Hello list! We're using OTRS with ITSM and we're using the SystemMonitoring Package to update the Incident State of CI's based on Nagios mails we get. That means, as soon as Nagios sends a mail with a host/service down notification, we mark the System as having an Incident, which in it's turn helps our Service desk a lot, and provides us with a list of tickets linked to the CI, which is very useful when searching for problems. We're also using another tool called OSSEC, which monitors servers for certain entries in log files and looks for configuration changes. As soon as something is found, it sends a mail out, which we capture in OTRS again. Now it would be very nice to have these messages processed just like the Nagios messages are processed: they should be attached to the CI. Doing so, poses me with two problems: 1. I cannot get regexps to react to work both for Nagios and OSSEC notifications. So, I would either need extra config entries or have the SystemMontoring Plugin installed a second time 2. The ticket is attached to the CI as soon as a second mail from Nagios comes in. With OSSEC, there is no second mail coming, so I would need it to be attached on the first mail already (this would also be very convenient for the Nagios messages). Any chance that someone is able to help me? Thanks in advance, Arthur