I am stiil trying to troubleshoot my missing enable messages, so I deleted the NOTICE rule mentioned below and created a new rule:
Send me notice alerts of enable and disable
HOST=* MAIL me at mydomain.com NOTICE NOALERT
I then proceeded to disable 2 services on a host. I observed that I received a disable notification, both by actual receipt of the email, and by tail -f /var/log/maillog.
Then I enabled the services (by enabling "ALL" for that host), and...nothing. No mail was sent, as verified by my tailing of the log.
I then immediately disabled ALL services on another host, and no mail was sent. I then immediately re-enabled ALL services on that same host, and no mail was sent.
Through testing I discovered that when you disable or enable _"ALL"_ services on a host, no NOTICE message is generated. If I disable or disable _individual_ services, notice messages are generated and an email is sent out.
If you need me to do further testing, let me know.
-Charles
Charles Jones wrote:
When I disable a host in hobbit, it says it was disabled by unknown at 1.2.3.4 <mailto:unknown at 1.2.3.4>. In the bb maint.pl script, it had an option to put a username, but I don't see an option to do this in the Hobbit Maint page, so is "unknown" hard coded, or does it look for it somewhere else?
I added the "NOTICE" rule to my hobbit-alerts.cfg
HOST=* SERVICE=* COLOR=red MAIL me at mydomain.com <mailto:me at mydomain.com> RECOVERED NOTICE
I then tested disabling the cpu service for a host, and I received an email with the disable message:
From: hobbit at myhost.com <mailto:hobbit at myhost.com> Sent: Wednesday, November 09, 2005 5:01 PM To: me at mydomain.com <mailto:me at mydomain.com> Subject: Hobbit servername:cpu NOTICE servername:cpu INFO Monitoring of servername:cpu has been DISABLED by unknown for 240 minutes Disabled by: unknown @ 1.2.3.4 Reason: testing disable notice
This is what I expected to get. However, I then went and re-enabled the disabled service, and I did not get an email saying it was re-enabled. I checked the /var/log/maillog to make sure that it wasn't a mail delay. There simply was no email sent about the enable. I assume this isn't normal behavior :)
-Charles