Xymon Mailing List Archive search

Alert issue

list David Welker
Thu, 12 Nov 2015 12:37:13 -0500
Message-Id: <user-b2c19854032d@xymon.invalid>

jc,

Using your idea...
PAGE=mypage COLOR=red,yellow
   MAIL user-4b28831ca997@xymon.invalid

...when cpu is green, yellow, purple, or red --test now always returns a
mail -s with CRITICAL (RED) message.

which may actually BE correct, since elsewhere on the page there is a red
status and I've now put the COLOR on the main line referencing the whole
page. In an attempt to narrow it back down to the one host, however, I used
HOST=^Server1*, instead of PAGE=, but STILL get the CRITICAL (RED) message
in the --test run, but actually got an email regarding the yellow cpu
status (and not for a different yellow status on the same page).

--dump-config returns...
HOST=^Server1* COLOR=yellow,red     <---- NOTICE REVERSED COLORS (see
above)??
MAIL user-4b28831ca997@xymon.invalid FORMAT=TEXT REPEAT=30

Interestingly enough, when I use a --color parameter with the --test, it
performs correctly...
If --color of cpu is yellow, --test returns a warning (YELLOW) message.
If --color of cpu is red, --test returns a CRITICAL (RED) message.
If --color of cpu is green or purple, --test returns a FAILED (due to
color) message.

By the way, my ALERTCOLORS="red,yellow,purple"

Could it possibly be that the --test feature needs more testing, and that
the alerting is actually working the way I expect it should?

Thanks,
David


On Thu, Nov 12, 2015 at 10:41 AM, J.C. Cleaver <user-87556346d4af@xymon.invalid>
wrote:
On Thu, November 12, 2015 6:44 am, David Welker wrote:
Thanks!  Makes sense.  I guess the alerts.cfg.5.html file needs to be
changed?  That's where I was looking...
*COLOR=color[,color]* Rule matching an alert by color. Can be "red",
"yellow", or "purple". The forms "!red", "!yellow" and "!purple" can also
be used to NOT send an alert if the color is the specified one.

Well, that fixed my first issue.  Now when the cpu is reporting green,
the
--test gives me a "Failed" message as expected, but with the cpu
reporting
yellow, I get the same "Failed" message - failed due to color!

Even took xymoncmd out of the equation and the result is the same.
Took out EXSERVICE as well.

Now all I have in alerts.cfg:
PAGE=mypage
  MAIL user-4b28831ca997@xymon.invalid COLOR=%(red|yellow)

..yet when I run:
 xymond_alert --test server.com cpu
I get..
#### DATE TIME Failed 'MAIL user-4b28831ca997@xymon.invalid COLOR=%(red|yellow)' (color)

Any other suggestions?  For example, do I have to restart the server
after
making changes to the alerts.cfg file?

I believe the proper syntax there is simply:

PAGE=mypage COLOR=red,yellow
   MAIL user-4b28831ca997@xymon.invalid

COLOR can be a list of options, unlike most of the other filters (such as
EXSERVICE) which must either lexically match OR have to be prepended with
a '%' to enter "pcre-regex" mode. Additionally, COLOR= appears to not be
allowed as a per-recipient filter; in this case, it'll need to be on the
main line.

One easy way to check the syntax and rule logic is to run xymoncmd
xymond_alert --dump-config . What shows up in the result will be how the
alert system interprets it.

Also, to actually enable 'yellow' alerts, you'll want to ensure the color
is added to "$ALERTCOLORS" in xymonserver.cfg if it's not already.


HTH,
-jc

Thanks,
David


On Wed, Nov 11, 2015 at 10:10 PM, Martin Lenko <user-024fe0c6d298@xymon.invalid>
wrote:
Hi David,
to specify multiple color values you will have to use regular
expression.
Use something like this in your alert config:
COLOR=%(yellow|red)

The '%' character instructs xymon that following string is a regular
expression.

Regards,
Martin

On 11 November 2015 at 18:46, David Welker <user-04cf53598626@xymon.invalid> wrote:
I admit, this is my first attempt at alerting, so this may or may not
be
user error.  It also could be an issue that is fixed in the latest
upgrade
(I'm still on 4.3.21), but before I resort to that (which will be soon
enough), I wanted to make sure I was at least thinking along the right
line...

The cpu column is reporting green.
The entry in alerts.cfg includes a COLOR=yellow parameter.
Running the xymond_alert --test reports (as expected)...
Failed 'MAIN me at here COLOR=yellow EXSERVICE=conn,disk' (color)

If, however, I change the COLOR to red, or even if I just add it
(COLOR=yellow,red), I get the "Mail alert with command 'mail -s...'"
line
rather than the failed.  Did I do something wrong?

Funny though, either way I don't actually get the email.

Thanks,
David