Share This:

Events, events, events!

 

TrueSight is definitely used to manage events. Data and events are our focus. When discussing events, there are many different types of events, third party events, internal events, manually created events, and all these events come from various sources. One such source is email. There are many companies using TrueSight which are looking to turn email messages into events and send them along through TrueSight for handling. TrueSight and BPPM both offer the basic email2event functionality. The feature is fairly straightforward and despite some limitations, many users have been able to set it up in their TrueSight environment and use it successfully.

 

The setup is quick and easy! The troubleshooting, not so much, but if you do have issues, do not hesitate to reach out to Support for help!

Setting up unread email as an event in the operator console

The TrueSight Infrastructure Management Server connects to the email server periodically using the configured credentials to retrieve emails. These emails are then converted into events. The subject of the email received is updated in the Message (msg) slot of the event and the content of the email is updated in the Detailed Message (mc_long_msg) slot of the event.

Only an email in plain text format or HTML format can be set as an event. For email in HTML format, only the content is extracted and the tags are removed. If an email has both plain text and HTML formats, then the text of the content that appears first in the email is converted as an event.

 

The severity of the event is determined from the content of the email, if it has any of  the following keywords:

  • State: <severity>
  • Severity: <severity>
  • MINOR
  • MAJOR
  • CRITICAL
  • WARNING

 

Only emails that are in the configured folder of the email server are read. The following properties can be configured in the pronet.conf property file:

 

pronet.email2event.mailserver.fqdn=<email server>

pronet.email2event.mailserver.port=143

pronet.email2event.protocol=imap

pronet.email2event.mailserver.username=<user name>

pronet.email2event.mailserver.password=<encrypyted password>

pronet.email2event.mailserver.ssl.enabled=false

pronet.email2event.folder=inbox

pronet.email2event.delete.read.messages=true

pronet.email2event.mailbox.scan.frequency.mins=15

pronet.email2event.enabled=false

pronet.email2event.email.message.body.newline=false

pronet.email2event.default.severity=INFO

 

Where parameter descriptions:

  • pronet.email2event.enabled: Enable email2event feature by setting this value to true. By default, this value is set to false.
  • pronet.email2event.mailserver.port: Default port number is 143. If you want to enable SSL/TLS, change the port number accordingly.
  • pronet.email2event.folder: Create a folder in the email server and assign the folder name to this parameter. Configure rules in the email server to direct the unread emails to this folder. By default, this parameter is set to INBOX.
  • pronet.email2event.email.message.body.newline: Enable the email new line feature by setting this value to true. By default, this value is set to false. When set to false, the entire email message is displayed on the same line. When set to true, the displayed message resembles the email format.
  • pronet.email2event.mailbox.scan.frequency.mins: Specifies the frequency in minutes at which the Infrastructure Management Server scans the mail box. By default, the Infrastructure Management Server scans the mail box in every 15 minutes. Emails that are already read, or are in draft or deleted modes are not considered.
  • pronet.email2event.delete.read.messages: If you set this value to false, the emails that are already read by the server and marked as seen are not deleted from the email server. If you set this value to true, the emails that are already read by the server and marked as seen are deleted from the email server. By default, this value is set to true. All other Multipurpose Internet Mail Extensions (MIME) content such as attachments, images, and so on are ignored.
  • pronet.email2event.mailserver.ssl.enabled: If you set this value to true, the communication between email server to the Infrastructure Management server is in SSL/TLS mode. If you set this value to false, the communication between the email server to the Infrastructure Management server is in plain text mode. By default, this value is set to false.
  • pronet.email2event.imps.version: TLSv1 and 1.2 are supported. You must enable SSL property to set the TLS version property. When you enable the SSL to true, by default the TLS v1.0 is enabled. Using this property, you can set the version to 1.2. For example,pronet.email2event.imps.version=TLSv1.2.

 

Configuring an email as an event

You can configure an email as an event through the command line interface by running the  pw email2event command:

pw email2event

usage:

pw email2event [-y]|[-c]|[-s]|[-e]

The following parameters are available with the pw email2event command :

-y  Encrypts the mailbox password

-c  Configures email as event

-s  Starts scanning email as event

-e  Stops scanning email as event

 

Example

 

  1. Run the following command to encrypt your mail box password. This command will prompt you to enter the mail box password in plain text, and gives the encrypted password as the output.   $pw email2event -y Assign this encrypted password value to the pronet.email2event.mailserver.password property in the pronet.conf file.
  2. Open the pronet.conf file and configure the following properties:

     pronet.email2event.mailserver.fqdn=<f.e.webmail.bmc.com>

     pronet.email2event.mailserver.username=<username>

     pronet.email2event.mailserver.password=<encrypted password>

     pronet.email2event.delete.read.messages=false

     pronet.email2event.mailbox.scan.frequency.mins=5

           pronet.email2event.mailserver.ssl.enabled=true

     pronet.email2event.enabled=true

     pronet.email2event.email.message.body.newline=true

     3. Restart the server.
     $ pw sys start

 

This is one way of creating and handling events within TrueSight. Please note there are some limitations to this functionality. The hope is to grow the capabilities, so let us know your feedback regarding email2event functionality.

 

These are documented limitations:

 

  • A dedicated email account is required.
  • Only IMAP protocol is supported.
  • IMAP protocol is also supported over SSL or TLS.
  • There is no proxy support in connecting to the email server.
  • NTLM authentication is not supported.
  • The configured user account must have read and write permission for the configured folder.
  • Email servers with HTTP access are not supported.
  • The cell process must be running to create events.
  • Events that are created are assigned to priority 5.

 

We also have several Ideas posted to the Communities requesting new functionality within the email2event feature. Please visit the links below and vote up any Idea you feel is relevant to your TrueSight environment.

 

Request to allow email2event adapter to use a shared non-inbox setting

Request to add email2event functionality to allow multiple unique mailboxes to be used

Mechanism to ignore attachment in Email2Event integration

TrueSight to monitor email2Event integration status

Set up email as an event improvements

email2event EWS support (BPPM 9.6 FP2)

SSL or TLS and NTLM should be supported with POP and IMAP email integration adapters


The troubleshooting of email2event is a bit challenging because the connections to various mailservers have different rules, restrictions, etc.. which can cause any one of a number of communication issues. However, BMC does have several knowledge articles which are commonly used for troubleshooting email2event issues.

 

 

Authentication failed with Email2Event

Queries regarding Email2Event feature in TrueSight/ProactiveNet

Tips for Email2Event problems in BPPM

The command 'pw email2event -s' is failing with message 'Unable to decrypt the string'
When configuring TrueSight Infrastructure Management email2event functionality, how many unique mailbox configurations are allowed?

When setting up email2event functionality in TrueSight Infrastructure Management 10.x, 11.x,  is it possible to use a shared email account?

Does the TrueSight Infrastructure Management email2event feature support the use a shared inbox or shared non-inbox folder when managing events?

email2event events are of class MC_CELL_UNDEFINED_CLASS

Email2event feature in TSIM does not include newlines when processing emails in HTML format

Undefined keyword email2event when running pw email2event command

Email2Event stops working if there is an email with null (blank) subject

Email2Event stops working if there is an email in UTF-7 format

Using BPPM/TrueSight's email2event functionality with a Lotus Notes account via imap is failing with "authentication failed"

 

 

If you are seeing issues and need help, please collect the following basic details and open a case for Support

 

  1. Run 'pw email2event' and see if there are any errors (it should just display usage)
  2. Enable email2event debug based on the command below:

          pw debug on -p jserver -s Email2Event

       Enable cell trace as well:

         mcfgtrace -n cellname ALL ALL stderr

       Reproduce the issue and send the pw dump 1 output to Support

    3. Was email2event working beforehand, or whether a problem has just started happening. If it was recent, let Support know what has changed in the environment

    4. Verify that the email server uses POP or IMAP protocols. BPPM/TrueSight server will not communicate with other protocols (e.g. POP3 over SSL)

    5. Login to the POP3 server via telnet. E.g.:

         telnet <IP address> 110

 

        Then run these commands:

         USER <username>

     PASS <password>

 

        Then run:

           STAT

           LIST

 

What do you see?

   6. Confirm that the email password encryption matches pronet.conf's pronet.email2event.mailserver.password entry by running:

         pw email2event -y

 

AMIGO.jpg

 

TrueSight 11.3.02 is here!!!!!… REMINDER - 11.3.02 is a Service Pack Release which requires 11.3.01 to be installed. If you are not on 11.3 yet, be sure to plan to go to 11.3.01 first then apply the 11.3.02 Service Pack.

The BMC Assisted MIGration Offering, or AMIGO, is a program designed to assist our customers in planning and preparing for product upgrades from an older, to a newer supported version.  By engaging with BMC Technical Support Analysts, you will be provided with materials containing guidelines and best practices to aid in compiling your own upgrade plan. An upgrade expert will then review your plan, and offer advice and suggestions to ensure success through proper planning and testing.

The AMIGO program consists of a Starter Phase and a Review Phase.  Each phase is initiated by opening a support case, and ends when the case is closed.

In the Starter Phase, an AMIGO Starter case is opened.  Reference material will be provided and a call with a Technical Support Analyst will take place to discuss the details of your upgrade, and address any questions you may have.  The AMIGO Starter case will be closed, and the next step will be for you to prepare a documented upgrade plan.

In the Review Phase, an AMIGO Review case is opened preferably two weeks prior to a set upgrade date.  A call will be scheduled with an upgrade expert to review your detailed plan, providing feedback and recommendations, along with answers to any outstanding questions.  As needed, a follow up discussion with a Technical Support Analyst may take place for feedback after the upgrade is performed.

The AMIGO program includes:

» A “Question and Answer” session before you upgrade

» A review of your upgrade plan with Customer Support

» An upgrade checklist

» Helpful tips and tricks for upgrade success from previous customer upgrades

» A follow-up session with Customer Support to let them know how it went. This will help BMC to enhance the process.

 

To get started, please review the details here:

https://docs.bmc.com/docs/TSOperations/113/amigo-checklist-for-truesight-operations-management-814553031.html

 

Then open a BMC Support issue containing your environment information (product, version, OS, etc.) and the planned date of the installation, if known. We will contact you promptly, and work with you to ensure a successful and timely outcome.

 

 

 

Computer.png

 

New Knowledge Added this month:

 

000168894  BPPM 9.6 compatibility with RedHat Linux 7.6
000168753
How do the Oracle changes affect TrueSight?

000168568 Reducing memory consumption of TSIM by changing garbage collection settings

000168526 Are there any queries for TSPS to show the list of Agent tags and their devices?

000168519 Is there a query to list the TSIM devices and their associated tags?

000168417 API returns 500 internal error when sending a large size JSON package to TSIM on Linux

000168231 Can the Publish-Subscribe API send to another BPPM cell?

000168108 "Unable to copy the folders" seen when running "tssh dump export"

000168499 Error while installing TSIM 11.3.01 installation with non-root user

000168166 After a TSPS upgrade, the csr and idxsrv processes will not start