-
Incident report
-
Resolution: Duplicate
-
Major
-
None
-
3.2.4
-
CentOS 6.4 on VMware 6.0, Oracle 12.1.0.2 as database backend
Afer upgrade from 3.2.3 to 3.2.4 we noticed that alerts sended by email and passed to external script are truncated, e.g.:
E-mail message body format:
Event time: {EVENT.DATE} {EVENT.TIME}
Event id: {EVENT.ID}
Event age: {EVENT.AGE}
Event ACK: {EVENT.ACK.STATUS}
Status: {TRIGGER.STATUS}
Severity: {TRIGGER.SEVERITY}
Name: {TRIGGER.NAME}
Expr: {TRIGGER.EXPRESSION}
Item(1) info:
Host: {HOST.NAME1}
IP: {HOST.IP1}
Value: {ITEM.LASTVALUE1}
Item(2) info:
Host: {HOST.NAME2}
IP: {HOST.IP2}
Value: {ITEM.LASTVALUE2}
Item(3) info:
Host: {HOST.NAME3}
IP: {HOST.IP3}
Value: {ITEM.LASTVALUE3}
Before upgrade:
Event time: 2017.03.01 10:25:09
Event id: 5755766
Event age: 0m
Event ACK: No
Status: PROBLEM
Severity: High
Name: webserwis SERVER
Expr: {*****:web.test.fail[webserwis SERVER].sum(#2)}>1
Item(1) info:
Host: *****
IP: 000.000.000.000
Value: 1
Item(2) info:
Host: *UNKNOWN*
IP: *UNKNOWN*
Value: *UNKNOWN*
Item(3) info:
Host: *UNKNOWN*
IP: *UNKNOWN*
Value: *UNKNOWN*
After upgrade:
Event time: 2017.03.06 14:12:31
Event id: 5842082
Event age: 0m
Event ACK: No
Status: PROBLEM
Severity: High
Name: webserwis SERVER
Expr: {*****:web.test.fail[webserwis SERVER].sum(#2)}>1
Item(1) info:
Host: hostname
IP: 000.000.000.000
Value: 1
Item(2) info:
Host: *UNKNOWN*
IP: *UNKNOWN*
Value: *UNKNOWN*
Item(3) info:
Host: *UNKNOWN*
IP: *UNKNOW
Each e-mail alert is truncated exactly after Item 3 info "IP: *UNKNOW", regardless of prior message length.
The same is with alert messages passed to external script.
instead:
OK/Warning 2017.03.07 10:53:13 Application SEVERE error detected Host: ***** Value: 0
we have:
OK/Warning 2017.03.07 10:53:13 Application SEVERE error detected Host: ***** Valu
I've checked the database content and table ALERTS also contains truncated messages, and there is no clear rule by which messages are truncated.
Regards,
Marcin Mazurek
- duplicates
-
-
- Closed
-