[Xymon] [SOLVED] Re: Getting "ATT0001.bin" attachments sometimes -- MAILC fix is already in place

[Shawn Heisey]

On 8/13/2015 10:33 AM, Shawn Heisey wrote:
> It's starting to sound like I need to write a script so that no special
> characters are required.  An ugly hack, but I think it will work ... so
> I will go ahead and do that.

Even when stripping CR characters, I was still getting attachments in
"msgs" alarms, but only on alarms related to one machine, which happens
to be the only one running Windows Server 2012.  The really frustrating
part: sometimes alarms related to that machine came through just fine,
no attachment.

I finally figured out why.  It's because Windows is trying to make event
logs prettier.  The problem event that I noticed is using the so-called
'smart' apostrophe.  Here's part of what I see if I 'cat' one of those
attachments on Linux:

===
This event is generated when a process attempts to log on an account by
explicitly specifying that account<92>s credentials.
===

Notice the <92> ... this is hex character 92 (the curly apostrophe in
the Windows-1252 character set), and because this character has the high
bit set, /bin/mail decides that it can't use the input as the message
body, and makes it an attachment.

I came up with a script to handle this situation, called with this line
in xymonserver.cfg:

MAILC="/etc/xymon/stripxymonmail"

The contents of that script are below:

===
#!/bin/sh

TMPF=`/bin/mktemp`
cat > ${TMPF}
CHARSET=`file --mime-encoding ${TMPF} | sed 's/.*: \(.*\)/\1/'`
[ "x${CHARSET}" == "xunknown-8bit" ] && CHARSET=cp1252
/usr/bin/iconv -f ${CHARSET} -t ASCII//TRANSLIT ${TMPF} \
 -o ${TMPF}.filter
/bin/rm -f ${TMPF}
cat ${TMPF}.filter | /usr/bin/tr -d '\001\004' | dos2unix \
 | /bin/mail "$@"
/bin/rm -f ${TMPF}.filter
===

I don't yet know whether this is completely foolproof.  It works if the
content is already ascii, and I'm hoping it works if the content is
UTF-8, but I haven't tested this yet.  If anyone has ideas to make it
more bulletproof, please share.

Thanks,
Shawn