You can also look in the bb-hosts man pages for the badhttp, badconn tags. <br><br>Thanks,<br>Larry Barber<br><br><div class="gmail_quote">On Mon, Mar 10, 2008 at 2:53 PM, Oliver Grube <<a href="mailto:oliver_grube@campbellsoup.com">oliver_grube@campbellsoup.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>
<p><font size="2">Hi Mark,</font><br>
<br>
<font size="2">see the man page:</font><br>
<br>
</p><table border="0" cellpadding="0" cellspacing="0" width="100%">
<tbody><tr valign="top"><td width="10%"><b>"DURATION</b></td><td valign="middle" width="90%">Rule matching an alert if the event has lasted longer/shorter than the given duration. E.g. <i>DURATION>10m</i> (lasted longer than 10 minutes) or <i>DURATION<2h</i> (only sends alerts the first 2 hours). Unless explicitly stated, this is in minutes - you can use 'm', 'h', 'd' for 'minutes', 'hours' and 'days' respectively.</td>
</tr>
</tbody></table>
<font size="2">"</font><br>
<font size="2">You can configure your alerts only being triggered after a period of time...</font><br>
<br>
<font size="2">eg:</font><br>
<font size="2">HOST=* EXHOST=%(acp.*) EXSERVICE=msgs,cpu</font><br>
<font size="2"> MAIL $helpdesk DURATION>2 REPEAT=60 UNMATCHED COLOR=red FORMAT=plain</font><br>
<font size="2"> MAIL $security DURATION>60 REPEAT=600 COLOR=red UNMATCHED FORMAT=plain </font><br>
<font size="2"> MAIL $manager DURATION>120 REPEAT=600 RECOVERED COLOR=red FORMAT=plain</font><br>
<br>
<font size="2">As you can see in the example, we use this to trigger the escalation process...</font><br>
<br>
<font size="2">Hope this helps!</font><br>
<br>
<font size="2">mit freundlichen Grüßen - Best regards<br>
Hälsningar - Met vriendelijke groeten<br>
Sincères salutations <br>
<br>
Oliver Grube<br>
EU Security&Controls Manager<br>
<br>
<br>
</font><br>
<img alt="Inactive hide details for "Mark Stoltzfus" <mark.stoltzfus@pmigroup.com>" height="16" width="16"><font size="2">"Mark Stoltzfus" <<a href="mailto:mark.stoltzfus@pmigroup.com" target="_blank">mark.stoltzfus@pmigroup.com</a>></font><br>
<br>
<br>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tbody><tr valign="top"><td width="40%">
<ul>
<ul>
<ul>
<ul><b><font size="2">"Mark Stoltzfus" <<a href="mailto:mark.stoltzfus@pmigroup.com" target="_blank">mark.stoltzfus@pmigroup.com</a>></font></b><font size="2"> </font>
<p><font size="2">2008-03-10 20:40</font>
</p><table border="1">
<tbody><tr valign="top"><td bgcolor="#ffffff" width="168"><div align="center"><font size="2">Please respond to<br>
<a href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a></font></div></td></tr>
</tbody></table>
</ul>
</ul>
</ul>
</ul>
</td><td width="60%">
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tbody><tr valign="top"><td width="1%"><img alt="" border="0" height="1" width="58"><br>
<div align="right"><font size="2">To</font></div></td><td width="100%"><img alt="" border="0" height="1" width="1"><br>
<font size="2"><<a href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a>></font></td></tr>
<tr valign="top"><td width="1%"><img alt="" border="0" height="1" width="58"><br>
<div align="right"><font size="2">cc</font></div></td><td width="100%"><img alt="" border="0" height="1" width="1"><br>
</td></tr><td><div class="Ih2E3d">
</div><tr valign="top"><td width="1%"><img alt="" border="0" height="1" width="58"><br>
<div align="right"><font size="2">Subject</font></div></td><td width="100%"><img alt="" border="0" height="1" width="1"><br>
<font size="2">[hobbit] Waiting longer than one polling failure to alert</font></td></tr>
</td></tbody></table>
<table border="0" cellpadding="0" cellspacing="0">
<tbody><tr valign="top"><td width="58"><img alt="" border="0" height="1" width="1"></td><td width="336"><img alt="" border="0" height="1" width="1"></td></tr>
</tbody></table>
</td></tr>
</tbody></table>
<br><div class="Ih2E3d">
<font face="Arial" size="2"> </font> <font face="Arial" size="2">My apologies if this is covered in the docs or in past discussions,</font> <font face="Arial" size="2">my google-fu</font> <font face="Arial" size="2">hasn't come through for me on this one. We're running</font> <font face="Arial" size="2">4.1.2p1, and we have several troublesome hosts that, for whatever reason, are constantly experiencing periodic disconnects with the hobbit server. </font> <font face="Arial" size="2">I'm not too concerned about the disconnects (we have some new firewalls that are probably to blame, and by all other indications, the hosts and services are fine), but we're constantly getting alerts. Is there any way to make hobbit alert on a</font> <font face="Arial" size="2">host or</font> <font face="Arial" size="2">service, only after it's failed</font> <font face="Arial" size="2">two or three times in a row?</font>
<p><font face="Arial" size="2">Thanks in advance,</font>
</p><p><font face="Arial" size="2">Mark</font>
</p><p></p></div></div>
<pre>Campbell's Germany GmbH
Registergericht Luebeck • Reg. Nr. HRB 4082
Geschaeftsfuehrer: Joseph B. Folds III
Geschaeftssitz:
Geniner Strasse 88 - 100
23560 Luebeck
Deutschland
**********************************************************************
This e-mail and any files transmitted with it may contain
confidential information and is intended solely for use by
the individual to whom it is addressed. If you received
this e-mail in error, please notify the sender, do not
disclose its contents to others and delete it from your
system.
**********************************************************************
</pre></blockquote></div><br>