Jump to content
Greg.Buerk

Email Box Monitor Plugin

Recommended Posts

This is fantastic Greg! I just implemented this to monitor a mailbox we setup for SAN support emails instead of having to send those to my inbox.

 

Would it be possible to have the plugin close a ticket if an email came in that was reporting a success after failure?

Share this post


Link to post
Share on other sites

I keep starting to work on this then have something else come up.

 

How can I test it? I want it to create a ticket any time an email is in the mailbox for now.

Share this post


Link to post
Share on other sites

cgauss, this is what I do, Im not currently doing any filtering per se, beyond filtering against the from field so that I can map the incoming mail to the correct client. I just dont enter anything in the other filter fields and placed %emailbody% in the message field.

 

I also have another question for Greg, you say the rules are processed in order, is that by the Rule# listed on the left or by the sort # we can enter?

 

*edit* nevermind, answered my own question. The Rule # is resorted after saving the account, upon reopening the account the rules are resorted to match the sort order.

Share this post


Link to post
Share on other sites

So just so I am testing this the same. The rule would look like this....

 

From Filter =

Subject Filter =

Header Filter =

Body Filter =

Alert Template = Default - Create LT Ticket

Script = None

Message = %emailbody%

Ticket Category = None

Client = None

Computer = Not Selected

Sort = 0

Share this post


Link to post
Share on other sites

According to Greg a bit further up I think you need to set the Body Filter to * so it will match everything. If they are all blank I imagine there will be no action against the emails as they wont match any rules.

Share this post


Link to post
Share on other sites

I cant get it to display anything in the ticket. I have tried %ShowVariables% and it just puts that in the ticket.

Share this post


Link to post
Share on other sites

Were you able to get multiple rules to work on an account? For some reason that doesnt seem to be working for me.

Share this post


Link to post
Share on other sites

I currently have only 1 account, and have 10 rules on it. There is a bit of quirkiness to the plugin, as is the case with them sometimes. After you have saved your first rule, hit the save account button, then go back in and add your second rule, make sure you give it a different sort order #. I find myself needing to do this occasionally to make sure changes are sticking.

Share this post


Link to post
Share on other sites

Hi Greg,

 

Is there any way to take control of the ticket subject? It seems to currently be something like, ACCOUNTNAME:ACCOUNTINDEX - RULEINDEX EMAILSUBJECT

 

Cheers,

Dave

Share this post


Link to post
Share on other sites

I'm getting this error message when running the plugin. it shows that email comes in but doesn't create a ticket.

Agent v60.276 - 8/1/2014 4:41:17 PM - PluginEmail Sink v1 commited an error in ScanRegex parsing "*" - Quantifier {x,y} following nothing.:::

Share this post


Link to post
Share on other sites

It looks like Greg has been too busy to answer questions on this plugin recently. Hopefully someone else is using this that could help me out though.

 

I have been using this for months for filtering SAN alerts coming, basically just using the From Filter to assign the ticket category and client so they flow in to CW with that info. This has worked great and is a pretty basic setup.

 

I am now trying to do something a bit more complicated. All of our firewalls talk to a central management appliance, when they don't check in because the clients WAN is down the central appliance sends an email with the client's firewall appliance name and the status (disconnected/reconnected) in the body.

 

What I am trying to do is a body filter for the appliance name, using this info I can create a rule for each appliance name and set the ticket category and client like I do with the SAN alerts. This works by itself. I am trying to take it one step further though and have the rule run a script which regex the email body again for (disconnected/reconnected) and opens or closes a ticket based on that.

 

One issue is that I can only chose computers for the client that I'm setting and their internet is down when this happens so I can't run a script on a remote machine, since the email is already in labtech by the time it hits the plugin I would like to run the script on the LT server, this doesn't appear possible.

 

The second issue is that I can never seem to get the script to run anywhere. I've tried setting the alert on the remote client DC, calling the script directly in the plugin, calling an alert template from the plugin which calls the scripts, even having the alert template raise an alert, but none of these things seem to ever happen either on the remote computer or LT server. I've checked the plugin and plugin error logs and see nothing in the errors and the plugin log says it found the email and is starting raise alert data.

 

What am I missing here?

Edited by Guest

Share this post


Link to post
Share on other sites

For your 2nd issue I was stuck on the same thing the other day. Just assigning the script to the rule didn't run the script. What I had to do was create a new alert template and the action set to script, but when it asks for which script just leave it as "Not Selected." From here in Email Sink I was able to select the alert to the one I just created, and client, computer, and script and it ran the script specified in Email Sink on that computer.

 

Not to take away from your other issue, but I am not stuck trying to find out how the variables are passed to the scripts. %ShowVariables% doesn't seem to be working in the script, but if I set the alert template to email then %ShowVariables% shows me all the variables.

 

32106a820cfb5f36774e4eb2904b2a7c.1409258389.PNG

Share this post


Link to post
Share on other sites

Thanks for the tip to get the script to run, that is working much better. But as you have noticed I'm also running into the issue that calling the script from the alert template seems to break the variables. That sucks but it does pass whatever message you have in the plugin in the variable @message@, im just going to regex the appliance name again in the script since I don't see a way to pass the filter result.

 

I also figured out the issue with running the script on a down site, I just set the computer to the DC on site and set the script to offline and at least for my script it looks like it is running on the remote machine but no commands are sent to it and I do get the results out of the script as expected.

Share this post


Link to post
Share on other sites

Here are the variables passed by Email Sink to scripts. (If you watch the script while it is in the "Waiting" stat it had all the variables seperated by | )

 

@status@ - True/False

@fieldname@ - This is the subject (Yes the variable is fieldname)

@result@ - (I think this is what regex parses, but I am using .* so it just returns the whole message)

@where@ - Looks like the header info

@what@ - Email address that sent the email.

@message@ - The body of the email (I believe before regex)

Share this post


Link to post
Share on other sites


Appliance Name : M_SNCSquaredRemote


 


Following alert(s) were generated as per the Appliance time 2014-09-04 04:01 and time zone - America/Chicago configured in Appliance.


 


     Appliance is reconnected since 04 Sep 2014 03:57:54.


 


You have received this alert by subscribing for CCC Appliance InstaAlerts. To unsubscribe/modify alerts login to CCC.



Share this post


Link to post
Share on other sites

Anyone still watching this thread? I'm trying to extract updates out of an e-mail, but having an issue with reg expressions. In the e-mail we are trying to determine when an extension has unregistered. We get the following notice via e-mail:

 

(0)  CPN-VOIP01   2/14/2013 5:23:01 PM

 

Event source: 3CXPhoneSystem

 

Extension 2202 is registered, contact: sip:2202@192.168.101.205:5062

 

We want to have a ticket opened when the extension is unregistered and then if the extension reports registered close the ticket.

 

Is this possible with this plugin?

 

Thanks in advance!

Share this post


Link to post
Share on other sites

tfreitas: It is sort of possible with this plugin, but you will have to do the same thing I am doing, you need a script to do the ticket opening/closing. I am doing essentially the same thing you are wanting to do as I am opening a ticket when getting a disconnected email from our firewall appliance monitor and closing a ticket when getting a reconnected email. Unfortunately my issue described above is causing this to not be a complete implementation yet. When I get that part working I would be happy to share my script and instructions, it should be pretty easy to tweak my script to do what you want as well.

Share this post


Link to post
Share on other sites

Ok I found a workaround for the trouble with html today, turns out in exchange there is a setting called ImapMessagesRetrievalMimeFormat that you can set so any email retrieved from the mailbox, like this plugin does, will be retrieved as plain text if configured. Also make sure to change ImapUseDefaultProtocols to false so the changes take effect and restart the IMAP services.

 

Here's a copy of the script i am using for my purpose, it should be fairly easy to modify for similar uses. The script needs to be called from an alert template with "Script" alert (but set the script to run in the plugin, not the alert template, thanks NCPJohn). You will have to pick a computer to target for the script, and your choices will be limited to the client in the rule, but this is an offline script and doesn't actually run any commands on the remote machine so it doesn't really matter what computer you pick. (And if you have client you need this type of alerting for but they don't have machines in labtech, you can create a dummy computer object in the database)

Appliance Email Ticket.zip

Share this post


Link to post
Share on other sites
First of all, thank you very much for that!

Just a quick one: Can it pull emails from outlook.office365.com?

I've tried every combination of options I could think of without success...

Thanks.

 

Never mind, got it working.

Thanks :D

Share this post


Link to post
Share on other sites

I upgraded my LT test environment to LT 10 from 2013 a week ago. I tried to run this email installer on LT10 directly and it gave me errors. It wasn't successful in LT 10. Is there a workaround for it? I am really interested in this plugin. It will save a ton of time for us !!

 

Thanks !!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×