Alerting rules - covering 24h interval. 🔗 link

Hi everyone,

In our journey towards completely and successfully deploying Xymon on our
machines we've come over this situation: we want to have an alert coming to
us if the duration is over 30 minutes between 0800 and 2259 AND every 60
minutes between 2300 and 0759 the next day. They need to be repeated every
120 minutes in both cases.

The following group of 3 rules obviously covers what we want to accomplish,
right?
--- cut here ---
        MAIL user-a284eb495264@xymon.invalid DURATION>60 REPEAT=120 RECOVERED NOTICE
TIME=*:0000:0759
        MAIL user-a284eb495264@xymon.invalid DURATION>30 REPEAT=120 RECOVERED NOTICE
TIME=*:0800:2259
        MAIL user-a284eb495264@xymon.invalid DURATION>60 REPEAT=120 RECOVERED NOTICE
TIME=*:2300:2359
--- and here ---

However, we're looking to write the most simple set of rules that would
cover our requirements and would therefore welcome your answers regarding
the following possible variants:

1. Would the following set of rules work given a setting like
"TIME=*:2300:0759"?
--- cut here ---
        MAIL user-a284eb495264@xymon.invalid DURATION>30 REPEAT=120 RECOVERED NOTICE
TIME=*:0800:2259
        MAIL user-a284eb495264@xymon.invalid DURATION>60 REPEAT=120 RECOVERED NOTICE
TIME=*:2300:0759
--- and here ---

2. Or maybe would the following work? In this case, wouldn't this duplicate
alerts that happen to have a duration of 70 minutes, for example?
--- cut here ---
        MAIL user-a284eb495264@xymon.invalid DURATION>30 REPEAT=120 RECOVERED NOTICE
TIME=*:0800:2259
        MAIL user-a284eb495264@xymon.invalid DURATION>60 REPEAT=120 RECOVERED NOTICE
--- and here ---

3. We have also been considering using "STOP" as below but this won't work
when we need to alert 3 similar recipients. Any thoughts?
--- cut here ---
        MAIL user-a284eb495264@xymon.invalid DURATION>30 REPEAT=120 RECOVERED NOTICE
TIME=*:0800:2259 STOP
        MAIL user-a284eb495264@xymon.invalid DURATION>60 REPEAT=120 RECOVERED NOTICE
--- and here ---

We are definitely looking forward to see the answers that users more
experienced than ourselves would provide.
Thanks in advance for your help.
-- 
kN

Hi everyone,

To answer my own question, in short: "TIME=*:2300:0759" is equivalent to
"TIME=*:2300:2400,*:0000:0759" and thus solves our problem. Xymon is indeed
a fine and well-thought piece of software.

Expanded explanation: While RTFM-ing 'man bb-hosts' and 'man
hobbit-alerts.cfg' I could find out that the time format of the alerts has
the same format as DOWNTIME has in bb-hosts which in turn has the same
format as NKTIME. Even more, NKTIME is explicitly allowing the following:

--- cut here ---
The interval between starttime and endtime may cross midnight, e.g.
*:2330:0200 would be valid and have the same effect as
*:2330:2400,*:0000:0200.
--- and here ---

Sorry for the noise, thought I'd mention my findings for future reference.

On Wed, Jan 27, 2010 at 6:55 PM, Kii NODA <user-d20081af5452@xymon.invalid> wrote:

[ snip ]

-- 

kN

You have done a Very Good Thing by posting a question and the answer, even
if you found it yourself.  Now anyone who takes the time to search for this
topic may find your answer!

GLH

On Wed, Jan 27, 2010 at 2:59 PM, Kii NODA <user-d20081af5452@xymon.invalid> wrote:

-- 

Disclaimer:  1) all opinions are my own, 2) I may be completely wrong, 3) my
advice is worth at least as much as what you are paying for it, or your
money cheerfully refunded.