I noticed that the xymon_alerts docs show there is a NOTICE keyword which is described as:
NOTICE Rule matches if the message is a "notify" message. This type of message is sent when a host or test is disabled or enabled.
I wanted to be alerted via a custom SMS script of any test as soon as it is enabled or disabled. So in the alerts.cfg file I had initially set up a line that I thought would trigger whenever a test was enabled or disabled like so:
HOST=* SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS NOTICE
As I was testing enabling and disabling, it appeared that I had gotten the syntax correct and I was off to the next thing.
However, when a normal test went yellow, I received two SMS alerts for it.
My logs shows that the CFID environment variable was showing that my new alert listed above was triggering the SMS as well as the PAGE=%firewalls/* alert that was supposed to trigger it.
I then tried
NOTICE SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS
as well as
NOTICE=* SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS
and finally
HOST=* NOTICE SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS
But it seems that ANY status change including normal green, yellow, red, purple triggers this alert as well as any other correctly matching alert.
I did some additional testing with all three above configurations using:
xymond_alert --test fw.example.com testname
And each of them showed (in order):
*** Match with 'HOST=*' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS NOTICE' ***
*** Match with 'NOTICE' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' ***
*** Match with 'NOTICE=*' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' ***
*** Match with 'HOST=* NOTICE' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' ***
Would love to get this working correctly and appreciate any help!
-- Bill Arlofski Reverse Polarity, LLC http://www.revpol.com/