[TheWitness]

Description

syslog_search_choices() eagerly loaded every distinct program from syslog_programs to build the program_id query-builder dropdown. On a busy collector that table can contain an effectively unbounded number of distinct program names, so the resulting choice array (and the JSON embedded into the page) could grow large enough to exhaust the PHP memory_limit and fatal with an HTTP 503 when opening the Alert Rule, Removal Rule, and Dashboard editors. The Report Rule editor does not use the filter builder and therefore kept working, which matches the exact symptom reported on the forums.

This change stops preloading programs. Only the small, fixed facility and priority enumerations are materialized as dropdown choices now. The program/program_id fields already resolve through the bounded AJAX suggestion endpoint (syslog_search_suggestions(), LIMIT 30), so the builder transparently falls back to autocomplete for them with no UI loss — and gains it for program_id, which previously tried to render a full dropdown.

Related Issue

Reported on the Cacti forums: https://forums.cacti.net/viewtopic.php?t=64912 — editing/creating Alert Rules, Removal Rules, and Dashboards returns Fatal Error:503, while Report Rules work. The forum poster's MariaDB processlist pinpointed the slow, unbounded query:

SELECT program_id AS id, program AS name FROM syslog.syslog_programs ORDER BY program

Motivation and Context

The 503 was a memory-exhaustion fatal, not a missing table/column. The query-builder's program dropdown is the only place that enumerated the entire syslog_programs table on every editor render. Because programs are unbounded on active deployments, preloading them does not scale; autocomplete is the correct, already-present mechanism.

How Has This Been Tested?

Ran the plugin's Pest suite against a Cacti checkout with the plugin at plugins/syslog:

include/vendor/bin/pest --configuration plugins/syslog/phpunit.xml

Result: 644 passed (2683 assertions), with 1 pre-existing unrelated warning (/proc cmdline stub in ProcessHelperCompatTest). The SearchValuesTest regression test was updated to assert that facility_id/priority_id are preloaded while program_id is intentionally not (it now uses bounded AJAX suggestions).

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation repository accordingly.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟢 Approval recommended

No active review issues were identified for the change replacing unbounded program-choice preloading with bounded autocomplete.

No open issues 🎉

What changed in this PR

Reduces memory use in Syslog query-builder editors by removing the unbounded program-choice preload, addressing reported HTTP 503 errors on busy collectors.

Changes:

• Preloads only facility and priority choices; program fields use the existing bounded AJAX autocomplete.
• Updates regression assertions to confirm program choices are excluded.
• Documents the fix and affected editors in the changelog.

File	Description
tests/​Unit/​SearchValuesTest.php	Confirms bounded choices remain populated and program choices are omitted.
includes/​functions.php	Removes program preloading and documents the autocomplete fallback.
CHANGELOG.md	Records the memory-exhaustion fix under develop.

_{Review effort: Balanced}