Sadly, I spoke to soon. It is definitely nagging with the recovered-messages, even though there is no RECOVERED tag in the alerts.cfg file.
Sincerely, Even
Fra: Xymon [mailto:xymon-bounces at xymon.com] På vegne av Even Hauge Juberg Sendt: tirsdag 28. mars 2017 11.28 Til: Galen Johnson <Galen.Johnson at sas.com>; xymon at xymon.com Emne: Re: [Xymon] Annyoing logic in alerts.cfg
Thank you for your reply!
Yes, I believe I did try that, but it actually sending a "recovered" to all users in the list, but I must've misconfigured something or simply remembering wrong. It seems to be working just as I want it now, I did add the "RECOVERED" to one user on the list - som maybe that did the trick?
Sincerely
Even
Fra: Galen Johnson <Galen.Johnson at sas.com<mailto:Galen.Johnson at sas.com>> Sendt: 27. mars 2017 15:49 Til: Even Hauge Juberg; xymon at xymon.com<mailto:xymon at xymon.com> Emne: Re: Annyoing logic in alerts.cfg
Have you tried removing the recovered stanza? I thought Xymon only sent a recovered message if you explicitly tell it to on the alert itself:
HOST=* MAIL someuser at example.com<mailto:someuser at example.com> DURATION>10 REPEAT=30 RECOVERED UNMATCHED
Check other rules to see if you are overriding it somewhere by telling it to explicitly send recover messages.
NB: I had thought there was a global setting somewhere that would default it to on but I can't find it
Basically, try commenting out
HOST=* RECOVERED=1 IGNORE HOST=*
and see if it behaves like you want.
=G=
From: Xymon <xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>> on behalf of Even Hauge Juberg <even.juberg at ntnu.no<mailto:even.juberg at ntnu.no>> Sent: Monday, March 27, 2017 8:04 AM To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Annyoing logic in alerts.cfg
Hi!
I've been using Xymon for years and have recently begun to play around with the alerts.cfg, however, there is something I have been banging my head against the wall with, for weeks now. So I am reaching out to this list in the hopes that someone out there might have the key to save me from eternal frustration.
*snippet from my alerts.cfg*
HOST=* RECOVERED=1 IGNORE HOST=*
HOST=one-host SERVICE=http MAIL someuser at domain.local<mailto:someuser at domain.local> COLOR=red MAIL someuser at domain.local<mailto:someuser at domain.local> DURATION>5 COLOR=red
What I'm trying to accomplish is to stop the "I'm OK - recovered" messages. Those messages are irrelevant, so I want those filtered out. The problem though, is that the logic is completely off on this point. The first rule for some reason takes presedense, even though I have explicitly told it to only use that rule IF the host has recovered, no?
I want it to skip that rule, if it has not yet recovered, send mail to the first user immediately, then to the other user after 5 minutes, but leave those users alone if the service is OK again. Is there a way to accomplish this?
Sincerely, Even