random equals all up in my emails

[Jklre]

Happy hollidays! umm i think i found a bug in the latest version of NLS

looks like random = signs are appearing throughout the emails and in the URL links generated.

When clicking on links sent via email i get "The URI you submitted has disallowed characters."

the link shoes as

http://pnls01lxv/nagioslogserver/alert= ... T18:51:26Z

when it should be:

http://pnls01lxv/nagioslogserver/alerts ... T18:51:26Z

I also notice in the message there are some random equals as well example:

107030 FileReceiverServiceClient Error - Priority 2 came back with a =RITICAL state at Wed, 23 Dec 2015 11:06:26 -0800
The alert was processed with the following thresholds:
• Lookback period: 15m
• Warning: 0
• Critical: 0
Here is the full alert output:
CRITICAL: 8 matching entries found |lo=s=8;0;0
See the last 15m in the Nagios Log Server dashboard.
message <11>papp11lxv jboss_jbc7: n=de2: [ID 21971 Dec 23, 2015 10:58:52 AM com..services.core.errorlo=.server.SyslogWriter write#012SEVERE: %%152128402%%107030%%FATAL%%pjbc7n4l=v..com:jboss_jbc7:node4%%PARTIALLOSS%%FILE_DELIVERY_SERVICE%%2015-=2-23T10:58:50.886-08:00%%com..services.business.partialloss.filere=eiver.client.FileReceiverServiceClient%%handleFileReceiverClientRequest%%b=877cc8-ac18-1922-1f1d-c07567786f77%%HT%%%%[jboss_jbc7] Claim Number: PA001=549948-01; Error Description: Caught non RemoteException Error returned fr=m web service
@version 1
@timestamp 2015-12-23T18:58:52.674Z
type syslog
host 172.22.1.68<=td>


Thank you!

[Box293]

Is it just in the emails you are seeing this?

Can you go to Alerting > Email Templates
Click System Default and show us how the template is defined

[jolson]

What kind of mail client are you using?

Are you sending NLS alerts to a ticketing system?

Could you PM me one of your mail headers?

What kind of encryption are you using to send you mail out? I ask because I'm wondering if we could tcpdump the outbound mail from NLS to check whether or not the random equal signs are inserted at that point.

If there's any way you can make certain that NLS is mutilating the email, I have some further troubleshooting suggestions. Thanks!

[Jklre]

PM Sent.

Thank you.

No ticketing system. Just sent via exchange to an outlook client. client = 2010 exchange server = 2013

Email settings are as follows.

emailsettings.jpg

ignore the password thats just chrome auto-fill no user id or password is set.

[jolson]

Thanks - I looked through the PM and the headers were indeed incorrect. I think that a good next step will be performing a tcpdump on outbound port 25 to see whether or not the emails are bad as they leave the NLS box:

Code: Select all

yum install tcpdump
tcpdump dst port 25 -X -n

After you have the tcpdump running, try triggering an alert that generates one of the bad emails and see whether or not it's reflected in the TCPdump output.

[Jklre]

Thanks - I looked through the PM and the headers were indeed incorrect. I think that a good next step will be performing a tcpdump on outbound port 25 to see whether or not the emails are bad as they leave the NLS box:

Code: Select all

yum install tcpdump
tcpdump dst port 25 -X -n

After you have the tcpdump running, try triggering an alert that generates one of the bad emails and see whether or not it's reflected in the TCPdump output.

Thanks I just sent you a PM with the TCP dump of one of the email alerts.

Thanks.

[Jklre]

Thanks - I looked through the PM and the headers were indeed incorrect. I think that a good next step will be performing a tcpdump on outbound port 25 to see whether or not the emails are bad as they leave the NLS box:

Code: Select all

yum install tcpdump
tcpdump dst port 25 -X -n

After you have the tcpdump running, try triggering an alert that generates one of the bad emails and see whether or not it's reflected in the TCPdump output.

Thanks I just sent you a PM with the TCP dump of one of the email alerts.

Thanks.

I also just switched from SNMP to PHP mail and the problem does not seem to effect php mail

[jolson]

I found the following string in your tcpdump:

http:/pnls01lxv/nagioslogserver/alert=.s/show/gWhll_TvTxa0rim07ZCKNA?s_to=3D2015-12-23T21:24:20Z&s_from=3D2015-12-=.23T21:09:20Z

The important part is "alert=s" - it appears that equal signs are indeed being inserted seemingly at random. You can even see it in some of the HTML tags:

Code: Select all

background-colo=r

I have sent this over to the developers for further review - I'll let you know what they say! I'm very interested in knowing why this may have happened - it didn't come up in any of our testing. Thanks!

Jesse

[jolson]

I received an answer from development:

More than likely - the bad characters in there looks like an encoding problem. We definitely do not transmit with all the equal characters in it - it's just plain HTML. We encode our emails with utf-8, perhaps their SMTP server doesn't support that?

I tested SMTP and PHP mail and both worked without issues for me - if it's only SMTP having problems (We don't do anything special for SMTP than for the php mailer besides send it off to the SMTP server) then it has to be something with either the way they are sending it (Who knows if they changed something) or the SMTP server itself - can't really be more specific.

Could you verify that your SMTP server supports utf-8 encoding?

[Jklre]

I received an answer from development:

More than likely - the bad characters in there looks like an encoding problem. We definitely do not transmit with all the equal characters in it - it's just plain HTML. We encode our emails with utf-8, perhaps their SMTP server doesn't support that?

I tested SMTP and PHP mail and both worked without issues for me - if it's only SMTP having problems (We don't do anything special for SMTP than for the php mailer besides send it off to the SMTP server) then it has to be something with either the way they are sending it (Who knows if they changed something) or the SMTP server itself - can't really be more specific.

Could you verify that your SMTP server supports utf-8 encoding?

I just checked with our exchange people and they said the mail server we are sending this to does support utf-8 encoding.

Thank you