From 249c7d35608b129d1c35f73ab0da65f853edf9a9 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Mon, 5 Jan 2026 11:16:31 -0600
Subject: [PATCH] Log initial interface discovery as events

- Detect when interface speed changes from null to a value
- Detect when MAC address changes from null to a value
- Log initial discoveries with "info" severity
- Differentiate between initial discovery and actual changes
- Show "detected" message for initial values
- Show "changed from X to Y" message for actual changes
---
 lib/towerops/snmp/poller_worker.ex | 43 ++++++++++++++++++++++--------
 1 file changed, 32 insertions(+), 11 deletions(-)

diff --git a/lib/towerops/snmp/poller_worker.ex b/lib/towerops/snmp/poller_worker.ex
index a6b90b48..8e6acb08 100644
--- a/lib/towerops/snmp/poller_worker.ex
+++ b/lib/towerops/snmp/poller_worker.ex
@@ -317,19 +317,31 @@ defmodule Towerops.Snmp.PollerWorker do
         [{:event, event} | changes]
       end
 
-    # Check speed change
+    # Check speed change (including initial discovery)
     changes =
-      if interface.if_speed != current_attrs.if_speed &&
-           current_attrs.if_speed != nil && interface.if_speed != nil do
+      if interface.if_speed != current_attrs.if_speed && current_attrs.if_speed != nil do
+        # Determine if this is initial discovery or a change
+        is_initial = interface.if_speed == nil
+
         severity =
-          if current_attrs.if_speed < interface.if_speed, do: "warning", else: "info"
+          cond do
+            is_initial -> "info"
+            current_attrs.if_speed < interface.if_speed -> "warning"
+            true -> "info"
+          end
+
+        message =
+          if is_initial do
+            "Interface #{interface.if_name} speed detected: #{format_speed(current_attrs.if_speed)}"
+          else
+            "Interface #{interface.if_name} speed changed from #{format_speed(interface.if_speed)} to #{format_speed(current_attrs.if_speed)}"
+          end
 
         event = %{
           equipment_id: equipment_id,
           event_type: "interface_speed_change",
           severity: severity,
-          message:
-            "Interface #{interface.if_name} speed changed from #{format_speed(interface.if_speed)} to #{format_speed(current_attrs.if_speed)}",
+          message: message,
           metadata: %{
             interface_id: interface.id,
             interface_name: interface.if_name,
@@ -344,16 +356,25 @@ defmodule Towerops.Snmp.PollerWorker do
         changes
       end
 
-    # Check MAC address change
+    # Check MAC address change (including initial discovery)
     changes =
       if interface.if_phys_address != current_attrs.if_phys_address &&
-           current_attrs.if_phys_address != nil && interface.if_phys_address != nil do
+           current_attrs.if_phys_address != nil do
+        # Determine if this is initial discovery or a change
+        is_initial = interface.if_phys_address == nil
+
+        message =
+          if is_initial do
+            "Interface #{interface.if_name} MAC address detected: #{current_attrs.if_phys_address}"
+          else
+            "Interface #{interface.if_name} MAC address changed from #{interface.if_phys_address} to #{current_attrs.if_phys_address}"
+          end
+
         event = %{
           equipment_id: equipment_id,
           event_type: "interface_mac_change",
-          severity: "warning",
-          message:
-            "Interface #{interface.if_name} MAC address changed from #{interface.if_phys_address} to #{current_attrs.if_phys_address}",
+          severity: if(is_initial, do: "info", else: "warning"),
+          message: message,
           metadata: %{
             interface_id: interface.id,
             interface_name: interface.if_name,