On 3/14/2015 5:35 PM, J.C. Cleaver wrote:
That would help, however it would also cause items that had gotten URL-encoded to potentially be missed in analysis.d LOG regex's (which don't URL-unencode).
Given that this is a display issue more than anything else, it might be better handled as we're creating the status message from xymond_client. This leaves the raw log message still available, while still protecting the display from getting interpreted this way.
Yes, this should definitely be a display-only conversion. The logs should be unchanged from what the client sends when they are being analyzed for potential alarms.
That is a perfect segue into another problem I noticed. The first character on all my log lines for this logfile is [, a left square bracket. That is being replaced with a . (period) character. In the email alarm, every line starts like this:
&red .2015-03-13 23:16:43.386125]
As expected, on the web page, the red indicator icon replaces &red.
Thanks, Shawn