<html><body>
<p><font size="2">Hi Mark,</font><br>
<br>
<font size="2">see the man page:</font><br>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="10%"><b>"DURATION</b></td><td width="90%" valign="middle">Rule matching an alert if the event has lasted longer/shorter than the given duration. E.g. <i>DURATION>10m</i> (lasted longer than 10 minutes) or <i>DURATION<2h</i> (only sends alerts the first 2 hours). Unless explicitly stated, this is in minutes - you can use 'm', 'h', 'd' for 'minutes', 'hours' and 'days' respectively.</td></tr>
</table>
<font size="2">"</font><br>
<font size="2">You can configure your alerts only being triggered after a period of time...</font><br>
<br>
<font size="2">eg:</font><br>
<font size="2">HOST=* EXHOST=%(acp.*) EXSERVICE=msgs,cpu</font><br>
<font size="2"> MAIL $helpdesk DURATION>2 REPEAT=60 UNMATCHED COLOR=red FORMAT=plain</font><br>
<font size="2"> MAIL $security DURATION>60 REPEAT=600 COLOR=red UNMATCHED FORMAT=plain </font><br>
<font size="2"> MAIL $manager DURATION>120 REPEAT=600 RECOVERED COLOR=red FORMAT=plain</font><br>
<br>
<font size="2">As you can see in the example, we use this to trigger the escalation process...</font><br>
<br>
<font size="2">Hope this helps!</font><br>
<br>
<font size="2">mit freundlichen Grüßen - Best regards<br>
Hälsningar - Met vriendelijke groeten<br>
Sincères salutations <br>
<br>
Oliver Grube<br>
EU Security&Controls Manager<br>
<br>
<br>
</font><br>
<img src="cid:10__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" width="16" height="16" alt="Inactive hide details for "Mark Stoltzfus" <mark.stoltzfus@pmigroup.com>"><font size="2">"Mark Stoltzfus" <mark.stoltzfus@pmigroup.com></font><br>
<br>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td style="background-image:url(cid:20__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com); background-repeat: no-repeat; " width="40%">
<ul>
<ul>
<ul>
<ul><b><font size="2">"Mark Stoltzfus" <mark.stoltzfus@pmigroup.com></font></b><font size="2"> </font>
<p><font size="2">2008-03-10 20:40</font>
<table border="1">
<tr valign="top"><td width="168" bgcolor="#FFFFFF"><div align="center"><font size="2">Please respond to<br>
hobbit@hswn.dk</font></div></td></tr>
</table>
</ul>
</ul>
</ul>
</ul>
</td><td width="60%">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="1%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="58" alt=""><br>
<div align="right"><font size="2">To</font></div></td><td width="100%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="1" alt=""><br>
<font size="2"><hobbit@hswn.dk></font></td></tr>
<tr valign="top"><td width="1%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="58" alt=""><br>
<div align="right"><font size="2">cc</font></div></td><td width="100%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="1" alt=""><br>
</td></tr>
<tr valign="top"><td width="1%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="58" alt=""><br>
<div align="right"><font size="2">Subject</font></div></td><td width="100%"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="1" alt=""><br>
<font size="2">[hobbit] Waiting longer than one polling failure to alert</font></td></tr>
</table>
<table border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="58"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="1" alt=""></td><td width="336"><img src="cid:30__=4EBBFE9BDFFF52D58f9e8a93df9386@soups.com" border="0" height="1" width="1" alt=""></td></tr>
</table>
</td></tr>
</table>
<br>
<font size="2" face="Arial"> </font> <font size="2" face="Arial">My apologies if this is covered in the docs or in past discussions,</font> <font size="2" face="Arial">my google-fu</font> <font size="2" face="Arial">hasn’t come through for me on this one. We’re running</font> <font size="2" face="Arial">4.1.2p1, and we have several troublesome hosts that, for whatever reason, are constantly experiencing periodic disconnects with the hobbit server. </font> <font size="2" face="Arial">I’m not too concerned about the disconnects (we have some new firewalls that are probably to blame, and by all other indications, the hosts and services are fine), but we’re constantly getting alerts. Is there any way to make hobbit alert on a</font> <font size="2" face="Arial">host or</font> <font size="2" face="Arial">service, only after it’s failed</font> <font size="2" face="Arial">two or three times in a row?</font>
<p><font size="2" face="Arial">Thanks in advance,</font>
<p><font size="2" face="Arial">Mark</font>
<p></body></html>
<pre>Campbell’s Germany GmbH
Registergericht Luebeck • Reg. Nr. HRB 4082
Geschaeftsfuehrer: Joseph B. Folds III
Geschaeftssitz:
Geniner Strasse 88 - 100
23560 Luebeck
Deutschland
**********************************************************************
This e-mail and any files transmitted with it may contain
confidential information and is intended solely for use by
the individual to whom it is addressed. If you received
this e-mail in error, please notify the sender, do not
disclose its contents to others and delete it from your
system.
**********************************************************************