On Tue, April 5, 2016 8:08 pm, Scot Kreienkamp wrote:
I ran the dump and grep'd for the server name. Here are the matching lines:
PORT local=%([.:]80)$ min=1 color=red TRACK=WWW HOST=innocent2.in.hq,innocent.in.hq TEXT=80-WWW (line: 468) PORT local=%([.:]55000)$ min=0 color=red TRACK=RPC_Clients HOST=innocent2.in.hq,innocent.in.hq TEXT=55000-RPC Client Access Sessions (line: 469) SVC MSExchangeADTopology status=started color=red HOST=innocent2.in.hq,innocent.in.hq (line: 470) SVC MSExchangeIS status=started color=red HOST=innocent2.in.hq,innocent.in.hq (line: 471) SVC MSExchangeMailboxAssistants status=started color=red HOST=innocent2.in.hq,innocent.in.hq (line: 472) SVC MSExchangeRPC status=started color=red HOST=innocent2.in.hq,innocent.in.hq (line: 473) SVC MSExchangeSA status=started color=red HOST=innocent2.in.hq,innocent.in.hq (line: 474) DISK * 15728640U 10485760U 0 -1 red HOST=innocent2.in.hq,innocent.in.hq (line: 475) DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=innocent2.in.hq,innocent.in.hq (line: 482)
It appears to be understanding the config correctly, but it's still alerting on the percentage: M (96% used) has reached the PANIC level (95%) Filesystem 1K-blocks Used Avail Capacity Mounted Label Summary(Total\Avail GB) M 2115137532 2032580452 82557080 96% /FIXED/M:
Ret_Mail 2017.15\78.73
It still might be part of the DEFAULT entry, though. Is the "host" entry listed literally as:
HOST=innocent2.in.hq,innocent.in.hq
...in the config? IIRC, that needs to be a regex. Comma-separated is only used when specifying colors (which aren't evaluated textually).
HTH, -jc