Xymon Mailing List Archive search

hobbit-alerts.cfg regex/MACRO problem - need help

9 messages in this thread

list Charles Jones · Thu, 09 Nov 2006 14:59:38 -0700 · 
I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)


Here is how I am using it for the actual alert definition:

HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms


I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$


This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest":

$ pcretest
PCRE version 6.6 06-Feb-2006

  re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>

As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it.

*However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section.  *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red

00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging

00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' ***

00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170

00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' ***

00009993 2006-11-09 21:48:30 Mail alert with command 'mail user-8488fc2902b5@xymon.invalid'

00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200)

...

00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded)


* Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work either.

If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong.

-Charles
list Charles Jones · Wed, 15 Nov 2006 11:03:11 -0700 · 
I'm still having this problem. If anyone has any ideas I'm open to suggestions :)

-Charles
▸ quoted from Charles Jones

Charles Jones wrote:
I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:
$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)

  Here is how I am using it for the actual alert definition:
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms

  I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$

  This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest":
$ pcretest
PCRE version 6.6 06-Feb-2006

  re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it.

*However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section.  *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' ***
00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' ***
00009993 2006-11-09 21:48:30 Mail alert with command 'mail user-8488fc2902b5@xymon.invalid'
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded)

* Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work either.

If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong.

-Charles
list Jason Altrincham Jones · Thu, 16 Nov 2006 09:06:23 -0000 · 
Total guess here but maybe you could try changing:
▸ quoted from Charles Jones

 
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms

 

To:

 
HOST=%(prod-.*) EXHOST=%$UNUSED_PROD
▸ quoted from Charles Jones
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms
 

And obv remove the % from the start of $UNUSED_PROD, just "my 2 cents
worth"
 
Thanks,
Jason.
▸ quoted from Charles Jones


From: Charles Jones [mailto:user-e86b4aeade4e@xymon.invalid] 
Sent: 15 November 2006 18:03
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] hobbit-alerts.cfg regex/MACRO problem - need help

 
I'm still having this problem. If anyone has any ideas I'm open to
suggestions :)

-Charles

Charles Jones wrote: 

I am trying to use a regex macro to exclude a number of hosts from an
alert.  Here is the one I was using at first:



$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod
-web-(1|2|3|4|9|10|11)
▸ quoted from Charles Jones
 
  
Here is how I am using it for the actual alert definition:


HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms
 
  
I ran into a problem with the host "prod-app-12" matching the regex. I
realized this was because I was not terminating the numbers, so I
changed my variable to:



$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|pro
d-web-(1|2|3|4|9|10|11)$
▸ quoted from Charles Jones
 
  
This SHOULD work according to online regex testing tools, and I also at
Henriks advice, verified it using "pcretest":


$ pcretest
PCRE version 6.6 06-Feb-2006
 
  re>

/prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|
4|9|10|11)$/
▸ quoted from Charles Jones
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  

As seen above, the host "prod-web-12" does NOT match, but "prod-web-11"
DOES, which is exactly how I want it. 

However, when I use this in hobbit-alerts.cfg. I do not get the expected
behavior. Instead, ALL hosts match, according to pages sent out and from
viewing the "info" section.  The strange thing is, according to
hobbitd_alert --test, the hostname was successfully excluded, but
clicking on the "info" column for hosts that are supposed to be excluded
reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*'
***
00009993 2006-11-09 21:48:30 Matching host:service:page
'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red
REPEAT=60 RECOVERED NOTICE format=sms' ***
00009993 2006-11-09 21:48:30 Mail alert with command 'mail
user-8488fc2902b5@xymon.invalid'
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red
DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration
0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=*
EXHOST=$UNUSED_PROD' (hostname excluded)


* Another thing, when I do the same test as above, using hostname
"prod-web-12", which is a host that should NOT be excluded,
hobbitd_alert still says that it was excluded (same last line of output
as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work
either.

If anyone has any insight, please let me know. I have contacted Henrik
about this, but I believe he misread my email, as he suggested that I
add $ to the regex, which I had already tried...so now I am hoping that
he or someone else sees this message and can see what Im doing wrong.

-Charles
list Charles Jones · Thu, 16 Nov 2006 10:21:52 -0700 · 
I gave that a try, didn't work :( I'm pretty much out of ideas, I'm hoping when Henrik gets time he can help me troubleshoot this.

-Charles
▸ quoted from Jason Altrincham Jones

Jones, Jason (Altrincham) wrote:
Total guess here but maybe you could try changing:

 
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms

 
To:

 
HOST=%(prod-.*) EXHOST=%$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms
 And obv remove the % from the start of $UNUSED_PROD, just "my 2 cents worth"
 Thanks,
Jason.

*From:* Charles Jones [mailto:user-e86b4aeade4e@xymon.invalid]
*Sent:* 15 November 2006 18:03
*To:* user-ae9b8668bcde@xymon.invalid
*Subject:* Re: [hobbit] hobbit-alerts.cfg regex/MACRO problem - need help

 
I'm still having this problem. If anyone has any ideas I'm open to suggestions :)

-Charles

Charles Jones wrote:

I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)
   
Here is how I am using it for the actual alert definition:

HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms
   
I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to:


$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$
   
This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest":

$ pcretest
PCRE version 6.6 06-Feb-2006
   re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  
As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it.

*However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section.  *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' ***
00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' ***

00009993 2006-11-09 21:48:30 Mail alert with command 'mail user-8488fc2902b5@xymon.invalid <mailto:user-8488fc2902b5@xymon.invalid>'
▸ quoted from Jason Altrincham Jones
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded)


* Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work either.

If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong.

-Charles
list Jason Altrincham Jones · Fri, 17 Nov 2006 11:48:52 -0000 · 
Ye but Henrik is currently doing a lot of development for clustering
hobbit servers, or something similar so he doesn't have much time (he
E-mailed the list a little while ago explaining).
 
$UNUSED_PROD=(prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod
-web-(1|2|3|4|9|10|11))
▸ quoted from Charles Jones
 
HOST=%prod-.* EXHOST=%$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms
 

Also try putting the full UNUSED_PROD string in the HOST... line to see
if it's a problem with the use of that variable? Do you really need
those extra dollar signs in the regex you put below?
 
4 cents worth now :-)
▸ quoted from Charles Jones
 
Thanks,
Jason.


From: Charles Jones [mailto:user-e86b4aeade4e@xymon.invalid] 
Sent: 16 November 2006 17:22
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] hobbit-alerts.cfg regex/MACRO problem - need help

 
I gave that a try, didn't work :( I'm pretty much out of ideas, I'm
hoping when Henrik gets time he can help me troubleshoot this.

-Charles

Jones, Jason (Altrincham) wrote: 

Total guess here but maybe you could try changing:

 
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms

 
To:

 
HOST=%(prod-.*) EXHOST=%$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms
 
And obv remove the % from the start of $UNUSED_PROD, just "my 2 cents
worth"
 
Thanks,
Jason.


From: Charles Jones [mailto:user-e86b4aeade4e@xymon.invalid] 
Sent: 15 November 2006 18:03
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] hobbit-alerts.cfg regex/MACRO problem - need help

 
I'm still having this problem. If anyone has any ideas I'm open to
suggestions :)

-Charles

Charles Jones wrote: 

I am trying to use a regex macro to exclude a number of hosts from an
alert.  Here is the one I was using at first:


$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod
-web-(1|2|3|4|9|10|11)
 
  
Here is how I am using it for the actual alert definition:


HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE
format=sms
 
  
I ran into a problem with the host "prod-app-12" matching the regex. I
realized this was because I was not terminating the numbers, so I
changed my variable to:


$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|pro
d-web-(1|2|3|4|9|10|11)$
 
  
This SHOULD work according to online regex testing tools, and I also at
Henriks advice, verified it using "pcretest":


$ pcretest
PCRE version 6.6 06-Feb-2006
 
  re>
/prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|
4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  

As seen above, the host "prod-web-12" does NOT match, but "prod-web-11"
DOES, which is exactly how I want it. 

However, when I use this in hobbit-alerts.cfg. I do not get the expected
behavior. Instead, ALL hosts match, according to pages sent out and from
viewing the "info" section.  The strange thing is, according to
hobbitd_alert --test, the hostname was successfully excluded, but
clicking on the "info" column for hosts that are supposed to be excluded
reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*'
***
00009993 2006-11-09 21:48:30 Matching host:service:page
'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red
REPEAT=60 RECOVERED NOTICE format=sms' ***
00009993 2006-11-09 21:48:30 Mail alert with command 'mail
user-8488fc2902b5@xymon.invalid'
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red
DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration
0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=*
EXHOST=$UNUSED_PROD' (hostname excluded)


* Another thing, when I do the same test as above, using hostname
"prod-web-12", which is a host that should NOT be excluded,
hobbitd_alert still says that it was excluded (same last line of output
as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work
either.

If anyone has any insight, please let me know. I have contacted Henrik
about this, but I believe he misread my email, as he suggested that I
add $ to the regex, which I had already tried...so now I am hoping that
he or someone else sees this message and can see what Im doing wrong.

-Charles
list Charles Jones · Wed, 29 Nov 2006 09:53:19 -0700 · 
As of today this problem is still a thorn in my side. I've been out sick this week so just now working on it again.
▸ quoted from Charles Jones

Charles Jones wrote:
I'm still having this problem. If anyone has any ideas I'm open to suggestions :)

-Charles

Charles Jones wrote:
I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:
$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)

  Here is how I am using it for the actual alert definition:
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms

  I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$

  This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest":
$ pcretest
PCRE version 6.6 06-Feb-2006

  re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it.

*However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section.  *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' ***
00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' ***
00009993 2006-11-09 21:48:30 Mail alert with command 'mail user-8488fc2902b5@xymon.invalid'
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded)

* Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work either.

If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong.

-Charles
list Charles Jones · Wed, 06 Dec 2006 10:29:13 -0700 · 
I offer $5 via paypal to anyone who can help me figure this out.  :-)

-Charles
▸ quoted from Charles Jones

Charles Jones wrote:
As of today this problem is still a thorn in my side. I've been out sick this week so just now working on it again.

Charles Jones wrote:
I'm still having this problem. If anyone has any ideas I'm open to suggestions :)

-Charles

Charles Jones wrote:
I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:
$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)

  Here is how I am using it for the actual alert definition:
HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD
     MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms
     MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms

  I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to:

$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$

  This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest":
$ pcretest
PCRE version 6.6 06-Feb-2006

  re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/
data> prod-web-12
No match
data> prod-web-11
 0: prod-web-11
 1: <unset>
 2: 11
data>
  As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it.

*However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section.  *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert.

../bin/hobbitd_alert --test prod-web-11 procs --color-red
00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging
00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' ***
00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170
00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' ***
00009993 2006-11-09 21:48:30 Mail alert with command 'mail user-8488fc2902b5@xymon.invalid'
00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200)
...
00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded)

* Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above).

I have also tried enclosing the regex in quotes, which didn't work either.

If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong.

-Charles
list Charles Goyard · Wed, 6 Dec 2006 18:46:59 +0100 · 
Hi,

Try:

$UNUSED_PROD1=prod-app-2|3|4||5|6|7|8|9|(10)|(11)|(12)|(18)|(20)|(21)|(22)|(23)|(24)
$UNUSED_PROD2=prod-web-1|2|3|4|9|(10)|(11)

and include both macros in you rule as two distinct regexes (separated
with commas I guess).

I did not try :).
▸ quoted from Charles Jones


Charles Jones wrote :
I offer $5 via paypal to anyone who can help me figure this out.  :-)
I am trying to use a regex macro to exclude a number of hosts from 
an alert.  Here is the one I was using at first:
$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)
-- 

Charles Goyard - user-98f9625a7a59@xymon.invalid - (+33) 1 45 38 01 31
list Charles Jones · Wed, 06 Dec 2006 10:57:09 -0700 · 
This is nuts but I tried the original fix again and this time it worked...I could swear that I tried this many times before and it definitely was not working as it should. Ah well maybe its a good thing I took a couple of weeks off before I looked at it again.

Heres what is working:
UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$
HOST=%(cna-prod-.*) SERVICE=*                                                                                                  
     MAIL $PRIMARY EXHOST=$UNUSED_PROD color=red REPEAT=60 RECOVERED NOTICE format=sms                                             MAIL $SECONDARY EXHOST=$UNUSED_PROD color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms
     MAIL user-90d22b039161@xymon.invalid color=red REPEAT=60 RECOVERED NOTICE
                                              -Charles
▸ quoted from Charles Goyard

Charles Goyard wrote:
Hi,

Try:

$UNUSED_PROD1=prod-app-2|3|4||5|6|7|8|9|(10)|(11)|(12)|(18)|(20)|(21)|(22)|(23)|(24)
$UNUSED_PROD2=prod-web-1|2|3|4|9|(10)|(11)

and include both macros in you rule as two distinct regexes (separated
with commas I guess).

I did not try :).


Charles Jones wrote :
  
I offer $5 via paypal to anyone who can help me figure this out.  :-)
    
I am trying to use a regex macro to exclude a number of hosts from an alert.  Here is the one I was using at first:
$UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11)