Hi, We are seeing unusual alerting behaviour with Xymon 4.3.21 server using a "holidays.cfg" with HOLIDAYLIKEWEEKDAY=0.
We have a network operations team (uqnoc-sms) that gets alerts during business hours (TIME=W:0800:1700) And a data networks team (dn-sms) that get out of business hours alerts in certain windows (TIME=W:0600:0759,W:1701:2200,60:0600:2200)
Rules are like:
PAGE=$UNSMSREGEX EXHOST=$UNEXCLUDE MAIL uqnoc-sms at xx.yy.edu.au SERVICE=$UNSMSSVCS DURATION>6m TIME=W:0800:1700 COLOR=red REPEAT=1w FORMAT=SMS RECOVERED MAIL dn-sms at xx.yy.edu.au SERVICE=$UNSMSSVCS DURATION>6m TIME=W:0600:0759,W:1701:2200,60:0600:2200 COLOR=red REPEAT=1w FORMAT=SMS RECOVERED
For a "red" conn test covered by the rule on a weekday public holiday, it seems to correctly identify not to send an alert to "uqnoc-sms" (TIME=W:0800:1700 ) and instead correctly generates an alert to "dn-sms" (TIME=60:0600:2200 component), but then keeps sending the same alert approximately every minute (my xymonnet poll cycle). Ignores REPEAT=1w?
Before I try and debug much further, I thought I would ask if anyone else has seen similar behaviour?
I have tried turning on the "-trace=filename" option of xymond_alert channel, but with a 7000 line hosts.cfg and 130 odd alerting rules it is rather hard to see what is going on in the trace file. I think I would have to build an isolated test environment, unless someone has one they could test a similar config to above in.
Cheers, Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au>
ITS: Service. Team. Accountability. Results.
IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include.
Please consider the environment before printing this email.
CRICOS Code 00025B