Alerting rules - covering 24h interval.
Hi everyone,
In our journey towards completely and successfully deploying Xymon on our machines we've come over this situation: we want to have an alert coming to us if the duration is over 30 minutes between 0800 and 2259 AND every 60 minutes between 2300 and 0759 the next day. They need to be repeated every 120 minutes in both cases.
The following group of 3 rules obviously covers what we want to accomplish, right? --- cut here --- MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE TIME=*:0000:0759 MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE TIME=*:2300:2359 --- and here ---
However, we're looking to write the most simple set of rules that would cover our requirements and would therefore welcome your answers regarding the following possible variants:
Would the following set of rules work given a setting like "TIME=*:2300:0759"? --- cut here --- MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE TIME=*:2300:0759 --- and here ---
Or maybe would the following work? In this case, wouldn't this duplicate alerts that happen to have a duration of 70 minutes, for example? --- cut here --- MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE --- and here ---
We have also been considering using "STOP" as below but this won't work when we need to alert 3 similar recipients. Any thoughts? --- cut here --- MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 STOP MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE --- and here ---
We are definitely looking forward to see the answers that users more experienced than ourselves would provide. Thanks in advance for your help.
kN
Hi everyone,
To answer my own question, in short: "TIME=*:2300:0759" is equivalent to "TIME=*:2300:2400,*:0000:0759" and thus solves our problem. Xymon is indeed a fine and well-thought piece of software.
Expanded explanation: While RTFM-ing 'man bb-hosts' and 'man hobbit-alerts.cfg' I could find out that the time format of the alerts has the same format as DOWNTIME has in bb-hosts which in turn has the same format as NKTIME. Even more, NKTIME is explicitly allowing the following:
--- cut here --- The interval between starttime and endtime may cross midnight, e.g. *:2330:0200 would be valid and have the same effect as *:2330:2400,*:0000:0200. --- and here ---
Sorry for the noise, thought I'd mention my findings for future reference.
On Wed, Jan 27, 2010 at 6:55 PM, Kii NODA <kii.noda at gmail.com> wrote:
Hi everyone,
In our journey towards completely and successfully deploying Xymon on our machines we've come over this situation: we want to have an alert coming to us if the duration is over 30 minutes between 0800 and 2259 AND every 60 minutes between 2300 and 0759 the next day. They need to be repeated every 120 minutes in both cases.
- Would the following set of rules work given a setting like "TIME=*:2300:0759"? --- cut here --- MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE TIME=*:2300:0759 --- and here ---
[ snip ]
-- kN
You have done a Very Good Thing by posting a question and the answer, even if you found it yourself. Now anyone who takes the time to search for this topic may find your answer!
GLH
On Wed, Jan 27, 2010 at 2:59 PM, Kii NODA <kii.noda at gmail.com> wrote:
Hi everyone,
To answer my own question, in short: "TIME=*:2300:0759" is equivalent to "TIME=*:2300:2400,*:0000:0759" and thus solves our problem. Xymon is indeed a fine and well-thought piece of software.
Expanded explanation: While RTFM-ing 'man bb-hosts' and 'man hobbit-alerts.cfg' I could find out that the time format of the alerts has the same format as DOWNTIME has in bb-hosts which in turn has the same format as NKTIME. Even more, NKTIME is explicitly allowing the following:
--- cut here --- The interval between starttime and endtime may cross midnight, e.g. *:2330:0200 would be valid and have the same effect as *:2330:2400,*:0000:0200. --- and here ---
Sorry for the noise, thought I'd mention my findings for future reference.
On Wed, Jan 27, 2010 at 6:55 PM, Kii NODA <kii.noda at gmail.com> wrote:
Hi everyone,
In our journey towards completely and successfully deploying Xymon on our machines we've come over this situation: we want to have an alert coming to us if the duration is over 30 minutes between 0800 and 2259 AND every 60 minutes between 2300 and 0759 the next day. They need to be repeated every 120 minutes in both cases.
- Would the following set of rules work given a setting like "TIME=*:2300:0759"? --- cut here --- MAIL email at recipient.tld DURATION>30 REPEAT=120 RECOVERED NOTICE TIME=*:0800:2259 MAIL email at recipient.tld DURATION>60 REPEAT=120 RECOVERED NOTICE TIME=*:2300:0759 --- and here ---
[ snip ]
-- kN
-- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.
participants (2)
-
glh.forums＠gmail.com
-
kii.noda＠gmail.com