslog_db_fetch_assoc('SELECT DISTINCT host
diff --git a/setup.php b/setup.php
index f67ffe5..7542f98 100644
--- a/setup.php
+++ b/setup.php
@@ -1144,6 +1144,12 @@ function syslog_config_settings() {
 			'method' => 'checkbox',
 			'default' => ''
 		),
+		'syslog_use_cacti_hosts' => array(
+			'friendly_name' => __('Resolve Syslog host IPs against Cacti Hosts', 'syslog'),
+			'description' => __('If this checkbox is set, all hostnames found in syslog messages will be cross referenced against the Cacti Host table.  If a hostname is not found in Cacti, the message will be assigned to a special host called \'unknownhost\'.  This setting can impact syslog processing time on large systems.  Therefore, use of this setting should only be used when other means are not in place to prevent this from happening.', 'syslog'),
+			'method' => 'checkbox',
+			'default' => ''
+		),
 		'syslog_refresh' => array(
 			'friendly_name' => __('Refresh Interval', 'syslog'),
 			'description' => __('This is the time in seconds before the page refreshes.', 'syslog'),

From fc28580d114d0e4d91896b0764ab9037f2baac14 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 22:55:05 -0500
Subject: [PATCH 05/17] Update
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
index 4ab939b..4100479 100644
--- a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
+++ b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
@@ -1,5 +1,5 @@
 ---
-description: "This custom agent assits with enhancements, troubleshooting, and management of MySQL and MariaDB databases."
+description: "This custom agent assists with enhancements, troubleshooting, and management of MySQL and MariaDB databases."
 name: "MySQL/ MariaDB Database Administrator"
 tools: ["search/codebase", "edit/editFiles", "web/githubRepo", "vscode/extensions", "execute/getTerminalOutput", "web"]
 model: "Claude Sonnet 4.5"

From 6df20ae869fc5ac5816712e9f9a139b2afc20a92 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 22:55:14 -0500
Subject: [PATCH 06/17] Update
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
index 4100479..6667989 100644
--- a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
+++ b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
@@ -57,7 +57,7 @@ When assisting with tasks, follow these guidelines:
 - `db_last_insert_id()`: Retrieves the ID of the last inserted record.
 
 
-##web documentation
+## Web Documentation
 For additional information and best practices, refer to the official MySQL and MariaDB documentation:
 - [MySQL Documentation](https://dev.mysql.com/doc/)
 - [MariaDB Documentation](https://mariadb.com/kb/en/documentation/)

From 2a4a11718b407a3c1118db5957fd7ce6d3807bf3 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:01:07 -0500
Subject: [PATCH 07/17] Update functions.php

---
 functions.php | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/functions.php b/functions.php
index 90452b7..f6b470f 100644
--- a/functions.php
+++ b/functions.php
@@ -1780,26 +1780,22 @@ function syslog_check_cacti_hosts($host, $uniqueID) {
 	}
 
 	// Check if the host exists in cacti by hostname and get the description
-	$cacti_host = db_fetch_row_prepared('SELECT hostname, description
+	$cacti_host = db_fetch_row_prepared('SELECT description
 		FROM host
 		WHERE hostname = ?
 		LIMIT 1',
 		array($host));
 
 	if (cacti_sizeof($cacti_host) && !empty($cacti_host['description'])) {
-		// Resolve the hostname to IP
-		$ip_address = gethostbyname($cacti_host['hostname']);
-		
-		// Update syslog_incoming: replace IP with description
-		syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
+		syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . '`.`syslog_incoming`
 			SET host = ?
 			WHERE host = ?
-			AND `status` = ?",
-			array($cacti_host['description'], $ip_address, $uniqueID));
-			
+			AND `status` = ?',
+			array($cacti_host['description'], $host, $uniqueID));
+		
 		return true;
 	}
-
+	
 	return false;
 }
 		
@@ -1826,7 +1822,7 @@ function syslog_update_reference_tables($uniqueID) {
 	syslog_debug('-------------------------------------------------------------------------------------');
 	syslog_debug('Updating Reference Tables from New Syslog Records');
 
-	
+
 	if (read_config_option('syslog_use_cacti_hosts') == 'on') {
 		$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
 			FROM `' . $syslogdb_default . '`.`syslog_incoming`

From d37a4e73685964bf8705b3f7e0d0e1b2d1d434b9 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:18:11 -0500
Subject: [PATCH 08/17] Consolodate setting

Update the flow as follows

1) If we recive a host check DNS
2.) if the IP is not in DNS check the cacti host table
3.) Mark as invalid if we cant find it
---
 functions.php | 32 +++++++++++++++-----------------
 setup.php     |  6 ------
 2 files changed, 15 insertions(+), 23 deletions(-)

diff --git a/functions.php b/functions.php
index f6b470f..50d57cd 100644
--- a/functions.php
+++ b/functions.php
@@ -1822,8 +1822,8 @@ function syslog_update_reference_tables($uniqueID) {
 	syslog_debug('-------------------------------------------------------------------------------------');
 	syslog_debug('Updating Reference Tables from New Syslog Records');
 
-
-	if (read_config_option('syslog_use_cacti_hosts') == 'on') {
+	/* Validate and resolve hostnames - check DNS first, then Cacti, then mark invalid */
+	if (read_config_option('syslog_validate_hostname') == 'on') {
 		$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
 			FROM `' . $syslogdb_default . '`.`syslog_incoming`
 			WHERE `status` = ?',
@@ -1834,23 +1834,21 @@ function syslog_update_reference_tables($uniqueID) {
 				continue;
 			}
 			
-			syslog_check_cacti_hosts($host['host'], $uniqueID);
-		}
-	}
-
-
-	/* correct for invalid hosts */
-	if (read_config_option('syslog_validate_hostname') == 'on') {
-		$hosts = syslog_db_fetch_assoc('SELECT DISTINCT host
-			FROM `' . $syslogdb_default . '`.`syslog_incoming`');
-
-		foreach($hosts as $host) {
+			// Check if hostname resolves via DNS
 			if ($host['host'] == gethostbyname($host['host'])) {
-				syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
-					SET host = 'invalid_host'
-					WHERE host = ?",
-					array($host['host']));
+				// DNS failed, try to resolve against Cacti hosts
+				$resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
+				
+				// If not found in Cacti either, mark as invalid
+				if (!$resolved) {
+					syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
+						SET host = 'invalid_host'
+						WHERE host = ?
+						AND `status` = ?",
+						array($host['host'], $uniqueID));
+				}
 			}
+			// If DNS succeeds, hostname is valid - leave it as is
 		}
 	}
 
diff --git a/setup.php b/setup.php
index 7542f98..f67ffe5 100644
--- a/setup.php
+++ b/setup.php
@@ -1144,12 +1144,6 @@ function syslog_config_settings() {
 			'method' => 'checkbox',
 			'default' => ''
 		),
-		'syslog_use_cacti_hosts' => array(
-			'friendly_name' => __('Resolve Syslog host IPs against Cacti Hosts', 'syslog'),
-			'description' => __('If this checkbox is set, all hostnames found in syslog messages will be cross referenced against the Cacti Host table.  If a hostname is not found in Cacti, the message will be assigned to a special host called \'unknownhost\'.  This setting can impact syslog processing time on large systems.  Therefore, use of this setting should only be used when other means are not in place to prevent this from happening.', 'syslog'),
-			'method' => 'checkbox',
-			'default' => ''
-		),
 		'syslog_refresh' => array(
 			'friendly_name' => __('Refresh Interval', 'syslog'),
 			'description' => __('This is the time in seconds before the page refreshes.', 'syslog'),

From 82ff4eedccd740e9e8b76d1bbd693aeb79eec419 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:19:56 -0500
Subject: [PATCH 09/17] update friendly name

---
 setup.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.php b/setup.php
index f67ffe5..c6679be 100644
--- a/setup.php
+++ b/setup.php
@@ -1140,7 +1140,7 @@ function syslog_config_settings() {
 		),
 		'syslog_validate_hostname' => array(
 			'friendly_name' => __('Validate Hostnames', 'syslog'),
-			'description' => __('If this checkbox is set, all hostnames are validated.  If the hostname is not valid. All records are assigned to a special host called \'invalidhost\'.  This setting can impact syslog processing time on large systems.  Therefore, use of this setting should only be used when other means are not in place to prevent this from happening.', 'syslog'),
+			'description' => __('If this checkbox is set, all hostnames are validated via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned to a special host called \'invalid_host\'.', 'syslog'),
 			'method' => 'checkbox',
 			'default' => ''
 		),

From a3dfc4896b5c8de27b49bf86297f8899ef69c570 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:25:57 -0500
Subject: [PATCH 10/17] Update functions.php

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 functions.php | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/functions.php b/functions.php
index 50d57cd..83516be 100644
--- a/functions.php
+++ b/functions.php
@@ -1798,11 +1798,6 @@ function syslog_check_cacti_hosts($host, $uniqueID) {
 	
 	return false;
 }
-		
-
-
-
-
 /**
  * syslog_update_reference_tables - There are many values in the syslog plugin
  *   that for the purposes of reducing the size of the syslog table are normalized

From cc4f0421d8100db4923a2ed150f15b089351ee6b Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:26:04 -0500
Subject: [PATCH 11/17] Update
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
index 6667989..b518312 100644
--- a/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
+++ b/.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md
@@ -39,7 +39,7 @@ When assisting with tasks, follow these guidelines:
 ## Sample design patternsHere are some common design patterns and best practices for MySQL and MariaDB database management:
 - **Normalization:** Ensure that database schemas are normalized to reduce redundancy and improve data integrity.
 - **Indexing:** Use appropriate indexing strategies to enhance query performance.
-- **Connection Pooling:** Implement connection pooling to manage database connections efficiently and improve application performance
+- **Connection Pooling:** Implement connection pooling to manage database connections efficiently and improve application performance.
 
 
 

From d324f0a9e88e181e27c02a460d2c65c4479aefa2 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Thu, 1 Jan 2026 23:26:14 -0500
Subject: [PATCH 12/17] Update .github/ISSUE_TEMPLATE/copilot-instructions.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/copilot-instructions.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/copilot-instructions.md b/.github/ISSUE_TEMPLATE/copilot-instructions.md
index d89f764..3d9a8ae 100644
--- a/.github/ISSUE_TEMPLATE/copilot-instructions.md
+++ b/.github/ISSUE_TEMPLATE/copilot-instructions.md
@@ -11,7 +11,7 @@ This is the **Syslog Plugin** for Cacti, a PHP-based network monitoring and grap
   - **Critical:** ALWAYS use the `syslog_db_*` wrapper functions (defined in `database.php`) for all database operations. NEVER use standard Cacti `db_*` functions directly for syslog tables, as they will fail if a dedicated database is configured.
 - **Integration:** The plugin integrates with Cacti via hooks defined in `setup.php`.
 - **Poller Integration:** Background processes (`syslog_process.php`, `syslog_removal.php`) are triggered by Cacti's poller or run independently.
-- **Syslog Reception:** Syslog messages are directly inserted into `syslog_incoming` table syslog_process.php then processes them.
+- **Syslog Reception:** Syslog messages are directly inserted into the `syslog_incoming` table; `syslog_process.php` then processes them.
 
 ## Critical Developer Workflows
 

From 7a6a76ede8d21ba84a34ebc3fe7d6398c0d51ac6 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Fri, 2 Jan 2026 19:38:02 -0500
Subject: [PATCH 13/17] update the host validation logic

Dont just mark the device as invalid
instead pass the  original sent hostname/ip and log  that it could not be resolved
---
 functions.php | 10 +++++-----
 setup.php     |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/functions.php b/functions.php
index 83516be..0f6f7a7 100644
--- a/functions.php
+++ b/functions.php
@@ -1818,7 +1818,7 @@ function syslog_update_reference_tables($uniqueID) {
 	syslog_debug('Updating Reference Tables from New Syslog Records');
 
 	/* Validate and resolve hostnames - check DNS first, then Cacti, then mark invalid */
-	if (read_config_option('syslog_validate_hostname') == 'on') {
+	if (read_config_option('syslog_resolve_hostname') == 'on') {
 		$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
 			FROM `' . $syslogdb_default . '`.`syslog_incoming`
 			WHERE `status` = ?',
@@ -1834,16 +1834,16 @@ function syslog_update_reference_tables($uniqueID) {
 				// DNS failed, try to resolve against Cacti hosts
 				$resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
 				
-				// If not found in Cacti either, mark as invalid
+				// If not found in Cacti either, set the hostname to the initial value
 				if (!$resolved) {
+					cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as 'invalid-hostname'", false, 'SYSLOG');
 					syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
-						SET host = 'invalid_host'
+						SET host = ?
 						WHERE host = ?
 						AND `status` = ?",
-						array($host['host'], $uniqueID));
+						array($host['host'], $host['host'], $uniqueID));
 				}
 			}
-			// If DNS succeeds, hostname is valid - leave it as is
 		}
 	}
 
diff --git a/setup.php b/setup.php
index c6679be..e884508 100644
--- a/setup.php
+++ b/setup.php
@@ -1138,9 +1138,9 @@ function syslog_config_settings() {
 			'size' => 80,
 			'max_length' => 255,
 		),
-		'syslog_validate_hostname' => array(
-			'friendly_name' => __('Validate Hostnames', 'syslog'),
-			'description' => __('If this checkbox is set, all hostnames are validated via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned to a special host called \'invalid_host\'.', 'syslog'),
+		'syslog_resolve_hostname' => array(
+			'friendly_name' => __('Resolve Hostnames', 'syslog'),
+			'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned to a special host called \'invalid_host\'.', 'syslog'),
 			'method' => 'checkbox',
 			'default' => ''
 		),

From dc570eb2fda766ae1c22bd2b589908c11c420215 Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Fri, 2 Jan 2026 20:05:06 -0500
Subject: [PATCH 14/17] Update to Hostname resolution logic

1.) Provide a way to disable dns resolution if your hosts are not in DNS
2.) Prefix an invalid hostname with unresolved-original_hostname for better traceability
---
 functions.php | 9 +++++----
 setup.php     | 8 +++++++-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/functions.php b/functions.php
index 0f6f7a7..41632f7 100644
--- a/functions.php
+++ b/functions.php
@@ -1487,7 +1487,7 @@ function syslog_process_alert($alert, $sql, $params, $count, $hostname = '') {
 					/**
 					 * Open a ticket if this options have been selected.
 					 */
-					$command = read_config_option('syslog_ticket_command');
+					 $command = read_config_option('syslog_ticket_command');
 
 					if ($command != '') {
 						$command = trim($command);
@@ -1834,14 +1834,15 @@ function syslog_update_reference_tables($uniqueID) {
 				// DNS failed, try to resolve against Cacti hosts
 				$resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
 				
-				// If not found in Cacti either, set the hostname to the initial value
+				// If not found in Cacti either, prefix the hostname
 				if (!$resolved) {
-					cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as 'invalid-hostname'", false, 'SYSLOG');
+					$unresolved_host = 'unresolved-' . $host['host'];
+					cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as '" . $unresolved_host . "'", false, 'SYSLOG');
 					syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
 						SET host = ?
 						WHERE host = ?
 						AND `status` = ?",
-						array($host['host'], $host['host'], $uniqueID));
+						array($unresolved_host, $host['host'], $uniqueID));
 				}
 			}
 		}
diff --git a/setup.php b/setup.php
index e884508..c94e412 100644
--- a/setup.php
+++ b/setup.php
@@ -1140,7 +1140,13 @@ function syslog_config_settings() {
 		),
 		'syslog_resolve_hostname' => array(
 			'friendly_name' => __('Resolve Hostnames', 'syslog'),
-			'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned to a special host called \'invalid_host\'.', 'syslog'),
+			'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned a prefix \'unresolved-Original_hostname\'.', 'syslog'),
+			'method' => 'checkbox',
+			'default' => ''
+		),
+		'syslog_no_dns' => array(
+			'friendly_name' => __('Disable DNS Resolution for incoming hosts', 'syslog'),
+			'description' => __('If this checkbox is set, the system will not attempt to resolve hosts via DNS lookups.  This is useful for environments where DNS resolution is not possible or not desired.', 'syslog'),
 			'method' => 'checkbox',
 			'default' => ''
 		),

From 2328eace855516b0964d1f7bda2a55cc488eaf9f Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Fri, 2 Jan 2026 20:44:16 -0500
Subject: [PATCH 15/17] Group host discovery options together

---
 setup.php | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/setup.php b/setup.php
index c94e412..d2a80b7 100644
--- a/setup.php
+++ b/setup.php
@@ -1138,18 +1138,6 @@ function syslog_config_settings() {
 			'size' => 80,
 			'max_length' => 255,
 		),
-		'syslog_resolve_hostname' => array(
-			'friendly_name' => __('Resolve Hostnames', 'syslog'),
-			'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first. If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned a prefix \'unresolved-Original_hostname\'.', 'syslog'),
-			'method' => 'checkbox',
-			'default' => ''
-		),
-		'syslog_no_dns' => array(
-			'friendly_name' => __('Disable DNS Resolution for incoming hosts', 'syslog'),
-			'description' => __('If this checkbox is set, the system will not attempt to resolve hosts via DNS lookups.  This is useful for environments where DNS resolution is not possible or not desired.', 'syslog'),
-			'method' => 'checkbox',
-			'default' => ''
-		),
 		'syslog_refresh' => array(
 			'friendly_name' => __('Refresh Interval', 'syslog'),
 			'description' => __('This is the time in seconds before the page refreshes.', 'syslog'),
@@ -1179,6 +1167,23 @@ function syslog_config_settings() {
 			'size' => 80
 		),
 		'syslog_html_header' => array(
+			'friendly_name' => __('Host Discovery Options', 'syslog'),
+			'method' => 'spacer',
+			'collapsible' => 'true'
+		),
+		'syslog_resolve_hostname' => array(
+			'friendly_name' => __('Enable Hostname Resolution', 'syslog'),
+			'description' => __('If this checkbox is set, all hostnames are resolved via DNS lookup first (If enabled). If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned a prefix \'unresolved-Original_hostname\'.', 'syslog'),
+			'method' => 'checkbox',
+			'default' => ''
+		),
+		'syslog_no_dns' => array(
+			'friendly_name' => __('Skip DNS Resolution for incoming hosts', 'syslog'),
+			'description' => __('If this checkbox is set, the system will not attempt to resolve hosts via DNS lookups.  This is useful for environments where DNS resolution is not possible or not desired.', 'syslog'),
+			'method' => 'checkbox',
+			'default' => ''
+		),
+		'syslog_html_notification_header' => array(
 			'friendly_name' => __('HTML Notification Settings', 'syslog'),
 			'method' => 'spacer',
 			'collapsible' => 'true'

From ac93b5b654dd4cb95a7a353812150efa4e4e730f Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Fri, 2 Jan 2026 20:44:46 -0500
Subject: [PATCH 16/17] Allow for no DNS option to be disabled

Allow for the check against cacti to continue
---
 functions.php | 64 +++++++++++++++++++++++++++------------------------
 1 file changed, 34 insertions(+), 30 deletions(-)

diff --git a/functions.php b/functions.php
index 41632f7..43d6282 100644
--- a/functions.php
+++ b/functions.php
@@ -1760,7 +1760,6 @@ function syslog_strip_incoming_domains($uniqueID) {
 
 
 
-
 /**
  * Check if the hostname is in the cacti hosts table
  * Some devices only send IP addresses in syslog messages, and may not be in the DNS
@@ -1818,35 +1817,40 @@ function syslog_update_reference_tables($uniqueID) {
 	syslog_debug('Updating Reference Tables from New Syslog Records');
 
 	/* Validate and resolve hostnames - check DNS first, then Cacti, then mark invalid */
-	if (read_config_option('syslog_resolve_hostname') == 'on') {
-		$hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
-			FROM `' . $syslogdb_default . '`.`syslog_incoming`
-			WHERE `status` = ?',
-			array($uniqueID));
-
-		foreach($hosts as $host) {
-			if (!isset($host['host']) || empty($host['host'])) {
-				continue;
-			}
-			
-			// Check if hostname resolves via DNS
-			if ($host['host'] == gethostbyname($host['host'])) {
-				// DNS failed, try to resolve against Cacti hosts
-				$resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
-				
-				// If not found in Cacti either, prefix the hostname
-				if (!$resolved) {
-					$unresolved_host = 'unresolved-' . $host['host'];
-					cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as '" . $unresolved_host . "'", false, 'SYSLOG');
-					syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
-						SET host = ?
-						WHERE host = ?
-						AND `status` = ?",
-						array($unresolved_host, $host['host'], $uniqueID));
-				}
-			}
-		}
-	}
+    if (read_config_option('syslog_resolve_hostname') == 'on') {
+        $hosts = syslog_db_fetch_assoc_prepared('SELECT DISTINCT host
+            FROM `' . $syslogdb_default . '`.`syslog_incoming`
+            WHERE `status` = ?',
+            array($uniqueID));
+
+        foreach($hosts as $host) {
+            if (!isset($host['host']) || empty($host['host'])) {
+                continue;
+            }
+            
+            $resolved = false;
+            
+            // Check if hostname resolves via DNS (only if DNS is enabled)
+            if (read_config_option('syslog_no_dns') != 'on') {
+                if ($host['host'] != gethostbyname($host['host'])) {
+                    continue;
+                }
+            }
+            // Check if hostname exists in Cacti hosts table
+            $resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
+            
+            // If not found in Cacti either, prefix the hostname
+            if (!$resolved) {
+                $unresolved_host = 'unresolved-' . $host['host'];
+                cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as '" . $unresolved_host . "'", false, 'SYSLOG');
+                syslog_db_execute_prepared('UPDATE `' . $syslogdb_default . "`.`syslog_incoming`
+                    SET host = ?
+                    WHERE host = ?
+                    AND `status` = ?",
+                    array($unresolved_host, $host['host'], $uniqueID));
+            }
+        }
+    }
 
 	syslog_db_execute_prepared('INSERT INTO `' . $syslogdb_default . '`.`syslog_programs`
 		(program, last_updated)

From cc459a5f67c6a843160f8eef7d2d2630f655089c Mon Sep 17 00:00:00 2001
From: Sean Mancini <sean@seanmancini.com>
Date: Fri, 2 Jan 2026 22:09:09 -0500
Subject: [PATCH 17/17] Fix  logic issue when dns  lookup is disabled

---
 functions.php | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/functions.php b/functions.php
index 43d6282..8cf6ace 100644
--- a/functions.php
+++ b/functions.php
@@ -1779,7 +1779,7 @@ function syslog_check_cacti_hosts($host, $uniqueID) {
 	}
 
 	// Check if the host exists in cacti by hostname and get the description
-	$cacti_host = db_fetch_row_prepared('SELECT description
+	$cacti_host = db_fetch_row_prepared('SELECT DISTINCT description
 		FROM host
 		WHERE hostname = ?
 		LIMIT 1',
@@ -1833,13 +1833,17 @@ function syslog_update_reference_tables($uniqueID) {
             // Check if hostname resolves via DNS (only if DNS is enabled)
             if (read_config_option('syslog_no_dns') != 'on') {
                 if ($host['host'] != gethostbyname($host['host'])) {
-                    continue;
+                    // DNS resolved successfully
+                    $resolved = true;
                 }
             }
-            // Check if hostname exists in Cacti hosts table
-            $resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
             
-            // If not found in Cacti either, prefix the hostname
+            // Check if hostname exists in Cacti hosts table (only if not already resolved via DNS)
+            if (!$resolved) {
+                $resolved = syslog_check_cacti_hosts($host['host'], $uniqueID);
+            }
+            
+            // If not resolved via DNS or found in Cacti, prefix the hostname
             if (!$resolved) {
                 $unresolved_host = 'unresolved-' . $host['host'];
                 cacti_log("SYSLOG WARNING: Hostname '" . $host['host'] . "' could not be resolved via DNS or found in Cacti hosts table, marking as '" . $unresolved_host . "'", false, 'SYSLOG');