How to filter for email events

[Wayne Brantley]

Coming from ELMAH world, I want to be emailed exceptions from my MVC application.

(Realizing I might put these on a dashboard or something in the future, but the problem remains the same).

Rule 1)  I want to log everything to Seq.

I then want to use the email app to send exceptions via email - perfect, easy.

However, there are MANY exceptions I do not want emailed about.   Currently I have ELMAH not email those to me.

I see this being done with Seq in one of two ways

    1)  Filter these exceptions out at the application level so Seq never sees them.  This violates Rule 1 above.

    2)  Have the email view/query smart enough to filter these out so I do not get the email.

I like number 2, but this is impractical...the problem is writing this query with Seq would be a nightmare to have and maintain.  (Plus the space to enter the query is one line on the UI making anything complex tough)

Examples -I want to ignore the following:

Exception.BaseException is System.Security.Cryptography.CryptographicException and Message=="Padding is invalid and cannot be removed." and the path of the request is ~/webresource.axd.

So, that can be written in a query not too bad, but I have about 50 of these....common exceptions that happen running a public facing website, but do not matter.  Here is a snippet of code that would not be fun to do as a query.

            else if (e.Exception is HttpException)

            {

                if (string.IsNullOrWhiteSpace(e.Exception.Message))

                    e.Dismiss();

                else if (e.Exception.InnerException is System.Web.UI.ViewStateException)

                {

                    if (string.Compare("The client disconnected.", e.Exception.Message, StringComparison.OrdinalIgnoreCase) == 0)

                        e.Dismiss();

                    else if (string.Compare("Invalid viewstate.", e.Exception.Message.Left(18), StringComparison.OrdinalIgnoreCase) == 0)

                        e.Dismiss();

                    else if (string.Compare("Validation of viewstate MAC failed.", e.Exception.Message.Left(36), StringComparison.OrdinalIgnoreCase) == 0)

                        e.Dismiss();

                    else if (string.Compare("The state information is invalid for this page and might be corrupted.", e.Exception.Message.Left(77), StringComparison.OrdinalIgnoreCase) == 0)

                        e.Dismiss();

                    else

                        Elmah.ErrorSignal.FromCurrentContext().Raise(new Exception(string.Format("Error Filter failed to match msg:[{0}]\n", e.Exception.Message), e.Exception));

                }

                else if (string.Compare("Invalid viewstate.", e.Exception.Message, StringComparison.OrdinalIgnoreCase) == 0)

                    e.Dismiss();

                else if (string.Compare("This is an invalid webresource request.", e.Exception.Message, StringComparison.OrdinalIgnoreCase) == 0)

                    e.Dismiss();

                else if (string.Compare("The remote host closed the connection. The error code is 0x80070057.", e.Exception.Message, StringComparison.OrdinalIgnoreCase) == 0)

                    e.Dismiss();

                else if (string.Compare("The length of the query string for this request exceeds the configured maxQueryStringLength value.", e.Exception.Message, StringComparison.OrdinalIgnoreCase) == 0)

                    e.Dismiss();

                else if (Regex.IsMatch(e.Exception.Message, "The controller for path '/[^']+' was not found or does not implement IController.")) 

                    e.Dismiss();

                else if (Regex.IsMatch(e.Exception.Message, "A public action method '[^']+' was not found on controller '[^']+'."))  

                    e.Dismiss();

                else if (Regex.IsMatch(e.Exception.Message, "The file '[^']+' does not exist.")) 

                    e.Dismiss();

                else if (Regex.IsMatch(e.Exception.Message, "Path '[^']+' was not found.")) 

                    e.Dismiss();

                else if (Regex.IsMatch(e.Exception.Message, @"A potentially dangerous Request.Path value was detected from the client \([^\)]+\).")) 

                    e.Dismiss();

            }

For now, I may just violate Rule 1 and filter these on the client so I do not get tons of emails....but it makes more sense to let Seq do it - I can measure attacks, etc.

So what are the thoughts around this?   

[nblum...@nblumhardt.com]

Writing a custom app for this (possibly even building it into the email app mentioned in the other thread) is the way to go here. There are some limitations to manipulating the events on the server (e.g. Seq won't let you use the app's internal logic for interactive querying) but to meet the goal of knocking out email noise it should work well.

Hope this helps,

Nick

[Wayne Brantley]

I fear this is a really common scenario.  Needing to create filters for what is emailed, etc.   No reason I could not create all the above in a query of some kind - as I can create each one individually.  Need a better answer here - just saying!  :-)