Xymon Mailing List Archive search

Receiving Duplicate Alerts

3 messages in this thread

list Ken Shackelford · Fri, 24 Jan 2014 13:49:23 +0000 · 
Hello,

        I have a situation where I'm receiving duplicate alert E-mail for most of my monitored devices.
For example, with the following configuration lines:

$B-list-brn-emea=%(Ballerup-w|Barcelona-w|Berlin-w|Bilbao-w|Bonn-w|Capelle-w|CastlePark-w|Essen-w|Goeppingen-w|Hamburg-w|Hannover-w|Hengelo-w|Huizingen-w|Kista-w|Klagenfurt-w|Leuven-LMS-w|Lindau-w|Linz-w|Madrid-w|Manchester-w|Milano-w|Modena-w|Molndal-w|Moscow-w|Munich-w|Nuernberg-w|Orbassano-w|Prague-w|Rheinfelden-w|s-Hertogenbosch-w|Solihull-w|StPriest-w|Stuttgart-w|Stuttgart-TCNO-w|Toulouse-w|ToulouseKineo-w|Treviso-w|Vejle-w|Velizy-w|Warsaw-w|Wolfsburg-w|Zurich-w)

$B-list-grn-emea=%(Ballerup-w-plnet|Barcelona-w-plnet|Bilbao-w-plnet|Bonn-w-plnet|CastlePark-w-plnet|Goeppingen-w-plnet|Hamburg-w-plnet|Hannover-w-plnet|Hengelo-w-plnet|Huizingen-w-plnet|Kista-w-plnet|Klagenfurt-w-plnet|Linz-w-plnet|Madrid-w-plnet|Manchester-w-plnet|Milano-w-plnet|Modena-w-plnet|Molndal-w-plnet|Moscow-w-plnet|Munich-w-plnet|Nuernberg-w-plnet|Orbassano-w-plnet|Prague-w-plnet|Rheinfelden-w-plnet|s-Hertogenbosch-w-plnet|Solihull-w-plnet|StPriest-w-plnet|Stuttgart-w-plnet|Stuttgart-TCNO-w-plnet|Toulouse-w-plnet|Treviso-w-plnet|Vejle-w-plnet|Velizy-w-plnet|Warsaw-w-plnet|Wolfsburg-w-plnet|Zurich-w-plnet)

HOST=$B-list-brn-emea
        MAIL user-7db41fdac34e@xymon.invalid<mailto:user-7db41fdac34e@xymon.invalid> DURATION>5 REPEAT=1d RECOVERED

HOST=$B-list-grn-emea
        MAIL user-7db41fdac34e@xymon.invalid DURATION>5 REPEAT=1d RECOVERED

Now, if, for example the device Ballerup-w-plnet goes red, I get two mails with identical headers:

Xymon [701628] Ballerup-w-plnet:conn CRITICAL (RED)

And likewise, when it comes back up, I get two messages:

Xymon Ballerup-w-plnet:conn recovered

I'm not really a PERL programmer, so I may have botched the above regular expressions, but does anyone have any
ideas why this might be happening?

Thanks,
Ken
list Ryan Novosielski · Fri, 24 Jan 2014 09:08:18 -0500 · 
It's certainly that first host entry there. The way I prevent this on my site is %(host1|host2|host3).example.com. Using FQDN's, you can't really have this kind of problem.

--
____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences*
 || \\UTGERS      |---------------------*O*---------------------
 ||_// Biomedical | Ryan Novosielski - Sr. Systems Programmer
 || \\ and Health | user-46c89e614701@xymon.invalid - 973/972.0922 (2x0922)
 ||  \\  Sciences | OIT/EI-Academic Svcs. - ADMC 450, Newark
▸ quoted from Ken Shackelford
      `'
From: Xymon [xymon-bounces at xymon.com] On Behalf Of Shackelford, Ken [user-bcfca0412b01@xymon.invalid]
Sent: Friday, January 24, 2014 8:49 AM
To: xymon at xymon.com
Subject: [Xymon] Receiving Duplicate Alerts

Hello,

        I have a situation where I’m receiving duplicate alert E-mail for most of my monitored devices.
For example, with the following configuration lines:

$B-list-brn-emea=%(Ballerup-w|Barcelona-w|Berlin-w|Bilbao-w|Bonn-w|Capelle-w|CastlePark-w|Essen-w|Goeppingen-w|Hamburg-w|Hannover-w|Hengelo-w|Huizingen-w|Kista-w|Klagenfurt-w|Leuven-LMS-w|Lindau-w|Linz-w|Madrid-w|Manchester-w|Milano-w|Modena-w|Molndal-w|Moscow-w|Munich-w|Nuernberg-w|Orbassano-w|Prague-w|Rheinfelden-w|s-Hertogenbosch-w|Solihull-w|StPriest-w|Stuttgart-w|Stuttgart-TCNO-w|Toulouse-w|ToulouseKineo-w|Treviso-w|Vejle-w|Velizy-w|Warsaw-w|Wolfsburg-w|Zurich-w)

$B-list-grn-emea=%(Ballerup-w-plnet|Barcelona-w-plnet|Bilbao-w-plnet|Bonn-w-plnet|CastlePark-w-plnet|Goeppingen-w-plnet|Hamburg-w-plnet|Hannover-w-plnet|Hengelo-w-plnet|Huizingen-w-plnet|Kista-w-plnet|Klagenfurt-w-plnet|Linz-w-plnet|Madrid-w-plnet|Manchester-w-plnet|Milano-w-plnet|Modena-w-plnet|Molndal-w-plnet|Moscow-w-plnet|Munich-w-plnet|Nuernberg-w-plnet|Orbassano-w-plnet|Prague-w-plnet|Rheinfelden-w-plnet|s-Hertogenbosch-w-plnet|Solihull-w-plnet|StPriest-w-plnet|Stuttgart-w-plnet|Stuttgart-TCNO-w-plnet|Toulouse-w-plnet|Treviso-w-plnet|Vejle-w-plnet|Velizy-w-plnet|Warsaw-w-plnet|Wolfsburg-w-plnet|Zurich-w-plnet)

HOST=$B-list-brn-emea
        MAIL user-7db41fdac34e@xymon.invalid<mailto:user-7db41fdac34e@xymon.invalid> DURATION>5 REPEAT=1d RECOVERED

HOST=$B-list-grn-emea
        MAIL user-7db41fdac34e@xymon.invalid DURATION>5 REPEAT=1d RECOVERED

Now, if, for example the device Ballerup-w-plnet goes red, I get two mails with identical headers:

Xymon [701628] Ballerup-w-plnet:conn CRITICAL (RED)

And likewise, when it comes back up, I get two messages:

Xymon Ballerup-w-plnet:conn recovered

I’m not really a PERL programmer, so I may have botched the above regular expressions, but does anyone have any
ideas why this might be happening?

Thanks,
Ken
list Jeremy Laidman · Tue, 28 Jan 2014 12:51:35 +1100 ·
▸ quoted from Ryan Novosielski
On 25 January 2014 00:49, Shackelford, Ken <user-bcfca0412b01@xymon.invalid>wrote:

 Hello,

        I have a situation where I’m receiving duplicate alert E-mail for
most of my monitored devices.
For example, with the following configuration lines:


$B-list-brn-emea=%(Ballerup-w

<snip>

$B-list-grn-emea=%(Ballerup-w-plnet
▸ quoted from Ryan Novosielski
Now, if, for example the device Ballerup-w-plnet goes red, I get two mails
with identical headers:

Yes, "ballerup-w-plnet" matches both "ballerup-w" and "ballerup-w-plnet",
because it's a substring match.  You would also get a match on "ballerup-w"
for a hostname of "something-ballerup-w".  If you want it to match exactly,
you need to anchor it to the start and end of the string, using "^" for the
start, and "$" for the end.  For example:

$somelist=%^(host1|host2|host3)$

This means, in English, "start of string, immediately followed by one of
host1, host2, host3, immediately followed by end of string".

With your problem, you probably don't need anchoring to the start, because
the only ambiguity is at the end of the hostname ("ballerup-w" vs
"ballerup-w-plnet").  Nevertheless, to future-proof, you probably should
anchor to the start of the string.

$B-list-brn-emea=%^(Ballerup-w|Barcelona-w|Berlin-w|Bilbao-w|
Bonn-w|Capelle-w|CastlePark-w|Essen-w|Goeppingen-w|Hamburg-
w|Hannover-w|Hengelo-w|Huizingen-w|Kista-w|Klagenfurt-w|Leuven-LMS-w|
Lindau-w|Linz-w|Madrid-w|Manchester-w|Milano-w|Modena-
w|Molndal-w|Moscow-w|Munich-w|Nuernberg-w|Orbassano-w|
Prague-w|Rheinfelden-w|s-Hertogenbosch-w|Solihull-w|StPriest-w|Stuttgart-w|
Stuttgart-TCNO-w|Toulouse-w|ToulouseKineo-w|Treviso-w|
Vejle-w|Velizy-w|Warsaw-w|Wolfsburg-w|Zurich-w)$

and

$B-list-grn-emea=%^(Ballerup-w-plnet|Barcelona-w-plnet|
Bilbao-w-plnet|Bonn-w-plnet|CastlePark-w-plnet|Goeppingen-
w-plnet|Hamburg-w-plnet|Hannover-w-plnet|Hengelo-w-
plnet|Huizingen-w-plnet|Kista-w-plnet|Klagenfurt-w-plnet|
Linz-w-plnet|Madrid-w-plnet|Manchester-w-plnet|Milano-w-
plnet|Modena-w-plnet|Molndal-w-plnet|Moscow-w-plnet|Munich-
w-plnet|Nuernberg-w-plnet|Orbassano-w-plnet|Prague-w-
plnet|Rheinfelden-w-plnet|s-Hertogenbosch-w-plnet|
Solihull-w-plnet|StPriest-w-plnet|Stuttgart-w-plnet|Stuttgart-TCNO-w-plnet|
Toulouse-w-plnet|Treviso-w-plnet|Vejle-w-plnet|Velizy-w-
plnet|Warsaw-w-plnet|Wolfsburg-w-plnet|Zurich-w-plnet)$

Cheers
Jeremy