Hi guys,<br><br>I stand corrected by myself after having been woken up just a few minutes ago. Seems that using those rules let an alert through. I just tested with 'bbcmd hobbitd-alert --test $HOST disk --color=yellow' and indeed it was not OK. Changed 'STOP' to 'IGNORE' and it seems to work as expected.<br>
<br>--- cut here ---<br>HOST=junkyard-starbox-v_trash<br> MAIL=cto@junkyard.tld<br> IGNORE<br>--- and here ---<br><br>-- <br>kN<br><br><div class="gmail_quote">On Thu, Jan 28, 2010 at 11:55 PM, Kii NODA <span dir="ltr"><<a href="mailto:kii.noda@gmail.com">kii.noda@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi everyone,<br><br>After doing some testing I can say we've elegantly solved the problem caused by "HOST=%^asd$" matching both hosts named "asd" and "asdf" despite the "$" at the end. We've added a "STOP" rule at the end of the "special" rules that only alert CTO & CEO of Junkyard.<br>
<br>The problem still remains, however.<br><br>The new, most elegant ruleset thus far, follows:<br><br>--- cut here ---<div class="im"><br>HOST=junkyard-starbox-v_trash<br> MAIL=cto@junkyard.tld<br></div> STOP<div class="im">
<br><br>HOST=junkyard-starbox-x_dustbin<br>
MAIL=ceo@junkyard.tld<br></div> STOP<br><br>HOST=*<br> MAIL=stars@sysadmins.tld REPEAT=60 RECOVERED NOTICE COLOR=purple,yellow<br> MAIL=stars@sysadmins.tld REPEAT=10 RECOVERED NOTICE COLOR=red<br> MAIL=cto@sysadmins.tld DURATION>60 REPEAT=60 RECOVERED NOTICE COLOR=purple,yellow<br>
MAIL=cto@sysadmins.tld DURATION>30 REPEAT=60 RECOVERED NOTICE COLOR=red<br>--- and here ---<div><div></div><div class="h5"><br><br><br><div class="gmail_quote">On Thu, Jan 28, 2010 at 10:45 PM, Kii NODA <span dir="ltr"><<a href="mailto:kii.noda@gmail.com" target="_blank">kii.noda@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi everyone,<br><br>As you may have already been aware by now, we're here to stay. :)<br>
<br>Here's one interesting problem (and maybe simple) for you: We've seen that "HOST=%^asd$" matches both hosts named "asd" and "asdf", not respecting the "$" at the end. Can you guys please confirm that regex matching for "HOST=" does not care about the "$" sign?<br>
<br>For those that need some expanded case-study (all others can now stop), here's the story behind: we are managing various servers of ours and our customers. Due to the fact that we do not control DNS entries for all these machines we have come up with a naming scheme like this:<br>
<br>
--- cut here ---<br>junkyard-starbox # clientID=junkyard, starbox=actual machine<br>junkyard-starbox-v_trash # v_trash=vserver named trash running on starbox<br>junkyard-starbox-v_trashcan # v_trashcan=vserver named trashcan running on starbox<br>
junkyard-starbox-x_dustbin # x_dustbin=xen server running on starbox<br>--- and here ---<br><br>We need to send these "special" alerts:<br>* ONLY cto@junkyard.tld for events on junkyard-starbox-v_trash<br>* ONLY ceo@junkyard.tld for events on junkyard-starbox-x_dustbin<br>
<br>Also, we need to send these alerts for all other hosts & events:<br>* stars@sysadmins.tld for purple, yellow & red w/ REPEAT=60<br>* cto@sysadmins.tld for red w/ DURATION>30 and REPEAT=60<br>* cto@sysadmins.tld for yellow&purple w/ DURATION>60 and REPEAT=60<br>
<br>Exercising our brain muscles we came up with these:<br>--- cut here ---<br>#alert CTO for v_trash<br>HOST=junkyard-starbox-v_trash<br> MAIL=cto@junkyard.tld<br><br>#alert CEO for x_dustbin<br>HOST=junkyard-starbox-x_dustbin<br>
MAIL=ceo@junkyard.tld<br><br>#stop alerting for the private boxes above<br>HOST=*<br> IGNORE HOST=%^junkyard-starbox-(v_trash|x_dustbin)$<br><br>HOST=* COLOR=purple,yellow<br> MAIL=stars@sysadmins.tld REPEAT=60 RECOVERED NOTICE<br>
MAIL=cto@sysadmins.tld DURATION>60 REPEAT=60 RECOVERED NOTICE<br><br>HOST=* COLOR=red<br> MAIL=stars@sysadmins.tld REPEAT=10 RECOVERED NOTICE<br> MAIL=cto@sysadmins.tld DURATION>30 REPEAT=60 RECOVERED NOTICE<br>
--- and here ---<br><br>However, even with the "$" at the end of our regex we are no longer receiving any alerts for v_trashcan because the regex wrongly matches on the "IGNORE HOST=" line. We could use 2 lines to match each host on its own line but that's not the point of this exercise.<br>
<br>So, can anyone confirm our finding?<br></blockquote></div></div></div></blockquote><div> </div></div><br>