[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

hobbit-alerts parsing order



hello list,

i'm having some trouble with my alert priorities. I can't find anything definitive in docs or archives about the order that hobbit-alerts is parsed in (frex, should Service come before Host?). Generally, some rules aren't getting matched on events, and no "STOP"ped rules before them are matching, so I'm not sure why.

ATM i have some host-specific rules near the top that have NO rules for conn.
Later in the file is a SERVICE=conn.
When one of the hosts that matches for HOST= loses conn, i get no alerts.
I had assumed that if a service was left out of a HOST block, then the SERVICE= blocks would catch them. Was this wrong, or have I done something else..?


Thanks,

--
Rob Munsch
Solutions For Progress IT