Inbound Mail hash errors: "^M" in cleaner.log

[gdksc]

Greetings...

I'm receiving hash errors on Inbound Mail (e.g. ack, down).

Assumption is that these errors are related to the hash being broken into multiple lines (e.g. "^M" found in the cleaner.log).

Example:

Code: Select all

-----^M
^M
To reply, keep the following data in your response email.^M
^M
##OTViMDcxY2VkYjUyMDZiZDhTNWFuSmNpLzVablVwR2lGd0NFUzVsMzlZRUVjK3pxcDNSS3lkO=^M
DlaWThRY0VWMTUybFhXR2VQZ1BBUStveklHOURXcllNeUUzeFZFNHFGazAvQ1dnPT0=3D##^M
Error - Could not find a host object in the hash provided

The version of Nagios XI is 5.7.2, running on RHEL 7.8.

Inbound mail must connect to MS Exchange mailbox via IMAP.

Changing reply emails to be plain text does not seem to resolve issue.

Previous posts regarding this issue reference line 559 from xicore.inc.php:

Code: Select all

$hash = trim(str_replace(array('> ', '>', '=', "\n", "\t", "\r"), '', substr($email['body'], $start + 2, $end - $start - 2)));

However, "^M" continue to arrive.

Looking for guidance, regarding any additional methods for stripping the "^M".

Thanks.

[benjaminsmith]

Hi @gdksc,

I'm going to reach out to our development team on this one as it could be a bug reading the lines correctly.

Also, it's helpful to have a system profile as well, can you send this in a private message when you have a chance. Thanks, Benjamin

To send us your system profile.
Login to the Nagios XI GUI using a web browser.
Click the "Admin" > "System Profile" Menu
Click the "Download Profile" button
Save the profile.zip file and share in a private message or upload it to the post/ticket, and then reply to this post to bring it up in the queue.

[gdksc]

Hi, @benjaminsmith,

I sent profile.zip via PM.

Thanks for your help.

[gdksc]

Hi, @benjaminsmith. Today, I tested Inbound Mail ack on two alerts, "Memory Usage is WARNING" and "Host is DOWN".

For the "Memory Usage is WARNING" alert, I received the "Nagios XI - Response Error" email, regarding the hash.

For the "Host is DOWN" alert, I received the "ACKNOWLEDGEMENT" email, so that Inbound Mail processed successfully.

In comparing the emails, the length of the hash data lines are different.

For the unsuccessfully processed "Memory Usage is WARNING" alert, the hash data line appears to be 144 characters in total.

Example:

Code: Select all

##NjRjNzU2MTY2ZTcwNDU3YjNuSXdPbllWRGdiM1R4YlY5U3ZLb0dWdGZHVlpHeXIwK3NHcEVyc2x5VlFhWStsQ3pnd1hoQVh5d24yUlNIVXBKbWpWclUvZXA3eXVSU3FJR2FETVBRPT0=##

For the successfully processed "Host is DOWN" alert, the hash data line appears to be 84 characters in total.

Example:

Code: Select all

##NDUyYTQ0MDcwZmE3MDE0ODhCRUE4MG5YSkNWSXdZS3RxTS9FMHIxRXVSWktOTFM2VkhhVE8vbzlkanM9##

In my MS Outlook client, I have the option to adjust the value for automatically wrapping text, but my upper limit appears to be 132 characters.

By chance, is there a way to adjust or limit the number of characters that can be used for hash data?

Thanks.

[benjaminsmith]

Hi,

Thanks for the update, some good information. Would you be able to try and test this from another mail client? I just want to determine if it's a mail client issue or not.

Also, the \r in the line below should strip the hash data of the carriage return, but it's worth trying to add ^M or \x0D to the line and see if this character is removed then. Let me know if that resolves the issue or not. Benjamin

Code: Select all

$hash = trim(str_replace(array('> ', '>', '=', "\n", "\t", "\r"), '', substr($email['body'], $start + 2, $end - $start - 2)));

Reference:
PHP Removing Windows ^M Character

[gdksc]

Hi, @benjaminsmith.

I tested with the ^M and \x0D added to xicore.inc.php, but no luck yet.

I was successful with a different mail client (thunderbird), but only on a desktop on the corporate network. When I attempted from various external clients (e.g. thunderbird, gmail, apple), but no luck. As this is appearing to be unique to my client environment, any additional ideas for debugging are certainly appreciated..

One follow-up question, regarding xicore.inc.php and cleaner.log.

As noted, for the mails that fail, I typically see the ^M breaking the hash. On one of the external mail clients, it sends the ">" in replies, and I'm seeing "> " in cleaner.log, along with ^M.

Is that to be expected?

Example:

Code: Select all

> -----^M
>=20^M
> To reply, keep the following data in your response email.^M
>=20^M
> ##ZGE4OWRiODU0MjQzYjMyYXJjNVhCcmc0R29WUGxpcHBVMWZUeTE0NlpwMHo1NEhWZ0VTQ0p=^M
XWG9JbWVkcEdBRU5FTmhmcEluTEkxSHYzY2pHeFpZN25sVURQelkxU3I5amZEWnFRPT0=3D##^M

[benjaminsmith]

Hi @gdksc,

At this point, after some internally testing, I believe this is likely a bug, and we're in the process of reviewing it right now.

I should have more information regarding a patch or workaround in the next few days.

Thanks for bringing this to our attention.

Benjamin

[gdksc]

Hi, @benjaminsmith.

Thanks for the update.

[benjaminsmith]

Hi,

No problem.

[benjaminsmith]

Hi,

I have an update on this issue, we've been able to repeat this here with Outlook and a bug report has been filed. It's a formatting issue of some kind and we should have this accounted for in the next maintenance release of Nagios XI.