[Xymon] Configuring alerts

Extract from analysis.cfg(5) man page :

DIRECTING ALERTS TO GROUPS For some tests - e.g. "procs" or "msgs" - the right group of people to alert in case of a failure may be different, depending on which of the client rules actually detected a problem. E.g. if you have PROCS rules for a host checking both "httpd" and "sshd" processes, then the Web admins should handle httpd-failures, whereas "sshd" failures are han- dled by the Unix admins.

   To handle this, all rules can have a "GROUP=groupname" setting.  When a
   rule with this setting triggers a yellow or red status,  the  groupname
   is passed on to the Xymon alerts module, so you can use it in the alert
   rule definitions in alerts.cfg(5) to direct alerts to the correct group
   of people.

For example, in alerts.cfg, you would have:

HOST=myhostname

PROC notepad.exe 1 GROUP=admins

And this in alerts.cfg:

HOST=myhostname SERVICE=procs GROUP=admins

MAIL john at testlab.local

HTH,

Dominique

UNIL - University of Lausanne

De : Xymon <xymon-bounces at xymon.com> de la part de Even Hauge Juberg <even.juberg at artsdatabanken.no> Envoyé : lundi 19 février 2018 15:53 À : xymon at xymon.com Objet : [Xymon] Configuring alerts

Hi!

I've been trying a few things to get the correct alerts to the correct staff-member, but for some reason I cannot get it to work. In order to find out if I'm doing something wrong within the configuration of Xymon, or if I have to search somewhere else, I'm reaching out here to see if anyone can give me any pointers.

The scenario is that I have one particular host, that should be running a specific process. Let's say this process is "notepad.exe" - if "notepad.exe" is not running, John should get an email.

What I have done so far is this:

1.   Edited the configuration file on my host as follows in the "procs section": <setting name="notepad.exe" rule="=1" comment="Notepad" alarmcolor="red" />

a. My goal here is to check if there is one instance of notepad.exe running - if not, give a "red alert".

b. This seems to be working. The host in the web-view of Xymon turns red in the procs column, and notepad.exe is shown as running -1 instance if there is not one running. So far so good!

2.   Now I want John to be alerted if notepad is not running so I have edited the alert.cfg in the following way:

a. HOST=myhostname(the same as in hosts.cfg NAME:myhostname) SERVICE=notepad.exe MAIL john at testlab.local<mailto:john at testlab.local> DURATION>10 COLOR=red

b. As "notepad.exe is not a service, but a process this is not working. AS "procs" is not a valid argument(at least not listed in the documentation, SERVICE was the closest thing that came to mind. So my question is simply, is there a way to filter alerts by the procs column or will I have to attack this in another way?

c. I would like to avoid John getting nagged by any other red-alerts from this host, as his responsibility is notepad. :)

Any pointers would be highly appreciated!

Sicnerely, Even Hauge Juberg Senior Engineer Norwegian Biodiversity Information Centre