Module: check_mk Branch: master Commit: 00396545f0eb7a95d178266f91e33ee2bf5908bb URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=00396545f0eb7a… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Aug 30 16:05:04 2017 +0200 5057 FIX Fixed cancelling events by "syslog application" when using similar rules When using two or more rules that both have a "match syslog application" condition and a "syslog application to cancel event" condition while all other conditions are equal, it could happen that the first rule always caught messages that should not be caught by that rule. These messages were not handled by the second rule as expected. Change-Id: Icdb5a02711ad43e411f89820c8bc3dc4d91087fd --- .werks/5057 | 13 +++++++++++++ bin/mkeventd | 23 +++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/.werks/5057 b/.werks/5057 new file mode 100644 index 0000000..bd1c867 --- /dev/null +++ b/.werks/5057 @@ -0,0 +1,13 @@ +Title: Fixed cancelling events by "syslog application" when using similar rules +Level: 1 +Component: ec +Compatible: compat +Edition: cre +Version: 1.5.0i1 +Date: 1504101697 +Class: fix + +When using two or more rules that both have a "match syslog application" condition and a +"syslog application to cancel event" condition while all other conditions are equal, it +could happen that the first rule always caught messages that should not be caught by that +rule. These messages were not handled by the second rule as expected. diff --git a/bin/mkeventd b/bin/mkeventd index 2467f42..61e0f5e 100755 --- a/bin/mkeventd +++ b/bin/mkeventd @@ -2459,11 +2459,21 @@ class EventServer(object): self.logger.info(" did not match because of wrong source IP address '%s' (need '%s')" % (event["ipaddress"], rule.get("match_ipaddress"))) return False + cancel_by_application = False + if "cancel_application" in rule: + cancel_by_application = match(rule.get("cancel_application"), + event["application"], + complete=False) != False + if match(rule.get("match_application"), event["application"], complete=False) == False \ - and "cancel_application" not in rule: + and not cancel_by_application: if debug: - self.logger.info(" did not match because of wrong application '%s' (need '%s')" % - (event["application"], pattern(rule.get("match_application")))) + need_msg = "need %r" % pattern(rule.get("match_application")) + if "cancel_application" in rule: + need_msg += " or %r for cancelling" % pattern(rule.get("cancel_application")) + + self.logger.info(" did not match because of wrong application '%s' (%s)" % + (event["application"], need_msg)) return False if "match_facility" in rule and event["facility"] != rule["match_facility"]: @@ -2483,13 +2493,6 @@ class EventServer(object): else: cp = True - if "cancel_application" in rule: - cancel_by_application = match(rule.get("cancel_application"), - event["application"], - complete=False) != False - else: - cancel_by_application = True - match_groups = match(rule.get("match_ok", ""), event["text"], complete = False) if match_groups != False and cp and cancel_by_application: if debug: