[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
DURATION rules for specific host alerts
- To: hobbit (at) hswn.dk
- Subject: DURATION rules for specific host alerts
- From: "Gary Baluha" <gumby3203 (at) gmail.com>
- Date: Fri, 22 Jun 2007 10:49:43 -0400
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; b=tbvbxCH7eG5INsmX/HhWUkcm3OD+U3dZpzaqKUmQKztaswCHAVW7aOZEbIniRWEje91OBcs7rfMQQQ+zNdV29jS7mikXsaeiuFthn7HSXwwAxHqqwnXroeB7S6j16AML/oa+dRPgG7AHzyH5h8gKRQxLq/2hlT4nDou+tpTNkkI=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type; b=t2CN3tlNrF+/ShXs9U9f548ZlsbcKZekBGuF1g7dm7T1da+1C43LfyCE+TXJydzlLrGsUJPLVfqAUtyvieEZDQTVGgF/InxdJqMZIs3f8wT3tObO6a5QAoo26Ncb6FkFZInr7r6YQb6Jcp/kZP8DIVNh2MwrrZ1Isy8GZZNLzsU=
Is there a [non-messy] way to set a DURATION rule for a specific host
alert? Basically, what I'm thinking of is something like this:
In hobbit-clients.cfg
HOST=myhost
LOAD 20 30 DURATION>5m
The effect being, the status of the "myhost" cpu alert will only change to
yellow/red if the load is above the appropriate threshold for more than 5
minutes.
There are a few hosts that occasionally will spike above the cpu load
thresholds, but only for a few minutes (usually around 5 min at most), and
then recover on its own. However, I don't want to raise the thresholds,
because a sustained load (more than 10 minutes) at this level _is_ actually
a critical event. It's just not critical if it is just a momentary spike.
My specific example is with cpu load, but it could be for other things too,
such as process counts, memory, or even in some situations, disk space.