[Rtir] But can it make coffee?

[julien at bestpractical.com]

   From: "Greg Kuhnert" <Greg.Kuhnert at comindico.com.au>
   Date: Wed, 9 Jul 2003 15:11:37 +1000

Hi Greg,

   I have been using RT for a while now, to handle abuse at comindico.com.au
   email tracking and incident resolution. I have dreamt for a long time
   about some of the functionality that you are talking about....

We're happy to oblige!

   1. Tickets are sent in to abuse at comindico.com.au or
   cert at comindico.com.au, and a ticket created. Most tickets are in the
   abuse queue at present. We are nearly up to ticket number 20,000 after
   running RT since April 12, 2002. Current volume is about 100-200 tickets
   a day.

In the RTIR model, new reports would appear in the "Incident Reports"
queue.  When you determine that it's a real issue (and not a mistake,
or some sort of confusion on the user's part, or spam, etc.), you
would create an Incident from the Incident Report.  Relevant
information from the report will be filled in, so if the user sent in
a good description of the problem, you won't need to cut & paste.

This incident will become the focal point for the issue.

If you receive multiple reports about the same issue, you can link all
of these reports to the same parent incident, to keep them together.

   2. For incidents that relate to our customers as "the bad guy", we need
   to search by IP address and date/time through radius logs to identify
   the guilty party.
   3. 99% of the time, the bad guy is not our direct customer... We usually
   forward these tickets to a downstream re-seller.
   4. The reseller does a reply to the ticket (back to the initial
   complainant) via RT, and then resolves the ticket leaving a comment
   detailing what action was taken.