This is an issue there has been knocking around for a few years now, we noticed it first in 2022 and it breaks Acknowledgements being sent back into Nagios as well as alert matching if you update anything in the ticket's freefields window. This was a forum post I raised about it back then https://community.znuny.org/viewtopic.php?t=43354 (znuny 6.4.2/SM 6.4.2) and we finally got round to diagnosing the issue properly this week.
Now running Znuny 7.0.19 with SystemMonitoring 7.0.2 and the issue is still the same.
When an alert is retrieved via email and processed correctly in the SystemMonitoring filter the function that puts the Host and Service Items into the Ticket FreeFields items adds a CR (0D in hex) to the end of each data item.
We've validated the RegEx used at regex101.com and there is no Carriage Return in the capture groups returned:
-- Test data --
***** Nagios *****
Notification Type: PROBLEM
Service: MGMT
Host: testserver
Host Alias: Dev C7 Test Server
Address: 111.222.333.444
State: CRITICAL
Date/Time: Fri Oct 28 17:10:41 BST 2022
Additional Info:
connect to address 111.222.333.444 and port 80: Connection refused
-- Test Data End --
-- RegEx strings --
HostRegExp -> \s*Host:\s+(.*)\s*
ServiceRegEx -> \s*Service:\s+(.*)\s*
--
Links to RegEx examples:
https://regex101.com/r/KbXp2p/1
https://regex101.com/r/glSNKp/1
We'd therefore guess that the code AFTER the regex parsing has captured the retrieved data correctly is then adding a CR itself at some point.
If you look at the FreeFields data in the created ticket, make NO CHANGES to anything, and just click save the extra CRs are stripped from the FreeFields. Subsequent SystemMonitoring updates to the ticket, for example a recovery email, no longer match up as there is no longer an CR at the end of the FreeFields ticket data - you can see this in the communication logs quite clearly.
This is an issue there has been knocking around for a few years now, we noticed it first in 2022 and it breaks Acknowledgements being sent back into Nagios as well as alert matching if you update anything in the ticket's freefields window. This was a forum post I raised about it back then https://community.znuny.org/viewtopic.php?t=43354 (znuny 6.4.2/SM 6.4.2) and we finally got round to diagnosing the issue properly this week.
Now running Znuny 7.0.19 with SystemMonitoring 7.0.2 and the issue is still the same.
When an alert is retrieved via email and processed correctly in the SystemMonitoring filter the function that puts the Host and Service Items into the Ticket FreeFields items adds a CR (0D in hex) to the end of each data item.
We've validated the RegEx used at regex101.com and there is no Carriage Return in the capture groups returned:
-- Test data --
-- Test Data End --
-- RegEx strings --
--
Links to RegEx examples:
https://regex101.com/r/KbXp2p/1
https://regex101.com/r/glSNKp/1
We'd therefore guess that the code AFTER the regex parsing has captured the retrieved data correctly is then adding a CR itself at some point.
If you look at the FreeFields data in the created ticket, make NO CHANGES to anything, and just click save the extra CRs are stripped from the FreeFields. Subsequent SystemMonitoring updates to the ticket, for example a recovery email, no longer match up as there is no longer an CR at the end of the FreeFields ticket data - you can see this in the communication logs quite clearly.