how to define a catch-all in hobbit-alerts.cfg

7 messages in this thread

list Bill Wagner · Tue, 20 Oct 2009 15:50:08 -0500 ·

I have rules defined for many of my 300+ hosts ( a mix of windows and unix servers scattered throughout, and interleaved across,  multiple pages.  I want to define a default rule for hosts so that, for example, every conn alert goes to my unix administrators.  I have experimented with several solutions which do not yield the desired result.  e.g.:

HOST=* EXHOST=<>  # I can't explicitly list all hosts (too many) and tried macros consisting of wildcard host names
   MAIL ...

HOST=* EXHOST=<>
    MAIL ... UNMATCHED

if I use only HOST=* then I end up with multiple (sometimes redundant) recipients for some hosts and no recipients for hosts not previously explicitly defined.

Help?

thanks

list Thomas Kähn · Wed, 21 Oct 2009 08:29:38 +0200 ·

Hi Bill,

▸ quoted from Bill Wagner


On Tue, Oct 20, 2009 at 10:50:08PM +0200, Bill Wagner wrote:

I have rules defined for many of my 300+ hosts ( a mix of windows and unix servers scattered throughout, and interleaved across,  multiple pages.  I want to define a default rule for hosts so that, for example, every conn alert goes to my unix administrators.  I have experimented with several solutions which do not yield the desired result.  e.g.:

HOST=* EXHOST=<>  # I can't explicitly list all hosts (too many) and tried macros consisting of wildcard host names
   MAIL ...

HOST=* EXHOST=<>
    MAIL ... UNMATCHED

if I use only HOST=* then I end up with multiple (sometimes redundant) recipients for some hosts and no recipients for hosts not previously explicitly defined.

simply group the servers on different pages and match using PAGE=...

Best regards
Thomas
-- 
Thomas Kähn
Technik, Network Engineering & Design; Content Delivery Platform & IP
NETCOLOGNE Gesellschaft für Telekommunikation mbH
Am Coloneum 9 | 50829 Köln
Tel: XXXX XXXX-XXXX | Fax: XXXX XXXX-XXXXX
www.netcologne.de

Geschäftsführer:
Werner Hanf
Dipl.-Ing. Karl-Heinz Zankel

HRB 25580, AG Köln


Diese Nachricht (inklusive aller Anhänge) ist vertraulich. Sollten
Sie diese Nachricht versehentlich erhalten haben, bitten wir, den
Absender (durch Antwort-E-Mail) hiervon unverzüglich zu informieren
und die Nachricht zu löschen. Die E-Mail darf in diesem Fall weder
vervielfältigt noch in anderer Weise verwendet werden.

list Henrik Størner · Wed, 21 Oct 2009 20:30:17 +0000 (UTC) ·

▸ quoted from Bill Wagner

In <user-8dab721eebe5@xymon.invalid> Bill Wagner <user-5db7d172e22d@xymon.invalid> writes:

I have rules defined for many of my 300+ hosts ( a mix of windows and unix servers scattered throughout, and interleaved across,  multiple pages.  I want to define a default rule for hosts so that, for example, every conn alert goes to my unix administrators.  I have experimented with several solutions which do not yield the desired result.  e.g.:

HOST=* EXHOST=<>  # I can't explicitly list all hosts (too many) and tried macros consisting of wildcard host names
  MAIL ...

HOST=* EXHOST=<>
   MAIL ... UNMATCHED

if I use only HOST=* then I end up with multiple (sometimes redundant) recipients for some hosts and no recipients for hosts not previously explicitly defined.


Not sure if I understand you correctly, but I *think* you want a
default rule that triggers only if there are no other rules that
apply. Correct ?

In that case, the following should do it:

	HOST=* SERVICE=conn
		MAIL user-4d430f56ac28@xymon.invalid UNMATCHED

The UNMATCHED keyword means that this alert only triggers if no other
rules applied.


Regards,
Henrik

list Ricardas Vaitkus · Thu, 22 Oct 2009 09:46:50 +0300 ·

Hi all.

I am running bb-roracle.ksh skript on several servers. The problem is that
on some servers it uses way too much cpu. It is on the top of table "prstat
-s cpu". Has any one had the same problem, or now that is the problem?

P.S. server is SunOS 5.10

Thanks in advance.
Ricardas

list Marco Avvisano · Thu, 22 Oct 2009 11:18:56 +0200 ·

Hi,

one question .. is possible to use msg to monitor logs not available in 
the Windows Event Viewer ?

thanks for help

Marco

list Bill Wagner · Thu, 22 Oct 2009 08:22:59 -0500 ·

I agree that would simplify things.  However we are using (inherited from Big Brother) fairly heterogeneous PAGEs.
Bill

▸ quoted from Thomas Kähn


-------- Original Message --------
Subject: Re: [hobbit] how to define a catch-all in hobbit-alerts.cfg
From: Thomas Kähn <user-04e2bc8a3755@xymon.invalid>
To: user-ae9b8668bcde@xymon.invalid <user-ae9b8668bcde@xymon.invalid>
Date: 10/21/2009 1:29 AM

Hi Bill,

On Tue, Oct 20, 2009 at 10:50:08PM +0200, Bill Wagner wrote:

I have rules defined for many of my 300+ hosts ( a mix of windows and unix servers scattered throughout, and interleaved across,  multiple pages.  I want to define a default rule for hosts so that, for example, every conn alert goes to my unix administrators.  I have experimented with several solutions which do not yield the desired result.  e.g.:

HOST=* EXHOST=<>  # I can't explicitly list all hosts (too many) and tried macros consisting of wildcard host names
   MAIL ...

HOST=* EXHOST=<>
    MAIL ... UNMATCHED

if I use only HOST=* then I end up with multiple (sometimes redundant) recipients for some hosts and no recipients for hosts not previously explicitly defined.

simply group the servers on different pages and match using PAGE=...

Best regards
Thomas

list Bill Wagner · Thu, 22 Oct 2009 10:16:08 -0500 ·

I will be able to define subpages and create rules matching against them.

thanks

▸ quoted from Bill Wagner


-------- Original Message --------
Subject: Re: [hobbit] how to define a catch-all in hobbit-alerts.cfg
From: Bill Wagner <user-5db7d172e22d@xymon.invalid>
To: user-ae9b8668bcde@xymon.invalid
Date: 10/22/2009 8:22 AM

I agree that would simplify things.  However we are using (inherited from Big Brother) fairly heterogeneous PAGEs.
Bill

-------- Original Message --------
Subject: Re: [hobbit] how to define a catch-all in hobbit-alerts.cfg
From: Thomas Kähn <user-04e2bc8a3755@xymon.invalid>
To: user-ae9b8668bcde@xymon.invalid <user-ae9b8668bcde@xymon.invalid>
Date: 10/21/2009 1:29 AM

Hi Bill,

On Tue, Oct 20, 2009 at 10:50:08PM +0200, Bill Wagner wrote:

I have rules defined for many of my 300+ hosts ( a mix of windows and unix servers scattered throughout, and interleaved across,  multiple pages.  I want to define a default rule for hosts so that, for example, every conn alert goes to my unix administrators.  I have experimented with several solutions which do not yield the desired result.  e.g.:

HOST=* EXHOST=<>  # I can't explicitly list all hosts (too many) and tried macros consisting of wildcard host names
   MAIL ...

HOST=* EXHOST=<>
    MAIL ... UNMATCHED

if I use only HOST=* then I end up with multiple (sometimes redundant) recipients for some hosts and no recipients for hosts not previously explicitly defined.

simply group the servers on different pages and match using PAGE=...

Best regards
Thomas

how to define a catch-all in hobbit-alerts.cfg 🔗 link

how to define a catch-all in hobbit-alerts.cfg