I understand perfectly what you're saying, but what I'm getting at is there are no differences (in Hobbit's POV) between "the bad "flopping" red-->yellow-->red-->yellow" and the green -> red -> green of that update being installed.<br>
<br>Is there a way you can have the server that is updating its spam definitions call to Hobbit and have it disable the monitoring for the next short while? How are the spam definitions updated?<br><br>Josh<br><br><div><span class="gmail_quote">On 2/19/08, <b class="gmail_sendername">Walter Appleby</b> <<a href="mailto:walterappleby@yahoo.com">walterappleby@yahoo.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Updates come when they come.. no set schedule. Sometimes only a few a day, sometimes several an hour depending on how spammy of a day it is I guess.</div> <div> </div> <div>I'm not trying to catch a desired cycle vs. a bad recycle. What I need is to catch the bad "flopping" red-->yellow-->red-->yellow... which indicates a real problem. At present the DURATION>2m keyword is masking the system problems where quick color flopping (meaning no one state exists for longer than 2 mins) occurs. I need to use the DURATION keyword to mask the spam update recycles... but it's masking too much when the quick red-->yellow-->red-->yellow situation occurs.</div>
<div> </div> <div>Does that make any more sense?</div> <div> </div> <div>Sorry if I was unclear.</div> <div> </div> <div>Thanks,</div> <div>Danny</div><div><span class="e" id="q_118329c4552ad302_1"> <div><br><br>
<b><i>Josh Luthman <<a href="mailto:josh@imaginenetworksllc.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">josh@imaginenetworksllc.com</a>></i></b> wrote:</div>
<blockquote style="border-left: 2px solid rgb(16, 16, 255); padding-left: 5px; margin-left: 5px;">I don't see how it would be possible for Hobbit to differentiate between a desired recycle and a bad recycle. Is there any set time where the spam definitions are done? You should be able to schedule an alert to avoid the unwanted alert if you do the updates at a certain time peroid.<br>
<br> <div><span class="gmail_quote">On 2/19/08, <b class="gmail_sendername">Walter Appleby</b> <<a href="mailto:walterappleby@yahoo.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">walterappleby@yahoo.com</a>> wrote:</span> <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Scenario:</div> <div> We have several mail servers that are doing spam filtering. When they receive a spam definition update there is a brief recycle of the smtp services. This causes Hobbit's smtp test to go "colorful" (red or
yellow). </div> <div> To avoid being notified every time there was a momentary blip due to this update cycle I setup an alert rule as follows:</div> <div> PAGE=mail_servers</div> <div> MAIL <my <a href="mailto:address@my" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">address@my</a> domain> SERVICE=smtp DURATION>2m</div>
<div> </div> <div>This works as desired by suppressing alerts for times when the smtp service goes from green to red or yellow and then back to green in less than two minutes.</div> <div> </div> <div> </div> <div>PROBLEM:</div>
<div> The above rule does not alert me when the smtp service goes from green to red for 1 min, then red to yellow for 1 min, then yellow back to red for 1 min...
etc. In this case since no one event is longer than two minutes I'm not getting alerts even though my servers are non-green for a longer period of time. The way I understand the DURATION keyword is that it keeps a timer on the present state (red, yellow, purple) and that when the state changes the timer is reset. What I want is a way to keep track of the total duration of non-green events. Whereas a blip when the smtp service recycles is acceptable, I need to know if it struggles to return to green afterward.</div>
<div> </div> <div>DESIRED STATE:</div> <div> I want to be alerted when the smtp service is anything other than green for more than two minutes. This could be a single red or yellow event lasting more than two minutes or it could be a string of connected red and yellow events that when combined are greater than two minutes in length.</div>
<div> </div> <div>Any help you can offer is
appreciated. If you need more info or clarification please let me know.</div> <div> </div> <div>Thanks,</div> <div>Danny</div><span> <div></div> <hr size="1"> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. <a href="http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">Try it now.</a> <div>
</div></span></blockquote></div><br><br clear="all"><br>-- <br>Josh Luthman<br>Office: 937-552-2340<br>Direct: 937-552-2343<br>1100 Wayne St<br>Suite 1337<br>Troy, OH 45373<br><br>Those who don't understand UNIX are condemned to reinvent it, poorly.<br>
--- Henry Spencer </blockquote><br></span></div><span class="ad"><p>
</p><hr size="1">Never miss a thing. <a href="http://us.rd.yahoo.com/evt=51438/*http://www.yahoo.com/r/hs" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> Make Yahoo your homepage.</a>
<p></p></span></blockquote></div><br><br clear="all"><br>-- <br>Josh Luthman<br>Office: 937-552-2340<br>Direct: 937-552-2343<br>1100 Wayne St<br>Suite 1337<br>Troy, OH 45373<br><br>Those who don't understand UNIX are condemned to reinvent it, poorly.<br>
--- Henry Spencer