# rules to handle printer errors from lprng
#
# One set of rules uses timing and additonal log messages to
# differentiate between paper jam, paper out and other printer offline
# and suppresses a door ajar error that would result from reapiring a
# paper jam.

## standard preamble
type= single
continue= dontcont
ptype= nsubstr
pattern= printer:
desc= Eliminate events that aren't processed by this ruleset.
action= none

type= single
continue= dontcont
ptype= tvalue
pattern= TRUE
desc= See if other ruleset has processed this event
action= none
context= [EVENT_PROCESSED]

type= single
continue= takenext
ptype= tvalue
pattern= TRUE
desc= Stop other rulesets from processing this event
action= create EVENT_PROCESSED

#####
#
# This rule generates an event if the cover/door is open
# unexpectedly.
# Delete printer offline message context since its redundant
#   when this report occurs.
# Example input:
# May  7 12:19:58 lj2.example.com  printer: cover/door open
#
type = single
desc = report printer cover open on $1
ptype = regexp
pattern = ([\w._-]+)  printer: cover/door open
context = ! expecting_cover_open_$1
action = delete Report_Printer_$1_Offline; \
         shellcmd /usr/bin/mailx -s \
            "check printer $1, cover/door open unexpectedly" admin

# clear the pending cover open since it is open.
#   Could change this to a set to have context expire in a say 5 minute
# window allowing multiple door open/close cycles as claering all
# paper jams from some machines requires an iterative process.
type = single
desc = report printer cover open on $1
ptype = regexp
pattern = ([\w._-]+)  printer: cover/door open
action = delete expecting_cover_open_$1

## differentiate between error types when the printer is offline:
## we have three cases to differentiate.
## all three start with the error:
##       printer: offline or intervention needed
## Case 1: no followup line telling what's wrong
## Case 2: paper jam
## Case 3: paper out

## in all cases we use a deferred error reporting mechanism triggered
## by a synthesized event that arrives after 10 seconds. The report
## is done only if the Report_Printer_$1_Offline still exists when the
## event is delivered. The Report_Printer_$1_Offline is deleted if we
## detect a specific error of paper out or paper jam.

######
# detect a paper jam failure
#
# We expect to have the case opened, so we will set the
# expecting_cover_open_$1 context.
#
# Example input:
#  May  7 12:19:50 lj2.example.com  printer: offline or intervention needed
#  May  7 12:19:50 lj2.example.com  printer: paper jam
#
type=pair
desc=detect paper jam on $1
continue=takenext
ptype=regexp
pattern=([\w._-]+)  printer: offline or intervention needed
action= event 10 $1: printer: Report Printer Offline if needed; \
        create Report_Printer_$1_Offline
desc2=confirm paper jam $1
ptype2=substr
pattern2=$1  printer: paper jam
action2= delete Report_Printer_$1_Offline; \
	 create expecting_cover_open_$1 ; \
         shellcmd /usr/bin/mailx -s \
            "Paper jam for printer $1" admin
window=5

######
# detect a paper out failure
#
# Example input:
#  May  7 12:17:24 lj2.example.com  printer: offline or intervention needed
#  May  7 16:17:24 lj2.example.com  printer: paper out
#
# Some devices complete this sequence with the following ignorable event:
#  Apr 28 12:15:16 lj0.example.com  printer: paper problem
# Report it only if we don't have a paper out condition pending.


# previous handling of this log message just deleted it.
#type=suppress
#desc=ignore non-specific paper problem report
#ptype=substr
#pattern=.  printer: paper problem


# if we detect paper out, don't report problem, email problem
# create paper out pending context to allow suppression of clear
# message.
type=pair
desc=detect paper out on $1
continue=dontcont
ptype=regexp
pattern=([\w._-]+)  printer: offline or intervention needed
action= event 10 $1: printer: Report Printer Offline if needed; \
        create Report_Printer_$1_Offline
desc2=confirm paper out $1
ptype2=substr
pattern2=$1  printer: paper out
action2= delete Report_Printer_$1_Offline; \
         create paper_out_condition_pending 1800; \
         shellcmd /usr/bin/mailx -s \
            "printer $1 paper out" admin
window=5

# Report printer offline due to unknown cause
type=single
desc = Report Printer Offline if needed
ptype=regexp
pattern=^([\w._-]+): printer: Report Printer Offline if needed
context = Report_Printer_$1_Offline
action =  shellcmd /usr/bin/mailx -s \
            "printer $1 offline, unknown cause" admin; \
         delete Report_Printer_$1_Offline

type=suppress
desc=ignore generated event
ptype=regexp
pattern=^([\w._-]+): printer: Report Printer Offline if needed

# If we get here, we must not have handled the event.
type= single
continue= dontcont
ptype= tvalue
pattern= TRUE
desc= unset EVENT_PROCESSED
action= delete EVENT_PROCESSED

# publish