mail2mon

Project Notes

Purpose:
========

- Submitting alert emails to a monitor system based on Nagios

Features of the program:
========================

- Accepts Internet mail (text), MIME and Multipart MIME messages (nested MIME not supported)
- Extracts sender, subject and content (text)
- Converts HTML in message content to text
- Converts base64 coded message content to text
- Converts german umlauts to ASCII but there is no general conversion (ISO-8859-1 or UTF8 to 7-Bit Ascii or so)
- Has a API to add filter scripts written in Perl or any other language to
extract and reformat
- host and/or application from subject and/or content
- data from subject and/or content
- reformat data and deliver the data back to the program
- Writes the reformatted data (host, errorcode, content) to the command pipe
- Includes a option to store mails in a given directory (because you need some stored mails to develop your filter)
- Includes a testmode for testing filters while developing them.

History and Changes:
====================

- 10 May 2012 Version 1
- First released version

Prerequisites:
==============

- Perl and some of its modules
- A configured mail daemon (tested with postfix) willing to accept incoming mails.

How does it works?
==================
The program receives it data via pipe from postfix. (Ingo Lantschner described it in "SMTP-Handling
für Nagios HowTo").

There are no temporary data to be stored for analytics purpose. As mentioned in features above text,
MIME, Multipart-MIME and base64 encoding is supported.

Why this?

Normally system messages come as plain text. But it can happen, that a system is configured to send
"wonderfull HTML messages" because the administrator is at present alarmed via email. So the only
thing to change on the system is the mail address. Nothing else.

Or you have some things like a jobscheduler on a AS400 which can only send emails. Or (as in my case)
you use for some reasons things like MOM. But MOM can not contact your trouble ticket system. But your
Nagios can. So you have to process messages from MOM.These are base64 coded.

Or you have a application which can send alert mails but nothing else.

After bases analysis of the message we have 3 things:

- Sender
- Subject
- Content (Text ASCII)

We have no sending host because a host refined from the mail header is not destinct. Therfore we have to
ections in the config file (see later on) where the admin defines a relation mail to host and eventually
mail to application.

mail2mon uses this informations to build the of the filter file.

Example:
Mailaddress [email protected] belongs to host harry then the name of the file is

harry.fltr

If [email protected] belongs also to application main-erp-system the name of the filter would be:

harry_main-erp-system.fltr

The trick is that when the progam starts noch a real great bunch of filters is loaded. The name of the
file is determined at runtime.

mail2mon will handle over sender, subject and content to the filter script, will receive the
output of the script and tranfer it to the eventdb.

Some words about a filter script. Normally it is a little perl program which is included via "require" at
runtime. A sample is included in the filter directory. For those of us who are not able to program
in perl there are two little scripts. A perl programm as a sample which calls a shellscript/program.

Via this interface you can use whatever you want as program language (but beware of runtime).