<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2722" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=192084618-05102005><FONT face=Arial size=2>Is it normal to get
two alert messages if an event matches two rules? Is there a keyword to suppress
multiple alert emails from the same event? I've been running 4.0 for a while,
but just getting in to configuring alerts. My hobbit-alerts.cfg includes
the following:</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial size=2>HOST=*
SERVICE=conn</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005>
<FONT face=Arial size=2>MAIL <A
href="mailto:sbrehm@titan.com">sbrehm@titan.com</A>
COLOR=red</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2>HOST=%atscm</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005>
<FONT face=Arial size=2>MAIL <A
href="mailto:sbrehm@titan.com">sbrehm@titan.com</A>
COLOR=red</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005>
<FONT face=Arial size=2>MAIL <A
href="mailto:person2@titan.com">person2@titan.com</A>
COLOR=red</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2>HOST=%atscs</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005>
<FONT face=Arial size=2>MAIL <A
href="mailto:sbrehm@titan.com">sbrehm@titan.com</A>
COLOR=red</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005>
<FONT face=Arial size=2>MAIL <A
href="mailto:person3@titan.com">person3@titan.com</A>
COLOR=red</FONT></SPAN></DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=192084618-05102005><FONT face=Arial size=2>I want alerts for
any connection problems, but only want alerts for other hosts if they come from
two specific sets of hosts. Unfortunately I'm getting a match for both the first
rule and the second or third rule when there is conn alert for one of the two.
I'm now using EXSERVICE=conn for myself on rules two and three, but still
curious.</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV><FONT size=2>
<P align=left>Scott Brehm</P>
<P align=left>IT Manager<BR>L3 Communications - Titan (ATS/ATAG)<BR>3394 Carmel
Mountain Rd, San Diego CA, 92121<BR>858-720-4035</P></FONT>
<DIV> </DIV></BODY></HTML>