One problem that NimSoft suffers from is that the default messages are just too verbose for SMS based alerting.
In the url_response probe, we would like to change the default message that is displayed when a content check fails. The default configuration for this message is as follows.
<ContainsUnexpected>text = URL content for '$profile' contains the unexpected text '$string'level = majorsubsystem = 1.1.14token = contains_unexpectedvariables = profile stringi18n_token = as#network.url_response.contains_unexpected</ContainsUnexpected>
We then have inserted our own custom message into the configuration file, and set it as the default.
<CustomContainsUnexpected>text = URL content check FAILED - $urllevel = criticalsubsystem = 4.5token = contains_unexpectedvariables = profile string urli18n_token =</CustomContainsUnexpected>
Unfortunately, what we always get is the default string. Each profile has a list of custom messages, and we've successfully tailored some of those.
dns_resolution_time_message =download_time_message = CustomTimeLimitfirst_bytefetch_time_message =last_bytefetch_time_message =redirect_time_message =tcp_connect_time_message =cert_expired_message = CustomCertExpiredcert_to_expire_message = CustomDaysToCertExpire
However, by default, there does not seem to be anything in the configuration file to suggest that you can set a custom contains_unexpected message. When I do a strings of url_response and search for "_message", I find the following:
That last one doesn't seem to be a configuration item though, as I've added the following to each profile and still we get the default message.
unexpected_message = CustomContainsUnexpected
Has anyone seen this behavior before, and perhaps done this without having to write some LUA to change the content of the when it arrives?
When I look at the alarm overrides for a profile in the url_response GUI, I see options there for choosing different messages for both "Page does not contain expected text" and "Page contains text which should not be there". Have you tried setting the latter to your custom message? Screenshot attached.
If you want your custom message to be the default, why don't you just change the text option in the ContainsUnexpected message rather than creating a whole new message definition? It seems like that would be simpler because you would not have to configure an alarm override for every profile.
I've tried both. It appears as though certain messages are hard coded. I've logged a case and am awaiting further investigation by NimSoft.