Hi,
at my company we manage alert filtering with an homebrew tool. One of its features is that it sends alerts on the second identical message received (anti up/down/up feature). It is somewhat equivalent to the DURATION keyword, with the difference it's not time-based, but count-based.
The "repeat" feature of hobbitd_alert defeats this mecanism, because it resends an alert every 5 minutes. The problem arises when a specific status reports every 5 minute and a few seconds :
02:00:00 the db1 host sends "db1.sql red" 02:00:01 hobbitd_alerts sends "db1.sql red" to my external filter 02:00:02 my external filter queues the alert until a second one comes 02:05:00 hobbitd_alerts sends "db1.sql red" to my external filter 02:05:01 my external filter pages "db1.sql red" to the crew 02:05:04 the db1 host sends "db1.sql green" 02:05:05 hobbitd_alerts sends "db1.sql green" to my external filter 02:05:06 my external filter pages "db1.sql recovered" to the now awakened crew
My question is : is there a way to tell hobbit not to repeat alerts, but to send alerts only upon reception of a status from a client ?
If not, I believe the "security code" is the same whenever an alert gets repeated, so I'll have to modify my filter to check for that. (or maybe write a real stripped down equivalent of hobbitd_alert that only relays incoming statuses to my filter).
-- Charles Goyard - charles.goyard at orange-ftgroup.com - (+33) 1 45 38 01 31 Orange Business Services - online multimedia // ingénierie