Weird email alerts issue

10 messages in this thread

list Wes Neal · Mon, 22 Mar 2021 10:01:15 -0400 ·

Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
        MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
        MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
        MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
        MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022]
1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?

list Malcolm Hunter · Mon, 22 Mar 2021 16:30:34 +0000 ·

SERVICE and TIME need to go on the same line as HOST

e.g.
HOST=$rcontrol TIME=W:1300:2200 SERVICE=conn DURATION>10
        MAIL $rcontrolpage REPEAT=1h


On Mon, 22 Mar 2021 at 14:09, Neal, Jonathan W via Xymon <xymon at xymon.com>
wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue

▸ quoted from Wes Neal

Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
        MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
        MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
        MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
        MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022]
1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?


---------- Forwarded message ----------
From: "Neal, Jonathan W via Xymon" <xymon at xymon.com>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: [Xymon] Weird email alerts issue

list Wes Neal · Mon, 22 Mar 2021 12:51:31 -0400 ·

Not sure what you mean, I have 100s of rules setup like this they have
always worked.  I want the first line to be working at all times and you
can see if has a different notification alias.
The page alias is the one with a specific time frame.

I don't think this is the issue.

Thanks for the reply though.

On Mon, Mar 22, 2021 at 12:30 PM Malcolm Hunter <user-7aa9cd20ba3a@xymon.invalid>

▸ quoted from Malcolm Hunter

wrote:

SERVICE and TIME need to go on the same line as HOST

e.g.
HOST=$rcontrol TIME=W:1300:2200 SERVICE=conn DURATION>10
        MAIL $rcontrolpage REPEAT=1h


On Mon, 22 Mar 2021 at 14:09, Neal, Jonathan W via Xymon <xymon at xymon.com>
wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
        MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
        MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
        MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
        MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022]
1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?


---------- Forwarded message ----------
From: "Neal, Jonathan W via Xymon" <xymon at xymon.com>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: [Xymon] Weird email alerts issue


<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=LwjhQ01TR9Vhmm46Y_nkiTmave547oP54aN1_422NMQ&m=JcUe519s-NMXjbfIrlQsJXNYtervf_PYa0sFVeDTY7I&s=Aj-3OlzLKUqQDgq7M0AeEDghPGBuuJ9nutBwGjiCM1g&e=>;

-- 

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

list Malcolm Hunter · Mon, 22 Mar 2021 18:09:34 +0000 ·

Ah my mistake - I missed the 1 line at the bottom of the man page. Is there
a possibility any of the env variables is not set?

▸ quoted from Wes Neal


On Mon, 22 Mar 2021 at 16:51, Neal, Jonathan W <user-9e31f92d698c@xymon.invalid> wrote:

Not sure what you mean, I have 100s of rules setup like this they have
always worked.  I want the first line to be working at all times and you
can see if has a different notification alias.
The page alias is the one with a specific time frame.

I don't think this is the issue.

Thanks for the reply though.

On Mon, Mar 22, 2021 at 12:30 PM Malcolm Hunter <
user-7aa9cd20ba3a@xymon.invalid> wrote:

SERVICE and TIME need to go on the same line as HOST

e.g.
HOST=$rcontrol TIME=W:1300:2200 SERVICE=conn DURATION>10
        MAIL $rcontrolpage REPEAT=1h


On Mon, 22 Mar 2021 at 14:09, Neal, Jonathan W via Xymon <xymon at xymon.com>
wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
        MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
        MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
        MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
        MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but
it also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166)
SERVICE=conn[1022] 1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing
it?


---------- Forwarded message ----------
From: "Neal, Jonathan W via Xymon" <xymon at xymon.com>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: [Xymon] Weird email alerts issue

<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=LwjhQ01TR9Vhmm46Y_nkiTmave547oP54aN1_422NMQ&m=JcUe519s-NMXjbfIrlQsJXNYtervf_PYa0sFVeDTY7I&s=Aj-3OlzLKUqQDgq7M0AeEDghPGBuuJ9nutBwGjiCM1g&e=>;

--

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

list Wes Neal · Mon, 22 Mar 2021 19:26:05 -0400 ·

No, none of that has changed.  All I did was re-work the alerts.cfg file
itself.  I wish there was a syntax checker or a way to see why xymond was
trying to email the wrong recipients.

On Mon, Mar 22, 2021 at 2:10 PM Malcolm Hunter <user-7aa9cd20ba3a@xymon.invalid>

▸ quoted from Malcolm Hunter

wrote:

Ah my mistake - I missed the 1 line at the bottom of the man page. Is
there a possibility any of the env variables is not set?

On Mon, 22 Mar 2021 at 16:51, Neal, Jonathan W <user-9e31f92d698c@xymon.invalid>
wrote:

Not sure what you mean, I have 100s of rules setup like this they have
always worked.  I want the first line to be working at all times and you
can see if has a different notification alias.
The page alias is the one with a specific time frame.

I don't think this is the issue.

Thanks for the reply though.

On Mon, Mar 22, 2021 at 12:30 PM Malcolm Hunter <
user-7aa9cd20ba3a@xymon.invalid> wrote:

SERVICE and TIME need to go on the same line as HOST

e.g.
HOST=$rcontrol TIME=W:1300:2200 SERVICE=conn DURATION>10
        MAIL $rcontrolpage REPEAT=1h


On Mon, 22 Mar 2021 at 14:09, Neal, Jonathan W via Xymon <
xymon at xymon.com> wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
        MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
        MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
        MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
        MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but
it also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166)
SERVICE=conn[1022] 1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing
it?


---------- Forwarded message ----------
From: "Neal, Jonathan W via Xymon" <xymon at xymon.com>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: [Xymon] Weird email alerts issue

<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=LwjhQ01TR9Vhmm46Y_nkiTmave547oP54aN1_422NMQ&m=JcUe519s-NMXjbfIrlQsJXNYtervf_PYa0sFVeDTY7I&s=Aj-3OlzLKUqQDgq7M0AeEDghPGBuuJ9nutBwGjiCM1g&e=>;

--

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=9MlONP1ksoPl8xsZgFx8K3-ZKlIfEuSEvwZ44PuiMsU&m=XU554saxMsnaejJKTvPwG7G7djGW0iNJ117zfJaxa2w&s=7kJeaxEh9s66MDnwBiVXM7-czgcEdQeygbpBNrNaQm8&e=

▸ quoted from Malcolm Hunter

-- 

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

list Becker Christian · Tue, 23 Mar 2021 07:20:20 +0000 ·

Don't you need a COLOR condition to alert on?

Regards
Christian

list Wes Neal · Tue, 23 Mar 2021 06:43:13 -0400 ·

Not that I am aware of.  It defaults to alerting on RED if that is what you
have in your config file.

On Tue, Mar 23, 2021 at 3:20 AM Becker Christian <

▸ quoted from Wes Neal

user-e4a19bfb94c0@xymon.invalid> wrote:

Don't you need a COLOR condition to alert on?

Regards
Christian

-- 

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

list Clovis Otteson · Tue, 23 Mar 2021 09:55:34 -0400 ·

▸ quoted from Wes Neal

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
         MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
         MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
         MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
         MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022]
1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?

Does the value of $rcontrol or $sms-ems-oncall end with a comma?

list Wes Neal · Wed, 24 Mar 2021 07:29:18 -0400 ·

It does not, but I did figure out the issue this morning.  Somehow when I
re-did all the rules I didn't even create an $sms-ems-oncall alias, so that
is why it was trying to message SERVICE=conn.  Pretty sure it is working as
intended now.  Thanks for the reply!

▸ quoted from Clovis Otteson


On Tue, Mar 23, 2021 at 10:02 AM Clovis Otteson <user-a5af9a0e854c@xymon.invalid> wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure
out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a
new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
         MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
         MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
         MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
         MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022]
1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?

Does the value of $rcontrol or $sms-ems-oncall end with a comma?


https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=9MlONP1ksoPl8xsZgFx8K3-ZKlIfEuSEvwZ44PuiMsU&m=vvQK3E5pYNAI5a_TbWsGRhy24QmlT8ZVuXb5869xnoA&s=Xr6xi9-tzSOnd2qjZlr3tPVria9_1V9WlGW4czRFJII&e=

▸ quoted from Wes Neal

-- 

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid

list Malcolm Hunter · Wed, 24 Mar 2021 12:06:16 +0000 ·

That's what I meant when I asked if one of the environment variables is not
set.

On Wed, 24 Mar 2021 at 11:29, Neal, Jonathan W via Xymon <xymon at xymon.com>

▸ quoted from Wes Neal

wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: Clovis Otteson <user-a5af9a0e854c@xymon.invalid>
Cc: "xymon at xymon.com" <xymon at xymon.com>


Bcc:
Date: Wed, 24 Mar 2021 07:29:18 -0400
Subject: Re: [E] Re: [Xymon] Weird email alerts issue

▸ quoted from Wes Neal

It does not, but I did figure out the issue this morning.  Somehow when I
re-did all the rules I didn't even create an $sms-ems-oncall alias, so that
is why it was trying to message SERVICE=conn.  Pretty sure it is working as
intended now.  Thanks for the reply!

On Tue, Mar 23, 2021 at 10:02 AM Clovis Otteson <user-a5af9a0e854c@xymon.invalid> wrote:

---------- Forwarded message ----------
From: "Neal, Jonathan W" <user-9e31f92d698c@xymon.invalid>
To: "xymon >> xymon at xymon.com" <xymon at xymon.com>
Cc:
Bcc:
Date: Mon, 22 Mar 2021 10:01:15 -0400
Subject: Weird email alerts issue
Running Xymon 4.3.28, have been since release.  I rebuilt my alerts.cfg
file from scratch and I have a weird issue with alerts I can't figure
out.

This seems to be happening on most if not all entries where I have a
SERVICE=conn.  The only thing I really changed on all my entries was a
new
mail alias for them, the actual rule itself is the same as before.

Entry looks like this:

HOST=$rcontrol
         MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED
         MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d
         MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h
TIME=W:1300:2200
         MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d

I get an alert, it emails the proper people tied to $rcontrolmail, but
it
also tries to email SERVICE=conn .

I can see them in the email log.

Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166)

SERVICE=conn[1022]

1616420829 300

Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725]
1616417943 100

Anyone got an idea how to troubleshoot this or what might be causing it?

Does the value of $rcontrol or $sms-ems-oncall end with a comma?


https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman_listinfo_xymon&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=9MlONP1ksoPl8xsZgFx8K3-ZKlIfEuSEvwZ44PuiMsU&m=vvQK3E5pYNAI5a_TbWsGRhy24QmlT8ZVuXb5869xnoA&s=Xr6xi9-tzSOnd2qjZlr3tPVria9_1V9WlGW4czRFJII&e=

--

<http://www.verizon.com>;

Wes Neal
Engineer IV Spec-Ntwk Eng&Ops
EMS Support

O 8139871162
user-9e31f92d698c@xymon.invalid


---------- Forwarded message ----------
From: "Neal, Jonathan W via Xymon" <xymon at xymon.com>
To: Clovis Otteson <user-a5af9a0e854c@xymon.invalid>
Cc: "xymon at xymon.com" <xymon at xymon.com>


Bcc:
Date: Wed, 24 Mar 2021 07:29:18 -0400
Subject: Re: [Xymon] [E] Re:  Weird email alerts issue

Weird email alerts issue 🔗 link

Weird email alerts issue