On Wed, Oct 05, 2005 at 03:27:07PM -0700, Brehm, Scott wrote:
Is it normal to get two alert messages if an event matches two rules?
Yes.
Is there a keyword to suppress multiple alert emails from the same event? I've been running 4.0 for a while, but just getting in to configuring alerts. My hobbit-alerts.cfg includes the following:
HOST=* SERVICE=conn MAIL sbrehm at titan.com COLOR=red
HOST=%atscm MAIL sbrehm at titan.com COLOR=red MAIL person2 at titan.com COLOR=red
HOST=%atscs MAIL sbrehm at titan.com COLOR=red MAIL person3 at titan.com COLOR=red
I want alerts for any connection problems, but only want alerts for other hosts if they come from two specific sets of hosts.
As you've found out yourself, EXSERVICE=conn on the two host-specific rules will do it. Instead, you could also use the keyword "STOP" with the "conn" rule - like
HOST=* SERVICE=conn MAIL sbrehm at titan.com COLOR=red STOP
This will make the alert-handler stop looking for recipients after your general "conn" rule has been matched.
Henrik