I spoke too soon
I just got 103 emails with
Hobbit [0] rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat CRITICAL (RED) red Mon May 14 20:19:26 2007
When I look at the hobbitdboard for the host, it shows a correct ack code
rochnygso-omrdd-cpe01.nyroc.rr.com|if_stat|red||1179233720|1179249886|117925 1686|0|0|10.10.8.180|419285|red Tue May 15 13:24:43 2007
Hobbitd_alert -test shows it matching just 1 rule
00008773 2007-05-15 13:31:47 *** Match with 'HOST=%.*-pe-rtr.*|.*-ons.*|.*-p-rtr.*|.*-osc.*|.*-adm.*|.*-nypa-.*|.*-amp.* |.*-omrdd-.* |.*-pe0.*|.*-pe1.* TIME=12345:0800:2159' *** 00008773 2007-05-15 13:31:47 Matching host:service:page 'rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat:regionalnet/omrdd' against rule line 534 00008773 2007-05-15 13:31:47 *** Match with 'MAIL emailalias at nyroc.rr.com REPEAT=60 COLOR=red RECOVERED' *** 00008773 2007-05-15 13:31:47 Mail alert with command '/var/mail//sclark "Hobbit [12345] rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat CRITICAL (RED)" email at nyroc.rr.com'
Is there something in my rule setup that could be causing all these extra alerts?
-Sean -----Original Message----- From: Sean R. Clark [mailto:sclark at nyroc.rr.com] Sent: Tuesday, May 15, 2007 12:54 PM To: hobbit at hswn.dk Subject: RE: [hobbit] two ack questions
When the status goes back to a non-critical state, hobbitd sends a recovery message on the "alert" channel, so the alerting module can send a "recovered" notice (if this has been configured).
No I understand this part - I have it configured and working
But when I enabled the bbpage module in hobbitlaunch, I got a bunch of messages that said RED CRITICAL but the ACK code passed to it was 0
Subject: Hobbit [0] hostname-swt09a-02.domain.com:if_stat CRITICAL (RED) (body) red Mon May 14 13:15:18 2007 results of test bleh bleh
This wasn't a recovery - it was red when I started bbpage
It hasn't happened since yesterday, something with having the paging module DISABLED and then restarting hobbit? I dunno
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk