Nagios regexp

[massimobianchi]

Dear all,
I'm trying to configure the systemmonitoring extension to process different sources of nagios in parallel.

Step 1 (OK)
i can receive email from nagios source1, and tickets are correctly opened and closed.

FromAddressRegExp: source1@email.com
HostRegExp: \s*Host:\s+(.*)\s*
CloseTicketRegExp: OK|UP
NewTicketRegExp: CRITICAL|DOWN
ServiceRegExp: \s*Service:\s+(.*)\s*
StateRegExp: \s*Stat[eo]:\s+(\S+)

incoing email content is
###########
Host: TIM-DIR-SAME(10.1.2.

Service:

State: DOWN
###########
Step 2 (NOT OK)

I insert another source, which requires a different set of regexp:


FromAddressRegExp: source1@email.com| source2@email.com
HostRegExp: \s*Host:\s+(.*)\s*|id_unico:\s*(.+)\s*
CloseTicketRegExp: OK|UP|risolto
NewTicketRegExp: CRITICAL|DOWN|aperto
ServiceRegExp: \s*Service:\s+(.*)\s*|tipocaso:\s*(.+)\s*
StateRegExp: \s*Stat[eo]:\s+(\S+)|status:\s*(.+)\s*

Content is like:
##################
EMAIL_AUTO
id_unico: 7972047871
rifcliente1: Npo Sistemi (xxx) Tel. email
rifcliente2: SS SP11, 20067 Non definito (ND)
categoria: Allarme
sottocategoria: Mancata Comunicazione
descrizione: - (SG21R0104B) 15.156.153.85 XXXXXX
priorita: basso
impatto: basso
livello: basso
urgenza: basso
tipocaso: incident
originecaso: allarme
status: aperto

##################

I already tested teh regexp with http://regexpal.com/ and they are working.

Apparently the SystemMonitoring recognizes only the first match for stateregexp and serviceregexp, and not the alternatives.
The system is working fine for closeticketregexp and openticketregexp.

Every time the system down not recognize this as a "nagios" integration, responding with

"Jul 18 17:24:28 npohd02 OTRS-otrs.PostMaster.pl-10[17179]: [Notice][Kernel::System::PostMaster::Filter::SystemMonitoring::Run] SystemMonitoring Mail: SystemMonitoring: Could not find host address and/or state in mail => Ignoring"

To get it to work I have to force the input to Host/Service/State as a valid label.

Any ideas ?

Thanks,
Massimo

[jojo]

Try:

FromAddressRegExp: (source1@email.com| source2@email.com)

[massimobianchi]

Thanks Jojo,
but the FromAddressRegExp is recognized correctly.

I tried with some fake email and the email is going to the sysmonitoring process, but serviceregexp and stateregexp are not recognized.

Up to my knowledge of regexp, the () are used to extract a pieace of a string to be used later...

Thanks,
Massimo

[reneeb]

Thats a weakness in the Postmaster filter module of the SystemMonitoring add on. It assumes that the regexps handles just 1 case.

The code:

Code: Select all

            if ( $Line =~ /$Regex/ ) {

                # get the found element value
                $Self->{$Element} = $1;

                # remember that we found this element already
                $AlreadyMatched{$Element} = 1;
            }

It uses "$1" explicitly! Your regex looks like

Code: Select all

\s*Stat[eo]:\s+(\S+)|status:\s*(.+)\s*

You use two pairs of parens... If the second alternative matches, the match is in $2

That results in:

Text: "State: test"
$1: test
$2: <undef>

Text: "status: test"
$1: <undef>
$2: test


So you should patch the module (Kernel/System/PostMaster/Filter/SystemMonitoring.pm:

Code: Select all

            my @Matches = $line =~ /$Regex/;
            my ($Match) = grep{ defined $_ }@Matches;

            if ( $Match ) {

                # get the found element value
                $Self->{$Element} = $Match;

                # remember that we found this element already
                $AlreadyMatched{$Element} = 1;
            }

[jojo]

it is much easier to register a second time the module, so you just need to change Config.pm or create an additional xml file instead of patching the code

[massimobianchi]

thanks to both.

I managed to get it working.

I will suggest the patch proposed by reneeb to be included, since in my opinion is a minor bug.

Kind regards,

Massimo

[jojo]

works as designed. so no bug for me