Xymon Mailing List Archive search

Getting doubled alerts

9 messages in this thread

list Scott Brehm · Wed, 5 Oct 2005 15:27:07 -0700 · 
Is it normal to get two alert messages if an event matches two rules? Is
there a keyword to suppress multiple alert emails from the same event?
I've been running 4.0 for a while, but just getting in to configuring
alerts. My hobbit-alerts.cfg includes the following:
 
HOST=* SERVICE=conn
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
 
HOST=%atscm
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-e7eda2829196@xymon.invalid COLOR=red
 
HOST=%atscs
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-78aee4d399ab@xymon.invalid COLOR=red
 
I want alerts for any connection problems, but only want alerts for
other hosts if they come from two specific sets of hosts. Unfortunately
I'm getting a match for both the first rule and the second or third rule
when there is conn alert for one of the two. I'm now using
EXSERVICE=conn for myself on rules two and three, but still curious.
 
Scott Brehm

IT Manager
L3 Communications - Titan (ATS/ATAG)
XXXX Carmel Mountain Rd, San Diego CA, 92121
XXX-XXX-XXXX
list Allan Spencer · Thu, 06 Oct 2005 15:19:23 +1000 ·
▸ quoted from Scott Brehm
Brehm, Scott wrote:

Is it normal to get two alert messages if an event matches two rules? Is there a keyword to suppress multiple alert emails from the same event? I've been running 4.0 for a while, but just getting in to configuring alerts. My hobbit-alerts.cfg includes the following:
 HOST=* SERVICE=conn

        MAIL user-43f0e15c2cc9@xymon.invalid <mailto:user-43f0e15c2cc9@xymon.invalid> COLOR=red
 HOST=%atscm
        MAIL user-43f0e15c2cc9@xymon.invalid <mailto:user-43f0e15c2cc9@xymon.invalid> COLOR=red
        MAIL user-e7eda2829196@xymon.invalid <mailto:user-e7eda2829196@xymon.invalid> COLOR=red
 HOST=%atscs
        MAIL user-43f0e15c2cc9@xymon.invalid <mailto:user-43f0e15c2cc9@xymon.invalid> COLOR=red
        MAIL user-78aee4d399ab@xymon.invalid <mailto:user-78aee4d399ab@xymon.invalid> COLOR=red
▸ quoted from Scott Brehm
 I want alerts for any connection problems, but only want alerts for other hosts if they come from two specific sets of hosts. Unfortunately I'm getting a match for both the first rule and the second or third rule when there is conn alert for one of the two. I'm now using EXSERVICE=conn for myself on rules two and three, but still curious.
 
Scott Brehm

IT Manager
L3 Communications - Titan (ATS/ATAG)
XXXX Carmel Mountain Rd, San Diego CA, 92121
XXX-XXX-XXXX

 
There is/was a STOP statement on a rule I think but not sure if its still there and if it will do what you want it to

Allan
list Henrik Størner · Thu, 6 Oct 2005 07:22:49 +0200 ·
▸ quoted from Allan Spencer
On Wed, Oct 05, 2005 at 03:27:07PM -0700, Brehm, Scott wrote:
Is it normal to get two alert messages if an event matches two rules? 
Yes.
▸ quoted from Allan Spencer
Is there a keyword to suppress multiple alert emails from the same event?
I've been running 4.0 for a while, but just getting in to configuring
alerts. My hobbit-alerts.cfg includes the following:
 
HOST=* SERVICE=conn
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
 
HOST=%atscm
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-e7eda2829196@xymon.invalid COLOR=red
 
HOST=%atscs
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-78aee4d399ab@xymon.invalid COLOR=red
 
I want alerts for any connection problems, but only want alerts for
other hosts if they come from two specific sets of hosts. 
As you've found out yourself, EXSERVICE=conn on the two host-specific
rules will do it. Instead, you could also use the keyword "STOP" with
the "conn" rule - like

 HOST=* SERVICE=conn
         MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red STOP
  
This will make the alert-handler stop looking for recipients after your
general "conn" rule has been matched.


Henrik
list Arun Sopanrao Nale · Thu, 6 Oct 2005 14:09:38 +0530 · 
HI,

Can we monitor applications running on VAX using Hobbit or BB.


Thanks and regards
Arun Sopanrao Nale
Tata Consultancy Services Limited
Mailto: user-329612cb6ba1@xymon.invalid
Website: http://www.tcs.com

Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information.   If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited.   If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments.  Thank you
list Henrik Størner · Thu, 6 Oct 2005 13:11:14 +0200 · 
On Thu, Oct 06, 2005 at 02:09:38PM +0530, user-329612cb6ba1@xymon.invalid wrote:
Can we monitor applications running on VAX using Hobbit or BB.
There are two ways of monitoring: Either by looking at your server
across the network (e.g. requesting a webpage, trying to connect to
a mail server etc); or by running some script locally on your VAX
that performs some local checks - e.g. if a certain process or job
is running.

Network based monitoring is built into Hobbit, so if you setup a
Hobbit server, it will be able to monitor all of the common TCP/IP
based services. And even some of the not-so-common ones :-)

Running a script locally means that you must 1) create such a 
script; and 2) you need a tool to feed the result of your script
into Hobbit. This combination is what we call a Hobbit "client",
and Hobbit includes client packages for most of the common Unix-
like operating systems.

Would it be possible to create a client package for a VAX ? Sure,
but I'd need some help from you. You know how to monitor a VAX
(it's been 15 years since I last touched one of those), so you could
probably come up with a script that checks what the load and disk
utilisation is on the box; and what processes and tasks are active.

Second, we need a C compiler for the VAX. Is GNU C (gcc) available?
With a C compiler, you can try to build the Hobbit client programs.
It might require some tweaking to get the Makefile right for the
client, but once that is done you'll have the program needed to
send your status from the VAX over to Hobbit.


Regards,
Henrik
list Mark Deiss · Thu, 6 Oct 2005 08:20:27 -0500 · 
There are around three(?) VMS BB clients on deadcat of various vintages -
don't know if they are built for Alphas and/or VAXs - or the version of VMS.
You "may" get lucky and one of them "may" support VAX architecture. If you
find a usable VAX BB client, then that should take care of the transport
mechanism out of the VAX client; you will still need to hack on the VAX
tests to get the messages into a format that hobbit accepts (or hack on the
hobbit server side to handle the VAX messaging).

Assuming that there is no VAX C license/compiler - may need to drill into HP
support concerning a GNU C port for VAX. There were (still past tense?)
issues trying to compile GNU products using the VAX C libraries.

If none of the above are practical, maybe you can get a fairly recent
version of perl ~5.003+ onto the VAX. For this, you may be able to use the
Big Sister perl-based client to handle transport out of the VAX. Mr. Aeby's
BS code can get pretty wild - you may have to resort to grabbing an older BS
release if there is too much strain using the current BS offerings with
possibly dated perl release on your VAX.
▸ quoted from Henrik Størner

-----Original Message-----
From: user-ce4a2c883f75@xymon.invalid [mailto:user-ce4a2c883f75@xymon.invalid]
Sent: Thursday, October 06, 2005 7:11 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] VAX Client


On Thu, Oct 06, 2005 at 02:09:38PM +0530, user-329612cb6ba1@xymon.invalid wrote:
Can we monitor applications running on VAX using Hobbit or BB.
There are two ways of monitoring: Either by looking at your server
across the network (e.g. requesting a webpage, trying to connect to
a mail server etc); or by running some script locally on your VAX
that performs some local checks - e.g. if a certain process or job
is running.

Network based monitoring is built into Hobbit, so if you setup a
Hobbit server, it will be able to monitor all of the common TCP/IP
based services. And even some of the not-so-common ones :-)

Running a script locally means that you must 1) create such a 
script; and 2) you need a tool to feed the result of your script
into Hobbit. This combination is what we call a Hobbit "client",
and Hobbit includes client packages for most of the common Unix-
like operating systems.

Would it be possible to create a client package for a VAX ? Sure,
but I'd need some help from you. You know how to monitor a VAX
(it's been 15 years since I last touched one of those), so you could
probably come up with a script that checks what the load and disk
utilisation is on the box; and what processes and tasks are active.

Second, we need a C compiler for the VAX. Is GNU C (gcc) available?
With a C compiler, you can try to build the Hobbit client programs.
It might require some tweaking to get the Makefile right for the
client, but once that is done you'll have the program needed to
send your status from the VAX over to Hobbit.


Regards,
Henrik
list Scott Brehm · Fri, 7 Oct 2005 09:45:32 -0700 ·
▸ quoted from Henrik Størner
Is there a keyword to suppress multiple alert emails from the same event?
I've been running 4.0 for a while, but just getting in to configuring
alerts. My hobbit-alerts.cfg includes the following:
HOST=* SERVICE=conn
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
HOST=%atscm
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-e7eda2829196@xymon.invalid COLOR=red
HOST=%atscs
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-78aee4d399ab@xymon.invalid COLOR=red
I want alerts for any connection problems, but only want alerts for
other hosts if they come from two specific sets of hosts. 
As you've found out yourself, EXSERVICE=conn on the two host-specific
rules will do it. Instead, you could also use the keyword "STOP" with
the "conn" rule - like

 HOST=* SERVICE=conn
         MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red STOP
  This will make the alert-handler stop looking for recipients after your
general "conn" rule has been matched.


Henrik


Will placing the STOP as shown stop looking for just conn events or all
events? And for just sbrehm or for all persons? In the example I still
need to notify person2 and person3 of connection problems with their
systems.

Scott
list Henrik Størner · Fri, 7 Oct 2005 19:03:16 +0200 ·
▸ quoted from Scott Brehm
On Fri, Oct 07, 2005 at 09:45:32AM -0700, Brehm, Scott wrote:
alerts. My hobbit-alerts.cfg includes the following:
 
HOST=* SERVICE=conn
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
 
HOST=%atscm
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-e7eda2829196@xymon.invalid COLOR=red
 
HOST=%atscs
        MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        MAIL user-78aee4d399ab@xymon.invalid COLOR=red
 
I want alerts for any connection problems, but only want alerts for
other hosts if they come from two specific sets of hosts. 
As you've found out yourself, EXSERVICE=conn on the two host-specific
rules will do it. Instead, you could also use the keyword "STOP" with
the "conn" rule - like

 HOST=* SERVICE=conn
         MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red STOP
  
This will make the alert-handler stop looking for recipients 
after your general "conn" rule has been matched.
Will placing the STOP as shown stop looking for just conn events or all
events? And for just sbrehm or for all persons? In the example I still
need to notify person2 and person3 of connection problems with their
systems.
The STOP condition triggers when it is used - i.e. it will only have
effect for "conn" tests, since it is inside a rule that has
"SERVICE=conn". But if you need to alert person2 and person3 of "conn"
problems, then you cannot use the STOP keyword.

Another way to avoid the duplicate alerts might be to restrict your 
general rule to not include the two special hosts:

	HOST=* EXHOST=atscm,atcsc SERVICE=conn
▸ quoted from Scott Brehm
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
 
	HOST=%atscm
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        	MAIL user-e7eda2829196@xymon.invalid COLOR=red
 
	HOST=%atscs
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        	MAIL user-78aee4d399ab@xymon.invalid COLOR=red


So ... several ways of doing the same thing. You choose which one
matches your thinking best :-)


Regards,
Henrik
list Scott Brehm · Fri, 7 Oct 2005 12:05:46 -0700 · 
Food for thought. Thanks
▸ signature

Scott Brehm

IT Manager
L3 Communications - Titan (ATS/ATAG)
XXXX Carmel Mountain Rd, San Diego CA, 92121
XXX-XXX-XXXX

 
-----Original Message-----
▸ quoted from Henrik Størner
From: Henrik Stoerner [mailto:user-ce4a2c883f75@xymon.invalid] Sent: Friday, October 07, 2005 10:03 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] Getting doubled alerts

The STOP condition triggers when it is used - i.e. it will only have
effect for "conn" tests, since it is inside a rule that has
"SERVICE=conn". But if you need to alert person2 and person3 of "conn"
problems, then you cannot use the STOP keyword.

Another way to avoid the duplicate alerts might be to restrict your general rule to not include the two special hosts:

	HOST=* EXHOST=atscm,atcsc SERVICE=conn
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
 	HOST=%atscm
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        	MAIL user-e7eda2829196@xymon.invalid COLOR=red
 	HOST=%atscs
        	MAIL user-43f0e15c2cc9@xymon.invalid COLOR=red
        	MAIL user-78aee4d399ab@xymon.invalid COLOR=red

So ... several ways of doing the same thing. You choose which one
matches your thinking best :-)


Regards,
Henrik