Combining Macros in alerts.cfg EXHOST?

newer
[Newbie] Smaller, lighter Xymon...

betsy.schwartz＠gmail.com

27 Nov 2012 27 Nov '12

8:32 p.m.

I'm trying to make my alerts.cfg a lot simpler.

I've got two macros defining groups of hosts. To simplify slightly:

    $NOPAGE=%(^*.eng|^netmon2).example.com
    $VIP=%(^web|^ftp|^mail-relay).example.com,web-vip,mail-vip

Each macro works by itself when I use it in a rule. However I want to make a rule that groups these two together, something like so:

    HOST=* EXHOST=%($VIP,$NOPAGE) SERVICE=$SYSENG
     include syseng.escalation.cfg

I'm not getting this to work , with various combinations : %($NOPAGE,$VIP) %($NOPAGE|$VIP)

The rules are catching hosts in $NOPAGE but not in $VIP I could make a third combined group, but since I've got other rules that just apply to $VIP or $NOPAGE it would be nice to be able to do this

thanks for any clues Betsy

Show replies by date

Paul.Root＠CenturyLink.com

27 Nov 27 Nov

8:38 p.m.

You don't need the %(...) stuff. You are already wildcarding it in the macro.

HOST=* EXHOST=$VIP,$NOPAGE ...

Paul Root - Senior Engineer Managed Services Systems - CenturyLink

...

-----Original Message----- From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Betsy Schwartz Sent: Tuesday, November 27, 2012 2:33 PM To: xymon at xymon.com Subject: [Xymon] Combining Macros in alerts.cfg EXHOST?

I'm trying to make my alerts.cfg a lot simpler.

I've got two macros defining groups of hosts. To simplify slightly:
    $NOPAGE=%(^*.eng|^netmon2).example.com
    $VIP=%(^web|^ftp|^mail-relay).example.com,web-vip,mail-vip
Each macro works by itself when I use it in a rule. However I want to make a rule that groups these two together, something like so:
    HOST=* EXHOST=%($VIP,$NOPAGE) SERVICE=$SYSENG
     include syseng.escalation.cfg
I'm not getting this to work , with various combinations : %($NOPAGE,$VIP) %($NOPAGE|$VIP)

The rules are catching hosts in $NOPAGE but not in $VIP I could make a third combined group, but since I've got other rules that just apply to $VIP or $NOPAGE it would be nice to be able to do this

thanks for any clues Betsy

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

Hm, thanks. I had %( in the rules because I defined the macro without the %, thinking that might help use | to glue two together. I initially tried it with two separate macros defined with %( but I still get a match when I think I should not.

[xymon at xymon-dev1 ~]$ /usr/local/xymon/server/bin/xymond_alert --test wiki.example.com http -color=red | grep -B5 Mail 00031698 2012-11-27 17:58:15 *** Match with 'HOST=* EXHOST=$NOPAGE,$VIP SERVICE=$TECHOPS_TESTS' * 00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page 'wiki.example.com:http:NONE:business' against rule line 222 00031698 2012-11-27 17:58:15 Failed 'MAIL xymail repeat=8h COLOR=yellow FORMAT=TEXT' (color) 00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page 'wiki.example.com:http:NONE:business' against rule line 223 00031698 2012-11-27 17:58:15 * Match with 'MAIL xymail repeat=5m COLOR=red FORMAT=TEXT' * 00031698 2012-11-27 17:58:15 Mail alert with command '/var/spool/mail/xymon "Xymon [12345] wiki.example.com:http CRITICAL (RED)" xymail' 00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page 'wiki.example.com:http:NONE:business' against rule line 224 00031698 2012-11-27 17:58:15 * Match with 'MAIL alert1 REPEAT=10 COLOR=red FORMAT=SMS' *** 00031698 2012-11-27 17:58:15 Mail alert with command 'mail alert1'

00031698 2012-11-27 17:58:15 *** Match with 'HOST=wiki.example.com SERVICE=conn,http' *** 00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page 'wiki.example.com:http:NONE:business' against rule line 335 00031698 2012-11-27 17:58:15 Failed 'MAIL xymail REPEAT=1d COLOR=yellow FORMAT=TEXT' (color) 00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page 'wiki.example.com:http:NONE:business' against rule line 336 00031698 2012-11-27 17:58:15 *** Match with 'MAIL sysengoncall REPEAT=10 COLOR=red,purple FORMAT=SMS' *** 00031698 2012-11-27 17:58:15 Mail alert with command 'mail sysengoncall'

the test does work as expected

00000469 2012-11-27 18:05:35 Failed 'HOST=* EXHOST=$NOPAGEANDVIP SERVICE=$TECHOPS_TESTS' (hostname excluded)

(I know I can simplify that last regexp, just put it in for proof-of-concept)

Going to go redefine my host lists now but it would be nice to get this to work

jlaidman＠rebel-it.com.au

11:55 p.m.

On 28 November 2012 07:32, Betsy Schwartz <betsy.schwartz at gmail.com> wrote:

...

I'm not getting this to work , with various combinations : %($NOPAGE,$VIP)

Can you use a comma in this context? If so, this is news to me, and I don't think it's reflected in the doco. If not, it could explain why your $VIP is not matching, although I don't know

...

%($NOPAGE|$VIP)

I think this should work, as long as you remove the percent (%) from the macros, and as long as the commas in $VIP are addressed (assuming commas are invalid). So:

[I'm assuming you had a typo in your NOPAGE definition: "^*.eng" should be "^.*eng"]

You can simplify these regexps by putting the caret only once at the start:

Or even moving the carets to the EXHOST definition:

Cheers Jeremy

betsy.schwartz＠gmail.com

28 Nov 28 Nov

2:16 a.m.

On Tue, Nov 27, 2012 at 6:55 PM, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote:

...

$NOPAGE=(^.*eng|^netmon2).example.com $VIP=(^web|^ftp|^mail-relay).example.com|web-vip|mail-vip HOST=* EXHOST=%($NOPAGE|$VIP) ...

OK that does work thank you!!

(funny, that's what I thought I'd tested FIRST... maybe there was a second error that I created and eliminated along the way. My eyes are starting to glaze over with this rewrite, but I've gotten the alerts.cfg down to 81 active lines from 133.... and that includes several new additions)

4956

Age (days ago)

4957

Last active (days ago)

List overview

Download

4 comments

3 participants

participants (3)

betsy.schwartz＠gmail.com
jlaidman＠rebel-it.com.au
Paul.Root＠CenturyLink.com