AutoCloseOnNagiosRecoveryMessages – RT Integration

Project Notes

This tip is based on an e-mail from Todd Chapman to the rt-users mailing list (Mars - 2004).

We use Nagios to check if our machines are up and working. Every time something strange happens (swap use is too high, CPU load is above 10, and so on ) it sends an e-mail with a subject like " * PROBLEM boxxor/CPU load os CRITICAL *". As soon as things back back to normal it sends another message " * RECOVERY boxxor/CPU load os OK *". So, this will create two tickets in RT - two tickets that ought to be manually merged and closed. To make things easier here I adapted the above script to merge ALL pending open/new PROBLEM messages related to a given RECOBERY message and automatically close/resolve these tickets.

Description: Merge Into Existing Ticket on match Condition: OnCreate

Action: User Defined Custom action preparation code:

1;

Custom action cleanup code:

# If the subject of the ticket matches a pattern suggesting
# that this is a Nagios RECOVERY message  AND there is
# an existing ticket (open or new) in the "General" queue with a matching
# "problem description", (that is not this ticket)
# merge this ticket into that ticket
#
# Based on http://marc.free.net.ph/message/20040319.180325.27528377.en.html

my $problem_desc = undef;

my $Transaction = $self->TransactionObj;
my $subject = $Transaction->Attachments->First->GetHeader('Subject');
if ($subject =~ /** RECOVERY (w+) - (.*) OK **/) {
    # This looks like a nagios recovery message
    $problem_desc = $2;

    $RT::Logger->debug("Found a recovery msg: $problem_desc");
} else {
    return 1;
}

# Ok, now let's merge this ticket with it's PROBLEM msg.
my $search = RT::Tickets->new($RT::SystemUser);
$search->LimitQueue(VALUE => 'General');
$search->LimitStatus(VALUE => 'new', OPERATOR => '=', ENTRYAGGREGATOR => 'or');
$search->LimitStatus(VALUE => 'open', OPERATOR => '=');

if ($search->Count == 0) { return 1; }
my $id = undef;
while (my $ticket = $search->Next) {
    # Ignore the ticket that opened this transation (the recovery one...)
    next if $self->TicketObj->Id == $ticket->Id;
    # Look for nagios PROBLEM warning messages...
    if ( $ticket->Subject =~ /** PROBLEM (w+) - (.*) (w+) **/ ) {
        if ($2 eq $problem_desc){
            # Aha! Found the Problem TICKET corresponding to this RECOVERY
            # ticket
            $id = $ticket->Id;
            # Nagios may send more then one PROBLEM message, right?
            $RT::Logger->debug("Merging ticket " . $self->TicketObj->Id . " into $id because of OA number match.");
            $self->TicketObj->MergeInto($id);
            # Keep looking for more PROBLEM tickets...
        }
    }
}

$id || return 1;
# Auto-close/resolve this whole thing
$self->TicketObj->SetStatus( "resolved" );
1;