Strange Alerts

I've found that adding STOP commands at the end of each match section help
as well to eliminate stray/unintended alerts going out.

On Mon, Jul 24, 2017 at 6:28 PM, Japheth Cleaver <user-87556346d4af@xymon.invalid>
wrote:

On 7/24/2017 10:19 AM, John Tullis wrote:

I'm getting an extremely strange behavior with alerts.

Several recipients are complaining that they are getting alerts for
servers that they don't manage and aren't assigned. There are about 200
lines in my alerts.cfg file.

I've verified that the alert rules are accurate and running the test
alert script (./bin/xymoncmd xymond_alert --test sever.name cpu) shows
the correct, assigned user and the info page for the servers show the right
user's email.

Anyone know what I'm missing? The same problems happened with my old
Hobbit server as well so it could be a config file issue but I've looked
thoroughly and haven't been able to track it down yet.

Hi,

I'd start by adding the --cfid option to xymond_alert in tasks.cfg. This
will cause the alert rule in question to be printed along with each alert
that goes out, which usually helps narrow down what's going on. If you have
a alerts.cfg file that spans multiple actual files (via include
statements), you can run xymoncmd xymond_alert --dump-config to see what
config lines line up with what rules. (Keep in mind that config line #'s
will change once you do start making changes to things.)

If that doesn't help, or just points you to catch-all rules, you can run
xymoncmd xymond_alert --test <host> <test> [other options] to trace down
exactly what evaluations are occurring, although with a large alert config
file you'll get a correspondingly large amount of output.

You'll also want to make sure you're running  4.3.25 or higher, as that
fixed a few bugs involving host records in xymond_alert.

HTH,
-jc