We got a lot of IMAP sensors against one mailbox, cheking backup tasks. Recently, we've detected that sensors are reporting false positives, 'cause there are mails inside mailbox reporting backup failures. But, sensors are giving ok status after all...
SENSOR CONFIGURATION:
IDENTIFY EMAIL--> Process emails in this mailbox Mailbox Name --> Inbox Identify by "From" Field --> Check using string search Search For --> Identify by "Subject" Field --> Check using regular expression Search For --> (?=.*\bDibuix\b).* Identify by Mail Body --> Don't check Check Last Message Date --> Check for new messages received within the last x hours Warning Threshold (Hours)--> 24 Error Threshold (Hours)--> 26 SENSOR BEHAVIOR Set to Alarm --> If mail body contains Check Method -->String search Search Text --> (?=.*\berror\b).*Error Message
INBOX MAIL
FROM: SUBJECT: Alerta de CA ARCserve Central Host-Based VM Backup-Copia de seguridad de máquinas virtuales-Copia de seguridad completa Estado de la tarea:Incorrecto(vmName:DIBUIX; nodeName:) BODY: Tipo ID de tarea Hora Mensaje Información 566 21/04/2014 0:40:23 Se han cerrado los archivos VMDK de la máquina virtual. Error 566 21/04/2014 0:40:22 Se ha producido un error en la tarea de copia de seguridad.
As you can see, FROM, SUBJECT and BODY coincide with sensor configuration. What am I doing wrong?
Last change on May 6, 2014 8:52:33 AM by
Add comment