Vernon,
My guess would be the "COLOR=red" token in the rule. When a recovery comes in the color isn't red, therefore no match.
Regards, Jim
----- Message from "Vernon Everett" <v.everett at afgonline.com.au> on Fri, 13 Jan 2006 18:55:30 +0800 ----- To: <hobbit at hswn.dk> Subject: Hobbit Alert config Hi all
Can anybody tell me if there is a specific order required for the entries in hobbit-alert.cfg? For instance, this line MAIL 55512345 at messagenet.com.au FORMAT=SMS REPEAT=180 DURATION>5 COLOR=red RECOVERED alerts me to the issue, but I don't get a recovered SMS.
I know Hobbit is configured correctly, because this line MAIL v.everett at afgonline.com.au RECOVERED REPEAT=480 mails me the recovered notice.
Cheers Vernon
Jim Horwath SANS Certified: GCUX, GCIH, GCIA, GHTQ, GREM Unix Admin JamesHorwath at glic.com (W) 610-807-8795 (C) 610-533-6972 (F) 610-807-6003
This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.