<p>Did Xymon create the alert? I believe there is a log specifically for this.</p>
<div class="gmail_quote">On Apr 5, 2011 11:45 PM, "Elizabeth Schwartz" <<a href="mailto:betsy.schwartz@gmail.com">betsy.schwartz@gmail.com</a>> wrote:<br type="attribution">> Yesterday we had a red after yellow page all the way up the hierarchy<br>
> immediately. Today we had a red after yellow not page at ALL.<br>> It did page in BB (test is going to both servers during this test<br>> period. Running Xymon 4.3.0 and really hoping to go live ASAP<br>> <br>
> Here are the hist log entries, see it go red at 22:07 for five minutes<br>> <br>> Tue Apr 5 17:32:35 2011 red 1302039155 300<br>> Tue Apr 5 17:37:35 2011 green 1302039455 900<br>> Tue Apr 5 17:52:35 2011 yellow 1302040355 599<br>
> Tue Apr 5 18:02:34 2011 red 1302040954 601<br>> Tue Apr 5 18:12:35 2011 yellow 1302041555 1199<br>> Tue Apr 5 18:32:34 2011 red 1302042754 900<br>> Tue Apr 5 18:47:34 2011 yellow 1302043654 12002<br>> Tue Apr 5 22:07:36 2011 red 1302055656 300<br>
> Tue Apr 5 22:12:36 2011 yellow 1302055956<br>> <br>> History shows critical status:<br>> Tue Apr 5 22:07:36 EDT 2011 OTHER Applications ( "mysqle1" ): CRITICAL<br>> <br>> And it paged and emailed earlier in the evening: (domain name elided).<br>
> It paged correctly at 6:34 and 6:45 but nothing at 10:07:<br>> <br>> Tue Apr 5 17:34:28 2011 db0.other (10.100.4.51) techops[160] 1302039268 0<br>> Tue Apr 5 17:34:28 2011 db0.com.other (10.100.4.51) alert1[162] 1302039268 0<br>
> Tue Apr 5 17:37:35 2011 db0.other (10.100.4.51) techops[160] 1302039455 0 300<br>> Tue Apr 5 17:52:35 2011 db0.other (10.100.4.51) techops[160] 1302040355 0<br>> Tue Apr 5 17:52:35 2011 db0.other (10.100.4.51) ticket[161] 1302040355 0<br>
> Tue Apr 5 18:04:18 2011 db0.other (10.100.4.51) techops[160] 1302041058 0<br>> Tue Apr 5 18:04:18 2011 db0.other (10.100.4.51) alert1[162] 1302041058 0<br>> Tue Apr 5 18:34:18 2011 db0.other (10.100.4.51) alert1[162] 1302042858 0<br>
> Tue Apr 5 18:34:18 2011 db0.other (10.100.4.51) alert2[163] 1302042858 0<br>> Tue Apr 5 18:34:18 2011 db0.other (10.100.4.51) alert3[164] 1302042858 0<br>> Tue Apr 5 18:45:02 2011 db0.other (10.100.4.51) alert1[162] 1302043502 0<br>
> Tue Apr 5 18:45:02 2011 db0.other (10.100.4.51) alert2[163] 1302043502 0<br>> Tue Apr 5 18:45:02 2011 db0.other (10.100.4.51) alert3[164] 1302043502 0<br>> <br>> <br>> And here are lines 159-165 in the hobbit-alerts.cfg:<br>
> HOST=%^db EXHOST=%.*dl2.example* SERVICE=other<br>> MAIL techops REPEAT=1d RECOVERED<br>> MAIL ticket REPEAT=1d COLOR=yellow # open<br>> ticket email<br>> MAIL alert1 REPEAT=10 COLOR=red,purple FORMAT=SMS# page onshift or<br>
> oncall at start RED, rep every 10 minutes<br>> MAIL alert2 DURATION>20 REPEAT=10 COLOR=red,purple FORMAT=SMS# page<br>> secondary after 20 mins RED . Repevery 10 minutes<br>> MAIL alert3 DURATION>40 REPEAT=10 COLOR=red,purple FORMAT=SMS# page<br>
> tertiary after 40 mins RED. Rep every 10mins<br>> MAIL alert4 DURATION>60 REPEAT=10 COLOR=red,purple FORMAT=SMS# page<br>> team after 60 mins RED. Rpt every 10mins<br>> <br>> <br>> I don't believe it was acked or signed out. It' s a complex custom test<br>
> _______________________________________________<br>> Xymon mailing list<br>> <a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>> <a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</div>