Re: Incident tracking database

From: Chris Adams <chris(at)improbable.org>
Date: Fri Dec 06 2002 - 01:24:25 EST

On Wednesday, December 4, 2002, at 06:15 PM, Russell Fulton wrote:
> The features are:

You might want to look at RT (http://www.bestpractical.com/) - it has a public Perl API which we've used for all sorts of management functions (e.g. I've written simple scripts to do things like email admins with their open / stalled tickets or modify certain tickets to fit a couple odd wrinkles in our environment). The system uses per-queue templates and allows you to fire off certain actions on various events so you can frequently do everything with the web-interface. The system is designed to be extended and it's pretty hackable - it didn't take very long to add the code to authenticate local users against our NIS server (remote users still get the default password in RT's database).

While you can put tickets in using perl we almost always use the web interface or email for that. The wrinkle we have is a perl script which I wrote which takes inbound mail, determines whether it's from a user with an account on our system and if so routes it into the queue for their lab instead of the general helpdesk queue. It'd be pretty easy to modify this to do things like your whois mentions - I'd have it toss the message in and automatically add a comment (which only admins see) containing the extra data - in addition to preserving the original message intact, this would allow lengthy stuff to be done asynchronously if you have some complex processing to do.

Chris

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Dec 8 22:20:47 2002