On 8/13/2015 10:33 AM, Shawn Heisey wrote:

It's starting to sound like I need to write a script so that no special characters are required. An ugly hack, but I think it will work ... so I will go ahead and do that.

Even when stripping CR characters, I was still getting attachments in "msgs" alarms, but only on alarms related to one machine, which happens to be the only one running Windows Server 2012. The really frustrating part: sometimes alarms related to that machine came through just fine, no attachment.

I finally figured out why. It's because Windows is trying to make event logs prettier. The problem event that I noticed is using the so-called 'smart' apostrophe. Here's part of what I see if I 'cat' one of those attachments on Linux:

=== This event is generated when a process attempts to log on an account by explicitly specifying that account<92>s credentials.

Notice the <92> ... this is hex character 92 (the curly apostrophe in the Windows-1252 character set), and because this character has the high bit set, /bin/mail decides that it can't use the input as the message body, and makes it an attachment.

I came up with a script to handle this situation, called with this line in xymonserver.cfg:

MAILC="/etc/xymon/stripxymonmail"

The contents of that script are below:

=== #!/bin/sh

TMPF=/bin/mktemp cat > ${TMPF} CHARSET=file --mime-encoding ${TMPF} | sed 's/.*: \(.*\)/\1/' [ "x${CHARSET}" == "xunknown-8bit" ] && CHARSET=cp1252 /usr/bin/iconv -f ${CHARSET} -t ASCII//TRANSLIT ${TMPF}
-o ${TMPF}.filter /bin/rm -f ${TMPF} cat ${TMPF}.filter | /usr/bin/tr -d '\001\004' | dos2unix
| /bin/mail "$@" /bin/rm -f ${TMPF}.filter

I don't yet know whether this is completely foolproof. It works if the content is already ascii, and I'm hoping it works if the content is UTF-8, but I haven't tested this yet. If anyone has ideas to make it more bulletproof, please share.

Thanks, Shawn