hobbit-alerts parsing order
list Rob Munsch
hello list, i'm having some trouble with my alert priorities. I can't find anything definitive in docs or archives about the order that hobbit-alerts is parsed in (frex, should Service come before Host?). Generally, some rules aren't getting matched on events, and no "STOP"ped rules before them are matching, so I'm not sure why. ATM i have some host-specific rules near the top that have NO rules for conn. Later in the file is a SERVICE=conn. When one of the hosts that matches for HOST= loses conn, i get no alerts. I had assumed that if a service was left out of a HOST block, then the SERVICE= blocks would catch them. Was this wrong, or have I done something else..? Thanks, -- Rob Munsch Solutions For Progress IT
list Dominique Frise
▸
Rob Munsch wrote:
hello list, i'm having some trouble with my alert priorities. I can't find anything definitive in docs or archives about the order that hobbit-alerts is parsed in (frex, should Service come before Host?). Generally, some rules aren't getting matched on events, and no "STOP"ped rules before them are matching, so I'm not sure why. ATM i have some host-specific rules near the top that have NO rules for conn. Later in the file is a SERVICE=conn. When one of the hosts that matches for HOST= loses conn, i get no alerts. I had assumed that if a service was left out of a HOST block, then the SERVICE= blocks would catch them. Was this wrong, or have I done something else..? Thanks,
You can check your rules using hobbitd_alert. Usage: hobbitd_alert --test HOST SERVICE [duration [color [time]]] More on the man page hobbitd_alert(8) Dominique UNIL - University of Lausanne