<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I just built a new hobbit server with 4.1.2p1 and I am still seeing the
behavior of, if you enable or disable "all" services for a host, it
does not trigger the NOTICE rule and thus no email is sent out. Below
are the last 2 messages I sent reporting this problem.<br>
<br>
-Charles<br>
<br>
Charles Jones wrote:
<blockquote cite="mid4373A65D.2060603@cisco.com" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
I am stiil trying to troubleshoot my missing enable messages, so I
deleted the NOTICE rule mentioned below and created a new rule:<br>
---<br>
# Send me notice alerts of enable and disable<br>
HOST=*<br>
MAIL <a class="moz-txt-link-abbreviated"
href="mailto:me@mydomain.com">me@mydomain.com</a> NOTICE NOALERT<br>
---<br>
<br>
I then proceeded to disable 2 services on a host. I observed that I
received a disable notification, both by actual receipt of the email,
and by tail -f /var/log/maillog.<br>
<br>
Then I enabled the services (by enabling "ALL" for that host),
and...nothing. No mail was sent, as verified by my tailing of the log.<br>
<br>
I then immediately disabled ALL services on another host, and no mail
was sent.<br>
I then immediately re-enabled ALL services on that same host, and no
mail was sent.<br>
<br>
Through testing I discovered that when you disable or enable <u>"ALL"</u>
services on a host, no NOTICE message is generated. If I disable or
disable <u>individual</u> services, notice messages are generated and
an email is sent out.<br>
<br>
If you need me to do further testing, let me know.<br>
<br>
-Charles<br>
<br>
Charles Jones wrote:
<blockquote cite="mid4372B94A.1030708@cisco.com" type="cite">
<meta content="text/html;charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
<div>
<div><span class="955015322-09112005"><font face="Arial" size="2">1.
When I disable a host in hobbit, it says it was disabled by <a
href="mailto:unknown@1.2.3.4">unknown@1.2.3.4</a>.</font></span></div>
<div><span class="955015322-09112005"></span><span
class="955015322-09112005"><font face="Arial" size="2">In the bb
maint.pl script, it had an option to put a username, but I don't see an
option to do this in the Hobbit Maint page, so is "unknown" hard coded,
or does it look for it somewhere else?</font></span></div>
<div><span class="955015322-09112005"></span> </div>
<div><span class="955015322-09112005"><font face="Arial" size="2">2.
I
added the "NOTICE" rule to my hobbit-alerts.cfg</font></span></div>
<div><span class="955015322-09112005"></span> </div>
<div><span class="955015322-09112005"><font face="Arial" size="2">HOST=*
SERVICE=* COLOR=red</font></span></div>
<div><span class="955015322-09112005"><font face="Arial" size="2">MAIL
</font><a href="mailto:me@mydomain.com"><font face="Arial" size="2">me@mydomain.com</font></a><font
face="Arial" size="2"> RECOVERED NOTICE</font></span></div>
<div><span class="955015322-09112005"></span> </div>
<div><span class="955015322-09112005"><font face="Arial" size="2">I
then tested disabling the cpu service for a host, and I received an
email with the disable message:</font></span></div>
<div><span class="955015322-09112005"></span> </div>
<div><span class="955015322-09112005"><font face="Arial" size="2">-----</font></span></div>
<div><span class="955015322-09112005"><font face="Arial" size="2">From:
</font><a href="mailto:hobbit@myhost.com"><font face="Arial"><font
size="2">hobbit@<span class="955015322-09112005">myhost.com</span></font></font></a></span></div>
<div><span class="955015322-09112005"></span><font face="Arial"
size="2">Sent:
Wednesday, November 09, 2005 5:01 PM</font></div>
<div><font face="Arial"><font size="2">To: <span
class="955015322-09112005"><a href="mailto:me@mydomain.com">me@mydomain.com</a></span></font></font></div>
<div><font face="Arial" size="2">Subject: Hobbit <span
class="955015322-09112005">servername</span>:cpu NOTICE</font></div>
<div><font face="Arial"><font size="2"><span
class="955015322-09112005">servername</span>:cpu
INFO</font></font></div>
<div><font face="Arial" size="2">Monitoring of <span
class="955015322-09112005">servername</span>:cpu has been DISABLED by
unknown for 240 minutes</font></div>
<div><font face="Arial"><font size="2">Disabled by: unknown @ <span
class="955015322-09112005">1.2.3.4</span></font></font></div>
<div><span class="955015322-09112005"></span><font face="Arial"
size="2">Reason:
testing disable notice</font></div>
<div><font face="Arial" size="2"><span class="955015322-09112005">-----</span></font></div>
<div><font face="Arial" size="2"><span class="955015322-09112005"></span></font> </div>
<div><font face="Arial" size="2"><span class="955015322-09112005">This
is what I expected to get. However, I then went and re-enabled the
disabled service, and I did not get an email saying it was re-enabled.
I checked the /var/log/maillog to make sure that it wasn't a mail
delay. There simply was no email sent about the enable. I assume this
isn't normal behavior :)</span></font></div>
<div><font face="Arial" size="2"><span class="955015322-09112005"></span></font> </div>
<div><font face="Arial" size="2"><span class="955015322-09112005">-Charles</span></font></div>
</div>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>