How to handle out of office email loops in the helpdesk (4311497)

Because the K1000 appliance handles email from any valid user it is susceptible to floods of email from those valid users. The most common scenario is when someone is out of the office and sets up an auto-responder to emails while they are away. The customer also has email events or ticket-rules that send emails set up that will respond to emails into the K1000 appliance. Since the K1000 has no way of knowing what a response is all about so it will accept these emails. If the subject is modified to remove the "[TICK:1234]" prefix then these emails will be treated as new tickets.

Here is the algorithm of what typically happens:

1. Ticket is updated
2. Submitter of ticket gets notified by email of the update
3. Out of Office responder replies to the K1000's update notification, modifying the subject to "out of the office notification"
4. K1000 accepts the email and open's it for the submitter as a new ticket
5. Submitter gets emailed a confirmation about the new ticket.
6. Back to step 3

CODE WRITTEN BY KACE SUPPORT FOR DEMONSTRATION PURPOSES ONLY AND NOT SUPPORTED BY KACE TECHNICAL SUPPORT.   CLIENT CONFIRMS THE NEED FOR TESTING AND ACCEPTS ALL RESPONSIBILITY FOR USE  AND MISUSE OF CODE. KACE SHALL NOT BE HELD LIABLE FOR DAMAGE OR DOWN TIME RESULTING  FROM USE OF THIS OR ANY CODE PRESENTED FOR PURPOSES OF TROUBLESHOOTING OR DEMONSTRATION.

1.1                        What you can do about it

There are three things that you can do about it in K1000 appliance version 4.0 and newer.

1. Any email program worth its salt should have a way to configure the out-of-office notification such that it only responds to a given recipient once. This prevents the loops.
2. Turn off all email-based events inside your K1000 appliance -- this has the unfortunate side effect of other notifications being squelched.
3. Create a ticket rule to modify the offending user's email address so that they do not receive any email.

1.1.1                  Option 3: Create a ticket rule to modify the offending user's email address so that they do not receive any email

  Note: This option only works if you also disable the checkbox “Accept email from unknown users (via Helpdesk-->Configuration [Choose a queue])”

The ticket rule would basically detect how many emails have come in from a particular user within a given time frame. It would do this with a query. The following query will detect any user that has sent more than 15 emails within a 15 minute time-frame. If you want to change these values then note the two places in the query where you would like to change it. This query also exempts ticket owners (i.e helpdesk admins) from being subject to this. This rule assumes that your ticket owners are in a label called "hdowners_1"

SELECT COMMON.USER_ID ID, 

USER.EMAIL BAD_EMAIL 

from 

(

   select count(ID) CT ,HD_TICKET_ID,USER_ID from HD_TICKET_CHANGE

   WHERE 

   TIMESTAMP> DATE_SUB(NOW(), INTERVAL 15 MINUTE) and /*time interval*/

   USER_ID

   USER_ID NOT IN (select USER.ID FROM USER,USER_LABEL_JT,LABEL WHERE

     USER.ID=USER_LABEL_JT.USER_ID and

     USER_LABEL_JT.LABEL_ID=LABEL.ID and

     (LABEL.ID IN (-1) OR LABEL.NAME LIKE 

     'hdowners_%' /*exempt the ticket admins*/

     OR USER.ID =0

     ) 

   )

   GROUP BY USER_ID

) COMMON, USER

WHERE

COMMON.USER_ID=USER.ID and

USER.EMAIL NOT LIKE '%\_donotmail' and /*do not process a user more than once*/

CT>15 /*number of entries in any ticket*/

Your rule will also require an update to modify the email address of the offending user. The update will look like this:

UPDATE USER SET EMAIL=CONCAT(EMAIL,'_donotemail') WHERE USER.ID IN ()

Lastly, your rule should contain one last email to the offender to notify them that you have turned off email notification for them from the helpdesk. You can do this by setting the "send an email for each result row to" to have the Email Column as "BAD_EMAIL" and fill out the subject and email body to whatever you desire. I suggest something like this:

It was detected that an email coming from your account ($bad_email) was sending the K1000 appliance too many emails.  Your email address within the K1000 has been modified such that you will no longer receive emails. If you would like to rectify this please contact the helpdesk by phone.

Regards, 

Your Company Helpdesk

Lastly, make sure that your rule frequency is set to 15 minutes.