Ingestion of Alerts via Email

Kevin Ford

Recommended Posts

  • LogicMonitor Staff

There have been a few different variations of EventSources for ingesting alerts via email over the years. I recently had need for some additional functionality, such as dynamic property replacement in the subject line, so created a new variation that I'm sharing here in case it's useful to others.

At its most basic, the EventSource checks an IMAP inbox for unseen messages that have specific text in the subject line. If a match is found, it captures the body of the email in a new alert associated to the host/resource in LogicMonitor where the properties are defined. By default, processed emails are marked as read but can optionally be flagged for deletion.

Because the EventSource supports dynamic replacement of a property value in the subject line, it allows the potential of having the module associate to multiple LogicMonitor resources and alert based on matching hostnames in incoming email subjects. For example, if you have the 'email.subject' property set to "Email Alert on ##system.hostname##" and an email is received with the subject line "Email Alert on host1", it would appear as an alert on the 'host1' resource in LogicMonitor.

LM Exchange locator code: AHDXND


Required properties:

  • The address of the IMAP server.
  • email.user: Username the module will to login & check for new emails.
  • email.pass: Password for the email user.

Optional properties:

  • email.subject: The email subject to search for. This can include a property name (example: "##system.hostname##") for dynamic replacement. Default: "Email Alert".
  • imap.type: IMAP security type (SSL or TLS).
  • email.deleteProcessed: Whether to attempt to delete processed email (versus just marking them as read). Default: false. NOTE: auto-deleting processed email may not work on Gmail due to Google's non-standard handling of IMAP.
  • email.folder: Inbox sub-folder to monitor (example: "Inbox/Errors"). Default: "Inbox".


Below is an example email regarding a specific host...


This is how the resulting alert displays on that host in LogicMonitor...


Edited by Kevin Ford
  • Like 3
Link to comment
Share on other sites

  • 7 months later...

Dear Kevin

Thanks do much for your contribution, this seems very useful, I added this module to our LM account, but I am having an issue and I hope you can help here.

I created a test email account on hotmail (also tried a shared mailbox on the tenant) and added these properties to one of ouur devices

- email.user:
- email.pass: Password for the email

After that I did test sending emails to that address but the alrerts didn´t show up- Also if I test the EventSource Script it tells me this:

"There would not be script events for the selected device"

Could you guide me on what else I can do for this to work?

Thanks so much

Email ingest message.PNG

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.