Hi Mike,
On Mon, Jun 19, 2006 at 11:55:53AM +0100, Mike Rowell wrote:
So what you're saying is that when you have a TIME blackout window for a service, even if the last rule for that service has STOP after it, the alerts continue until it finds a rule it can send with?
Yes.
That if it is what you are saying is not something I would be expecting.
OK, let me try and explain why that is. From your other email I gather your alert configuration (lines 134-139) is like this:
HOST=* MAIL=sysalert SERVICE=aq FORMAT=PLAIN REPEAT=1h COLOR=yellow MAIL=support SERVICE=aq COLOR=RED FORMAT=SMS DURATION>5 REPEAT=1h TIME=W:0900:1700 STOP MAIL=systems at some.domain COLOR=red,yellow REPEAT=1h FORMAT=PLAIN MAIL=support-rightmove at some.domain COLOR=RED FORMAT=SMS DURATION>5 REPEAT=1h
The STOP keyword means (from the man-page): "STOP Stop looking for more recipients after this one matches." So STOP only applies for rules that are positively matched (ie. they did result in an alert being sent).
If STOP meant "after seeing this rule, whether it matched or not, stop looking for any more recipients" - then your two last lines (the "catch-all" rules) would never trigger because there's a STOP rule in front of them. And that is not what you would expect either.
I *think* that what you want is to have "sysalert" and "support" alerted on weekdays, and the "systems at ..." and "support-rightmove at ..." alerted outside this time window. May I suggest
TIME=W:0900:1700 SERVICE=aq MAIL=sysalert COLOR=yellow FORMAT=PLAIN REPEAT=1h MAIL=support COLOR=red FORMAT=SMS DURATION>5 REPEAT=1h
EXTIME=W:0900:1700 MAIL=systems at some.domain COLOR=red,yellow REPEAT=1h FORMAT=PLAIN MAIL=support-rightmove at some.domain COLOR=red FORMAT=SMS DURATION>5 REPEAT=1h
Regards, Henrik