If you use an MTA which can forward mail via a pipe, then you can set up mailbox(s) to collect
emails and send them to your Zentinel/ZEP with this program.
Here is an example using the Courier MTA and Courier Maildrop (see dot-courier and maildrop
manpages in the courier-mta for further explanation), but it should work with many other
forwarders. There are further options - try /usr/bin/zenemailevent --help for more details.
In the $HOME of your mail user (zenoss@domain.com say), place the following (customised for your
setup) in the .courier and .courier-default files:
| /usr/bin/zenemailevent -u admin -p password -s http://zenoss.domain.com:8080
If you direct mail to zenoss@domain.com, it will be forwarded to your Zentinel with a default severity
of info. If you send to zenoss-critical@domain.com, it'll have a Critical severity.
The default event class is /Status/Update.
The component and the device are calculated from the Sender/From header as component@device. As
it is trivially easy to spoof these, you have considerable flexibility in assuring email events are
bound to their associated device(s).
A real-world configuration of Monit's email alerting is as simple as (in /etc/monitrc):
set mail-format
{ from: monit@mydevice.domain.com
subject: $SERVICE $EVENT
message: $ACTION: $DESCRIPTION }
set alert zenoss@domain.com # Send alert to system admin on any event
This will register Monit emails as info events on the /Device mydevice.domain.com. Note that because we've also removed $DATE markers from the message, monit events will roll-up.
|