I spoke too soon
I just got 103 emails with
Hobbit [0] rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat CRITICAL (RED)
red Mon May 14 20:19:26 2007
When I look at the hobbitdboard for the host, it shows a correct ack code
rochnygso-omrdd-cpe01.nyroc.rr.com|if_stat|red||1179233720|1179249886|117925
1686|0|0|10.10.8.180|419285|red Tue May 15 13:24:43 2007
Hobbitd_alert -test shows it matching just 1 rule
00008773 2007-05-15 13:31:47 *** Match with
'HOST=%.*-pe-rtr.*|.*-ons.*|.*-p-rtr.*|.*-osc.*|.*-adm.*|.*-nypa-.*|.*-amp.*
|.*-omrdd-.*
|.*-pe0.*|.*-pe1.* TIME=12345:0800:2159' ***
00008773 2007-05-15 13:31:47 Matching host:service:page
'rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat:regionalnet/omrdd' against rule
line 534
00008773 2007-05-15 13:31:47 *** Match with 'MAIL user-379a78b7e224@xymon.invalid
REPEAT=60 COLOR=red RECOVERED' ***
00008773 2007-05-15 13:31:47 Mail alert with command '/var/mail//sclark
"Hobbit [12345] rochnygso-omrdd-cpe01.nyroc.rr.com:if_stat CRITICAL (RED)"
user-7bfd2181a0ed@xymon.invalid'
Is there something in my rule setup that could be causing all these extra
alerts?
-Sean
-----Original Message-----
From: Sean R. Clark [mailto:user-94e09d797e16@xymon.invalid]
Sent: Tuesday, May 15, 2007 12:54 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] two ack questions
When the status goes back to a non-critical state, hobbitd sends a
recovery
message on the "alert" channel, so the
alerting module can send a "recovered" notice (if this has been configured).
No I understand this part - I have it configured and working
But when I enabled the bbpage module in hobbitlaunch, I got a bunch of
messages that said RED CRITICAL but the ACK code passed to it was 0
Subject: Hobbit [0] hostname-swt09a-02.domain.com:if_stat CRITICAL (RED)
(body) red Mon May 14 13:15:18 2007
results of test bleh bleh
This wasn't a recovery - it was red when I started bbpage
It hasn't happened since yesterday, something with having the paging module
DISABLED and then restarting hobbit? I dunno