<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 6/7/2017 1:29 PM, Asif Iqbal wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAOHBbgVAaDZq7hRMF7XAPrEKkGXF3oufMB0fwZEZWvYoZFkyeA@mail.gmail.com">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Jun 7, 2017 at 4:26 PM, Ryan
Novosielski <span dir="ltr"><<a
href="mailto:novosirj@rutgers.edu" target="_blank"
moz-do-not-send="true">novosirj@rutgers.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">I stop
the MTA sometimes when I know this is about to happen.<br>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>In our case, we do not see a pattern when the firewall
is crashing. </div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
______________________________<wbr>__________<br>
From: Xymon <<a href="mailto:xymon-bounces@xymon.com"
moz-do-not-send="true">xymon-bounces@xymon.com</a>>
on behalf of Asif Iqbal <<a
href="mailto:vadud3@gmail.com" moz-do-not-send="true">vadud3@gmail.com</a>><br>
Sent: Wednesday, June 7, 2017 4:14:43 PM<br>
To: <a href="mailto:xymon@xymon.com"
moz-do-not-send="true">xymon@xymon.com</a><br>
Subject: [Xymon] Avoid email storm<br>
<span class=""><br>
xymon is behind a firewall and lately firewall is dying
a lot and at restore we are getting email storm about
devices that are on other sites.<br>
<br>
firewall team will have a replacement "soon".<br>
<br>
In the meantime I guess I should add a depend (first
hop) for all 2000+ devices in hosts.cfg file.<br>
<br>
Is there another option with less editing?<br>
<br>
Thanks for any suggestion!</span></blockquote>
</div>
</div>
</div>
</blockquote>
<br>
Flap detection and delaying the alert might help, but delayred=
(hosts.cfg(5)) might be a better option for handling this, depending
on the number of network tests you have.<br>
<br>
If the entire server is behind the FW or you have some other
programmatic way of determining what will be on the other side of
this FW, I'd suggest adding (either via route or depends) data in
regardless (you might be able to get creative with sed or perl to
make this addition easier). I've found the more flexibility you can
give yourself in describing what you're testing, the more options
you'll have for coping with situations like this.<br>
<br>
HTH,<br>
-jc<br>
<p><br>
</p>
</body>
</html>