Combining Macros in alerts.cfg EXHOST? 🔗 link

I'm trying to make my alerts.cfg a lot simpler.

I've got two macros defining groups of hosts. To simplify slightly:

        $NOPAGE=%(^*.eng|^netmon2).example.com
        $VIP=%(^web|^ftp|^mail-relay).example.com,web-vip,mail-vip

Each macro works by itself when I use it in a rule. However I want to
make a rule that groups these two together, something like so:

        HOST=* EXHOST=%($VIP,$NOPAGE) SERVICE=$SYSENG
         include syseng.escalation.cfg

I'm not getting this to work , with various combinations :
    %($NOPAGE,$VIP)
    %($NOPAGE|$VIP)

The rules are catching hosts in $NOPAGE but not in $VIP
I could make a third combined group, but since I've got other rules
that just apply to $VIP or $NOPAGE it would be nice to be able to do
this

thanks for any clues
Betsy

You don't need the %(...) stuff. You are already wildcarding it in the macro. 

HOST=* EXHOST=$VIP,$NOPAGE ...


Paul Root    - Senior Engineer
Managed Services Systems - CenturyLink

-----Original Message-----
From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On
Behalf Of Betsy Schwartz
Sent: Tuesday, November 27, 2012 2:33 PM
To: xymon at xymon.com
Subject: [Xymon] Combining Macros in alerts.cfg EXHOST?

Hm, thanks. I had %( in the rules because I defined the macro without
the %, thinking that might help use | to glue two together. I
initially tried it with two separate macros defined with  %(  but I
still get a match when I think I should not.

$NOPAGE=%(^xymon.eng.*|^sm05.*|.*ad.example.com)
$VIP=%(^ftp|^images|^mail-relay|^mail-router|^wiki).example.com

[xymon at xymon-dev1 ~]$ /usr/local/xymon/server/bin/xymond_alert --test
wiki.example.com http -color=red | grep -B5 Mail
00031698 2012-11-27 17:58:15 *** Match with 'HOST=*
EXHOST=$NOPAGE,$VIP SERVICE=$TECHOPS_TESTS' ***
00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page
'wiki.example.com:http:NONE:business' against rule line 222
00031698 2012-11-27 17:58:15 Failed 'MAIL xymail repeat=8h
COLOR=yellow FORMAT=TEXT' (color)
00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page
'wiki.example.com:http:NONE:business' against rule line 223
00031698 2012-11-27 17:58:15 *** Match with 'MAIL xymail repeat=5m
COLOR=red FORMAT=TEXT' ***
00031698 2012-11-27 17:58:15 Mail alert with command
'/var/spool/mail/xymon "Xymon [12345] wiki.example.com:http CRITICAL
(RED)" xymail'
00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page
'wiki.example.com:http:NONE:business' against rule line 224
00031698 2012-11-27 17:58:15 *** Match with 'MAIL alert1 REPEAT=10
COLOR=red FORMAT=SMS' ***
00031698 2012-11-27 17:58:15 Mail alert with command 'mail alert1'
--
00031698 2012-11-27 17:58:15 *** Match with 'HOST=wiki.example.com
SERVICE=conn,http' ***
00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page
'wiki.example.com:http:NONE:business' against rule line 335
00031698 2012-11-27 17:58:15 Failed 'MAIL xymail REPEAT=1d
COLOR=yellow FORMAT=TEXT' (color)
00031698 2012-11-27 17:58:15 Matching host:service:dgroup:page
'wiki.example.com:http:NONE:business' against rule line 336
00031698 2012-11-27 17:58:15 *** Match with 'MAIL sysengoncall
REPEAT=10 COLOR=red,purple FORMAT=SMS' ***
00031698 2012-11-27 17:58:15 Mail alert with command 'mail sysengoncall'

When I create the rather horrible:
$NOPAGEANDVIP=%(^xymon.eng.*|^sm05.*|.*ad.example.com)|(^ftp|^images|^mail-relay|^mail-router|^wiki).example.com

the test does work as expected

00000469 2012-11-27 18:05:35 Failed 'HOST=* EXHOST=$NOPAGEANDVIP
SERVICE=$TECHOPS_TESTS' (hostname excluded)

(I know I can simplify that last regexp, just put it in for proof-of-concept)

Going to go redefine my host lists now but it would be nice to get this to work

On 28 November 2012 07:32, Betsy Schwartz <user-c61747246f66@xymon.invalid> wrote:

I'm not getting this to work , with various combinations :
    %($NOPAGE,$VIP)

Can you use a comma in this context?  If so, this is news to me, and I
don't think it's reflected in the doco.  If not, it could explain why your
$VIP is not matching, although I don't know

    %($NOPAGE|$VIP)

I think this should work, as long as you remove the percent (%) from the
macros, and as long as the commas in $VIP are addressed (assuming commas
are invalid).  So:

   $NOPAGE=(^.*eng|^netmon2).example.com
   $VIP=(^web|^ftp|^mail-relay).example.com|web-vip|mail-vip
   HOST=* EXHOST=%($NOPAGE|$VIP) ...

[I'm assuming you had a typo in your NOPAGE definition: "^*.eng" should be
"^.*eng"]

You can simplify these regexps by putting the caret only once at the start:

   $NOPAGE=^(.*eng|netmon2).example.com
   $VIP=^(web|ftp|mail-relay).example.com|web-vip|mail-vip

Or even moving the carets to the EXHOST definition:

   $NOPAGE=(*.eng|netmon2).example.com
   $VIP=(web|ftp|mail-relay).example.com|web-vip|mail-vip
   HOST=* EXHOST=%^($NOPAGE|$VIP) ...

Cheers
Jeremy

On Tue, Nov 27, 2012 at 6:55 PM, Jeremy Laidman
<user-71895fb2e44c@xymon.invalid> wrote:

   $NOPAGE=(^.*eng|^netmon2).example.com
   $VIP=(^web|^ftp|^mail-relay).example.com|web-vip|mail-vip
   HOST=* EXHOST=%($NOPAGE|$VIP) ...

OK that does work thank you!!

(funny, that's what I thought I'd tested FIRST... maybe there was a
second error that I created and eliminated along the way. My eyes are
starting to glaze over with this rewrite, but I've gotten the
alerts.cfg down to 81 active lines from 133.... and that includes
several new additions)