Alert config issue or question -- 4.2 Alpha Release (and 4.03 Rc1)
I've a problem with my running 4.03RC1 (yeah, I know :-) that doesn't seem to change with 4.2 Alpha.
With this alert_config set:
HOST=%(whq-sapcon-1|whq-sapcon-2) EXSERVICE=msgs SCRIPT=/usr/local/hobbit/server/ext/pg/sms oracle_echelon SERVICE=telnet,svcs,procs color=RED DURATION>6m REPEAT=4h MAIL techsupt at localhost SERVICE=telnet,svcs,procs DURATION>6 REPEAT=4h MAIL techsupt at localhost UNMATCHED DURATION>6m REPEAT=4h
I get this when running the test:
00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 140 00018172 2006-04-05 11:42:36 *** Match with 'HOST=%(whq-sapcon-1|whq-sapcon-2) EXSERVICE=msgs' *** 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 141 00018172 2006-04-05 11:42:36 Failed 'SCRIPT=/usr/local/hobbit/server/ext/pg/sms oracle_echelon SERVICE=telnet,svcs,procs color=RED DURATION>6m REPEAT=4h' (min. duration 0<360) 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 142 00018172 2006-04-05 11:42:36 Failed 'MAIL techsupt at localhost SERVICE=telnet,svcs,procs DURATION>6 REPEAT=4h' (min. duration 0<360) 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 143 00018172 2006-04-05 11:42:36 Failed 'MAIL techsupt at localhost UNMATCHED DURATION>6m REPEAT=4h' (min. duration 0<360)
So if I'm reading this correctly, my 'duration>6m' is being interpreted as 'duration>6h'. The intent here is to require two failed tests before paging. Where have I gone wrong?
Tom Kauffman NIBCO, Inc
CONFIDENTIALITY NOTICE: This email and any attachments are for the
exclusive and confidential use of the intended recipient. If you are not
the intended recipient, please do not read, distribute or take action in
reliance upon this message. If you have received this in error, please
notify us immediately by return email and promptly delete this message
and its attachments from your computer system. We do not waive
attorney-client or work product privilege by the transmission of this
message.
Not sure if this could be the problem, but your DURATION parameter in the MAIL line just says "DURATION>6". Maybe hours is the default, and you need to change it to DURATION>6m (like your second use of it on the last line)?
-Charles
Kauffman, Tom wrote:
I've a problem with my running 4.03RC1 (yeah, I know :-) that doesn't seem to change with 4.2 Alpha.
With this alert_config set:
HOST=%(whq-sapcon-1|whq-sapcon-2) EXSERVICE=msgs SCRIPT=/usr/local/hobbit/server/ext/pg/sms oracle_echelon SERVICE=telnet,svcs,procs color=RED DURATION>6m REPEAT=4h MAIL techsupt at localhost SERVICE=telnet,svcs,procs *DURATION>6* REPEAT=4h MAIL techsupt at localhost UNMATCHED DURATION>6m REPEAT=4h
I get this when running the test:
00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 140 00018172 2006-04-05 11:42:36 *** Match with 'HOST=%(whq-sapcon-1|whq-sapcon-2) EXSERVICE=msgs' *** 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 141 00018172 2006-04-05 11:42:36 Failed 'SCRIPT=/usr/local/hobbit/server/ext/pg/sms oracle_echelon SERVICE=telnet,svcs,procs color=RED DURATION>6m REPEAT=4h' (min. duration 0<360) 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 142 00018172 2006-04-05 11:42:36 Failed 'MAIL techsupt at localhost SERVICE=telnet,svcs,procs DURATION>6 REPEAT=4h' (min. duration 0<360) 00018172 2006-04-05 11:42:36 Matching host:service:page 'whq-sapcon-1:telnet:' against rule line 143 00018172 2006-04-05 11:42:36 Failed 'MAIL techsupt at localhost UNMATCHED DURATION>6m REPEAT=4h' (min. duration 0<360)
So if I'm reading this correctly, my 'duration>6m' is being interpreted as 'duration>6h'. The intent here is to require two failed tests before paging. Where have I gone wrong?
Tom Kauffman NIBCO, Inc
CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive
attorney-client or work product privilege by the transmission of this message.To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Wed, Apr 05, 2006 at 11:52:00AM -0400, Kauffman, Tom wrote:
I've a problem with my running 4.03RC1 (yeah, I know :-) that doesn't seem to change with 4.2 Alpha. 00018172 2006-04-05 11:42:36 Failed 'MAIL techsupt at localhost UNMATCHED DURATION>6m REPEAT=4h' (min. duration 0<360)
So if I'm reading this correctly, my 'duration>6m' is being interpreted as 'duration>6h'. The intent here is to require two failed tests before paging. Where have I gone wrong?
You're not reading it correctly. When you put DURATION>6m into the config, Hobbit internally converts that into 360 seconds. The output you see means that the current duration of the alert (0 seconds) - was less than the minimum duration required (360 seconds).
I cannot recall if the test option in 4.0.3 allows you to specify the duration for the test-alert; with newer version you can, and then you'd see the the "0" change accordingly.
Henrik
participants (3)
-
henrik＠hswn.dk
-
jonescr＠cisco.com
-
KauffmanT＠nibco.com