Alert Syntax and Notification log mismatch
Hi All
I did a bbcmd hobbit_alert --dump-config and looked for particular host testhost1
HOST=%.* EXHOST=%testhost1(.*) MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30 SERVICE=msgs DURATION>10
HOST=%testhost1(.*) EXSERVICE="msgs,vmio" MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30 MAIL user at here.com,123456789 at skytel.com FORMAT=TEXT REPEAT=30
HOST=%testhost1(.*) SERVICE="vmio" MAIL sysadmin at here.net FORMAT=TEXT REPEAT=30 DURATION>10
HOST=%testhost2(.*)|testhost1(.*) SERVICE="msgs" SCRIPT /export/home/hobbit/server/bin/script user at here.com,12345678 at skytel.com FORMAT=TEXT REPEAT=30
So only sysadmin at here.net and oncall at here.net should get any alert related to testhost1.here.net's vmio service. But I am seeing user at here.com and 123456789 at skytel.com are also getting those alerts per my notification log
(hobbit)@hobbitserver:~/server/etc$ tail -100 /var/log/hobbit/notifications.log
Wed Oct 12 09:23:33 2005 testhost1.here..net.vmio (1.2.1.251) sysadmin at here.net,oncall at here.net 1129123412 0 Wed Oct 12 09:23:35 2005 testhost1.here.net.vmio (1.2.1.251) user at here.com,12345678 at skytel.com 1129123412 0 Thu Oct 13 09:23:48 2005 testhost1.here..net.vmio (1.2.1.251) sysadmin at here.net,oncall at here.net 1129209826 0 Thu Oct 13 09:23:50 2005 testhost1.here.net.vmio (1.2.1.251) user at here.com,12345678 at skytel.com 1129209826 0
Any help to demystify this would be appreciated
I am using 4.1.2 for hobbit server and BB 1.9c for testhost1.here.net
Thanks
-- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu "..there are two kinds of people: those who work and those who take the credit...try to be in the first group;...less competition there." - Indira Gandhi
On Thu, Oct 13, 2005 at 11:18:12AM -0400, Asif Iqbal wrote:
I did a bbcmd hobbit_alert --dump-config and looked for particular host testhost1
Could you try "bbcmd hobbitd_alert --test testhost1.here.net vmio 700" ?
That will simulate how hobbitd_alert walks through the configuration while processing an alert for the host "testhost1.here.net" and service "vmio", which has been red for 700 seconds.
Wed Oct 12 09:23:33 2005 testhost1.here..net.vmio (1.2.1.251) sysadmin at here.net,oncall at here.net 1129123412 0
Odd - double dots in the hostname there. Any idea where they come from ?
Henrik
On Thu, Oct 13, 2005 at 11:18:12AM -0400, Asif Iqbal wrote:
I did a bbcmd hobbit_alert --dump-config and looked for particular host testhost1
HOST=%.* EXHOST=%testhost1(.*) MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30 SERVICE=msgs DURATION>10
HOST=%testhost1(.*) EXSERVICE="msgs,vmio" MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30 MAIL user at here.com,123456789 at skytel.com FORMAT=TEXT REPEAT=30
HOST=%testhost1(.*) SERVICE="vmio" MAIL sysadmin at here.net FORMAT=TEXT REPEAT=30 DURATION>10
Asif's problem turned out to be the quotes he put around the SERVICE and EXSERVICE parameters. EXSERVICE="msgs,vmio" does not work as expected, but EXSERVICE=msgs,vmio does.
That is too tricky for my taste. I'll try and make it behave better.
Regards, Henrik
participants (2)
-
henrik@hswn.dk
-
iqbala-hobbit@qwestip.net