[Xymon] Annyoing logic in alerts.cfg

[Even Hauge Juberg]

Thank you for your reply!


Yes, I believe I did try that, but it actually sending a "recovered" to all users in the list, but I must've misconfigured something or simply remembering wrong. It seems to be working just as I want it now, I did add the "RECOVERED" to one user on the list - som maybe that did the trick?


Sincerely

Even



________________________________
Fra: Galen Johnson <Galen.Johnson at sas.com>
Sendt: 27. mars 2017 15:49
Til: Even Hauge Juberg; xymon at xymon.com
Emne: Re: Annyoing logic in alerts.cfg


Have you tried removing the recovered stanza?  I thought Xymon only sent a recovered message if you explicitly tell it to on the alert itself:


HOST=*
     MAIL someuser at example.com DURATION>10 REPEAT=30 RECOVERED UNMATCHED


Check other rules to see if you are overriding it somewhere by telling it to explicitly send recover messages.


NB: I had thought there was a global setting somewhere that would default it to on but I can't find it


Basically, try commenting out


HOST=* RECOVERED=1
        IGNORE HOST=*?

and see if it behaves like you want.


=G=


________________________________
From: Xymon <xymon-bounces at xymon.com> on behalf of Even Hauge Juberg <even.juberg at ntnu.no>
Sent: Monday, March 27, 2017 8:04 AM
To: xymon at xymon.com
Subject: [Xymon] Annyoing logic in alerts.cfg


Hi!


I've been using Xymon for years and have recently begun to play around with the alerts.cfg, however, there is something I have been banging my head against the wall with, for weeks now. So I am reaching out to this list in the hopes that someone out there might have the key to save me from eternal frustration.


*snippet from my alerts.cfg*


HOST=* RECOVERED=1
        IGNORE HOST=*

HOST=one-host SERVICE=http
        MAIL someuser at domain.local COLOR=red
        MAIL someuser at domain.local DURATION>5 COLOR=red


What I'm trying to accomplish is to stop the "I'm OK - recovered" messages. Those messages are irrelevant, so I want those filtered out. The problem though, is that the logic is completely off on this point. The first rule for some reason takes presedense, even though I have explicitly told it to only use that rule IF the host has recovered, no?

I want it to skip that rule, if it has not yet recovered, send mail to the first user immediately, then to the other user after 5 minutes, but leave those users alone if the service is OK again. Is there a way to accomplish this?

Sincerely,
Even

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20170328/fbd4de41/attachment.html>