System Monitoring - Regular Expression for Nagios Email coming

[catharn]

Dear Everyone,

I implemented in OTRS 4.0.6 successfully the SystemMonitoring module with a link to the Config Items in the CMDB.
So when a mail from Nagios is coming (for example host : serv2k3 is down), he will look for serv2k3 in the CMDB, find it, and put his incident state to Incident.

You'll say I don't see your request in this post, but here it is.

For some services, i've put an allias in Nagios (So host vserv2k8) can be Main Server 2008. So when the mail is coming from nagios, the host is set to Main Server 2008 but SystemMonitoring link with CI is looking only for Main, instead of Main Server 2008.

I've tested a lot of regexp for the host, but not the one (that i'm looking for) that work...

I'm using this HostRegExp for now : \s*Host:\s+(\S*)\s*

I've put you the configuration of my PostMaster PreFilterMoule from SystemMonitoring.

I tested the same reg exp as Service, but in this case, he was looking for the name of the host, but with a blank at the end, so like this : 'win2k3 ' instead of 'win2k3'

Thanks in advance for your help

[reneeb]

Try to replace "\S*" with ".*?"

[catharn]

I just tried it, but it is ignoring the lookup. Here is what the logs are saying :
Thu Mar 12 11:59:02 2015 notice OTRS-otrs.PostMasterMailbox.pl-57 SystemMonitoring Mail: SystemMonitoring: Could not find host address and/or state in mail => Ignoring

I already tested \S*, .*, .*?,...

[reneeb]

Can you post the .eml of a sample mail?

[catharn]

I can't post you the sample .eml file, but I can copy you the content of the email : (With that, I want to look for V Oracle Entreprise Manager instead of V (if it's for sure possible)
Subject : ** PROBLEM Service Alert: V Oracle Enterprise Manager/http Oracle Enterprise Manager is WARNING **


De: nagios@****
À: test.arnaud@*******
Sujet: ** PROBLEM Service Alert: V Oracle Enterprise Manager/http Oracle Enterprise Manager is WARNING **
Date: 2015-03-12 11:24:02

***** Nagios *****

Notification Type: PROBLEM

Service: http Oracle Enterprise Manager
Host: V Oracle Enterprise Manager
Address: X.X.X.X
State: WARNING

Date/Time: Thu Mar 12 11:23:45 CET 2015

Additional Info:

HTTP WARNING: HTTP/1.1 404 Not Found - 1446 bytes in 3.897 second response time

[reneeb]

Try

Code: Select all

\s*Host:\s+(.*?)\r?\n

[catharn]

I'm back to my old problem. The fact that he had a space after the last word. Here is the log entry (Thanks for your time!)

Thu Mar 12 13:24:01 2015 error OTRS-otrs.PostMasterMailbox.pl-57 Could not find any CI with the name 'V Oracle Enterprise Manager '.

[reneeb]

Code: Select all

\s*Host:\s+(.*?)\s*\r?\n

[catharn]

I'm again back as before : Thu Mar 12 14:29:02 2015 notice OTRS-otrs.PostMasterMailbox.pl-57 SystemMonitoring Mail: SystemMonitoring: Could not find host address and/or state in mail => Ignoring

One solution that I might have, it won't be solving the problem, but what nagios send (V http Oracle Manager) is an allias of voem. I can also change in nagios to send the name of the host instead of the alias of the host.

Or if you have other idea, i'm listenning