<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Brehm, Scott wrote:
<blockquote
cite="mid109B9877426D22468ADC0617DC38DDD546842F@atscmmail1.ats.ad.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta content="MSHTML 6.00.2900.2722" name="GENERATOR">
<div><span class="192084618-05102005"><font face="Arial" size="2">Is
it normal to get two alert messages if an event matches two rules? Is
there a keyword to suppress multiple alert emails from the same event?
I've been running 4.0 for a while, but just getting in to configuring
alerts. My hobbit-alerts.cfg includes the following:</font></span></div>
<div><span class="192084618-05102005"></span> </div>
<div><span class="192084618-05102005"><font face="Arial" size="2">HOST=*
SERVICE=conn</font></span></div>
<div><span class="192084618-05102005"> <font face="Arial"
size="2">MAIL <a href="mailto:sbrehm@titan.com">sbrehm@titan.com</a>
COLOR=red</font></span></div>
<div><span class="192084618-05102005"></span> </div>
<div><span class="192084618-05102005"><font face="Arial" size="2">HOST=%atscm</font></span></div>
<div><span class="192084618-05102005"> <font face="Arial"
size="2">MAIL <a href="mailto:sbrehm@titan.com">sbrehm@titan.com</a>
COLOR=red</font></span></div>
<div><span class="192084618-05102005"> <font face="Arial"
size="2">MAIL <a href="mailto:person2@titan.com">person2@titan.com</a>
COLOR=red</font></span></div>
<div><span class="192084618-05102005"></span> </div>
<div><span class="192084618-05102005"><font face="Arial" size="2">HOST=%atscs</font></span></div>
<div><span class="192084618-05102005"> <font face="Arial"
size="2">MAIL <a href="mailto:sbrehm@titan.com">sbrehm@titan.com</a>
COLOR=red</font></span></div>
<div><span class="192084618-05102005"> <font face="Arial"
size="2">MAIL <a href="mailto:person3@titan.com">person3@titan.com</a>
COLOR=red</font></span></div>
<div><span class="192084618-05102005"></span> </div>
<div><span class="192084618-05102005"><font face="Arial" size="2">I
want alerts for any connection problems, but only want alerts for other
hosts if they come from two specific sets of hosts. Unfortunately I'm
getting a match for both the first rule and the second or third rule
when there is conn alert for one of the two. I'm now using
EXSERVICE=conn for myself on rules two and three, but still curious.</font></span></div>
<div> </div>
<font size="2">
<p align="left">Scott Brehm</p>
<p align="left">IT Manager<br>
L3 Communications - Titan (ATS/ATAG)<br>
3394 Carmel Mountain Rd, San Diego CA, 92121<br>
858-720-4035</p>
</font>
<div> </div>
</blockquote>
There is/was a STOP statement on a rule I think but not sure if its
still there and if it will do what you want it to <br>
<br>
Allan<br>
</body>
</html>