Now that I think of it, if the goal is just to have the alert send an email once, you probably just want to remove the REPEAT= part (not sure if there is a default for this), or optionally change it to something like REPEAT=1d. In that case, the DURATION isn't needed. On 3/14/07, Larry Barber <lebarber at gmail.com> wrote:
I think you have the inequality backwards on your DURATION clause, as it is written no alert will be issued for for alerts that are older than 3 minutes, probably should be DURATION>3, not DURATION<3.
Thanks, Larry Barber
On 3/14/07, cits.bogajewski at daimlerchrysler.com <cits.bogajewski at daimlerchrysler.com> wrote:
Hello,
thanks for ur reply.
gumby3203 at gmail.com schrieb am 13.03.2007 16:53:25:
it should be counting the time from when the alert changes status (so, green-to-yellow, yellow-to-red, etc)
thought so
Try using the bbcmd "hobbitd_alert" test below to see if it is working as intended. It can be used as below: /var/hobbit/server/bin/bbcmd hobbitd_alert --test <hostname> <host test>
works in principle as expected, although there is no possibility to reproduce my scenario using test utility
Also, you might want to consider using DURATION<3m (specifying "m" for minutes). I'm not sure what the default is, but I personally prefer to be explicit; makes reading it a little easier as well.
from man pages: "The duration is specified as a number, _optionally_ followed by 'm' (minutes, default), 'h' (hours) or 'd' (days)."
--debug output of hobbitd_alert looks like:
(initial alert yellow)
2007-03-13 14:38:58 hobbitd_alert: Got message 1139 @@page#1139|1173793138.770212|xx.xx.xx.xx|myhost|disk|xx.xx.xx.xx|1173794938|yellow|green|1173793138|pct|643201|||
2007-03-13 14:38:58 startpos 2590, fillpos 2590, endpos -1 2007-03-13 14:38:58 Got page message from myhost:disk 2007-03-13 14:38:58 Alert status changed from 0 to 1 2007-03-13 14:38:58 Found a first matching rule 2007-03-13 14:38:58 No more secondary matching rule 2007-03-13 14:38:58 1 alerts to go 2007-03-13 14:38:58 Found a first matching rule 2007-03-13 14:38:58 send_alert myhost:disk state 0 2007-03-13 14:38:58 No more secondary matching rule 2007-03-13 14:38:58 Want msg 1140, startpos 2590, fillpos 2590, endpos -1, usedbytes=0, bufleft=263649 2007-03-13 14:38:58 Found a first matching rule 2007-03-13 14:38:58 repeat myhost|disk|script|0123456789 at 0 2007-03-13 14:38:58 Alert for myhost:disk to 0123456789 2007-03-13 14:38:58 Opening file /opt/hobbit/server/etc/bb-hosts
(4min later red alert raises)
2007-03-13 14:42:49 hobbitd_alert: Got message 1223
@@page#1223|1173793369.998387|xx.xx.xx.xx|myhost|disk|xx.xx.xx.xx|1173795169|red|yellow|1173793369|pct|643201||| 2007-03-13 14:42:49 startpos 47243, fillpos 47243, endpos -1 2007-03-13 14:42:49 Got page message from myhost:disk 2007-03-13 14:42:49 Severity increased, cleared repeat interval: myhost/disk yellow->red 2007-03-13 14:42:49 Found no first matching rule 2007-03-13 14:42:49 Want msg 1224, startpos 47243, fillpos 47243, endpos
-1, usedbytes=0, bufleft=218996
so hm. i am not sure i got any lines of interest, but this looks not very helpfull.
Chears, Anatoli
Dear Hobbits,
is DURATION keyword within hobbit-alerts.cfg relates to the time
period
one test is in a special state, yellow or red, or more general the time period since non-green state occurs. In example, i want to get exact one notification at yellow state and one at red, but the following configuration does not work. I get notified on initial yellow alert, but not on red one occurring 4 min later.
HOST=myhost SERVICE=disk COLOR=yellow DURATION<3 SCRIPT $SSMSS $ABSMS REPEAT=5 RECOVERED
HOST=myhost SERVICE=disk COLOR=red DURATION<3 SCRIPT $SSMSS $ABSMS REPEAT=5 RECOVERED
Any ideas? Thanks :-)
Mit freundlichen Grüßen / Yours sincerely
Anatoli Bogajewski
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk