Hi all!

As I expand my alerting ruleset to do cool things like only page me about "printers" during the day and so on, I had a weird occurrence today.

Basically, I have rules that list less-critical things first, and what I'm trying to do is something like this:

Rules for printers: Send emails, pages when printers go offline, and recover STOP HERE, because I do not need other rules to apply (like "connectivity" below)

Rules for "connectivity" for anything: Send emails, pages.

What is happening is this:

When the device (printer) went offline, I got alerted. Yay! I then got alerted exactly two hours later. Exactly what I want. Yay again!

Then, the printer recovered. I got *two* emails and *two* pages, because presumably the printers rule *AND* the "connectivity" rule applied, even though I only want the one rule to apply.

Am I missing some intended behavior, or is the "recovered" flag ignoring how I want my rules to "stop" when certain conditions are met?

My notifications log:

Printer goes offline:

Tue Jul 25 16:50:29 2006 lp4.phys.mcw.edu.conn (141.106.188.244) sysadmins[158] 1153864229 500 Tue Jul 25 16:50:29 2006 lp4.phys.mcw.edu.conn (141.106.188.244) pagers[159] 1153864229 500

Same message sent two hours later(yay!)

Tue Jul 25 18:50:32 2006 lp4.phys.mcw.edu.conn (141.106.188.244) sysadmins[158] 1153871432 500 Tue Jul 25 18:50:32 2006 lp4.phys.mcw.edu.conn (141.106.188.244) pagers[159] 1153871432 500

*DOUBLE* messages sent when recovered state occurs...???

Tue Jul 25 19:49:21 2006 lp4.phys.mcw.edu.conn (141.106.188.244) sysadmins[158] 1153874961 500 10792 Tue Jul 25 19:49:22 2006 lp4.phys.mcw.edu.conn (141.106.188.244) pagers[159] 1153874961 500 10792 Tue Jul 25 19:49:22 2006 lp4.phys.mcw.edu.conn (141.106.188.244) sysadmins[175] 1153874961 500 10792 Tue Jul 25 19:49:22 2006 lp4.phys.mcw.edu.conn (141.106.188.244) pagers[176] 1153874961 500 10792

My ruleset for alerts:

These rules change defaults for printers warnings/alerts (only email

or

page every 2 hours)

use of IGNORE rule means NO OTHER RULE matches printers after this

rule....

HOST=%^pr.*mcw\.edu MAIL sysadmins REPEAT=120 RECOVERED FORMAT=TEXT MAIL pagers REPEAT=120 RECOVERED FORMAT=SMS IGNORE

HOST=%^hp.*mcw\.edu MAIL sysadmins REPEAT=120 RECOVERED FORMAT=TEXT MAIL pagers REPEAT=120 RECOVERED FORMAT=SMS
IGNORE

HOST=%^lp.*mcw\.edu MAIL sysadmins REPEAT=120 RECOVERED FORMAT=TEXT MAIL pagers REPEAT=120 RECOVERED FORMAT=SMS
IGNORE

Anything that loses connectivity, email/page every 30 minutes

SERVICE=conn MAIL sysadmins REPEAT=30 RECOVERED FORMAT=TEXT MAIL pagers REPEAT=30 RECOVERED FORMAT=SMS