<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} @font-face
{font-family:Wingdings}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.WordSection1
{}
ol
{margin-bottom:0cm}
ul
{margin-bottom:0cm}--></style>
</head>
<body dir="ltr" style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Helvetica,Sans-Serif;">
<p>Extract from analysis.cfg(5) man page :</p>
<p><br>
</p>
<p><span style="font-size: 9pt;"><span style="font-family: "Courier New",monospace;">DIRECTING ALERTS TO GROUPS</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> For some tests - e.g. "procs" or "msgs" - the right group of people to</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> alert in case of a failure may be different, depending on which of the</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> client rules actually detected a problem. E.g. if you have PROCS rules</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> for a host checking both "httpd" and "sshd" processes, then the Web</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> admins should handle httpd-failures, whereas "sshd" failures are han‐</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> dled by the Unix admins.</span><br style="font-family: "Courier New",monospace;">
<br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> To handle this, all rules can have a "GROUP=groupname" setting. When a</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> rule with this setting triggers a yellow or red status, the groupname</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> is passed on to the Xymon alerts module, so you can use it in the alert</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> rule definitions in alerts.cfg(5) to direct alerts to the correct group</span><br style="font-family: "Courier New",monospace;">
<span style="font-family: "Courier New",monospace;"> of people.</span></span></p>
<p><br>
</p>
<p>For example, in alerts.cfg, you would have:</p>
<p><br>
</p>
<p><span style="font-family: "Courier New",monospace; font-size: 9pt;">HOST=myhostname<br>
</span></p>
<p><span style="font-family: "Courier New",monospace; font-size: 9pt;"> PROC notepad.exe 1 GROUP=admins</span></p>
<p><br>
</p>
<p>And this in alerts.cfg:</p>
<p><br>
</p>
<p><span style="font-family: "Courier New",monospace; font-size: 9pt;">HOST=myhostname SERVICE=procs GROUP=admins</span></p>
<p><span style="font-family: "Courier New",monospace; font-size: 9pt;"> MAIL john@testlab.local</span></p>
<p><br>
</p>
<p>HTH,</p>
<p><br>
</p>
<p>Dominique</p>
<p>UNIL - University of Lausanne<font size="2" face="Helvetica, sans-serif"></font></p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
</div>
</div>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>De :</b> Xymon <xymon-bounces@xymon.com> de la part de Even Hauge Juberg <even.juberg@artsdatabanken.no><br>
<b>Envoyé :</b> lundi 19 février 2018 15:53<br>
<b>À :</b> xymon@xymon.com<br>
<b>Objet :</b> [Xymon] Configuring alerts</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal">Hi!</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span lang="EN-US">I’ve been trying a few things to get the correct alerts to the correct staff-member, but for some reason I cannot get it to work. In order to find out if I’m doing something wrong within the configuration of Xymon, or
if I have to search somewhere else, I’m reaching out here to see if anyone can give me any pointers.</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">The scenario is that I have one particular host, that should be running a specific process. Let’s say this process is “notepad.exe” – if “notepad.exe” is not running, John should get an email.
</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">What I have done so far is this:</span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span lang="EN-US"><span style="">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">Edited the configuration file on my host as follows in the “procs section”: <setting name="notepad.exe" rule="=1" comment="Notepad" alarmcolor="red" /></span></p>
<p class="MsoListParagraph" style="margin-left:72.0pt; text-indent:-18.0pt"><span lang="EN-US"><span style="">a.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">My goal here is to check if there is one instance of notepad.exe running – if not, give a “red alert”.
</span></p>
<p class="MsoListParagraph" style="margin-left:72.0pt; text-indent:-18.0pt"><span lang="EN-US"><span style="">b.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">This seems to be working. The host in the web-view of Xymon turns red in the procs column, and notepad.exe is shown as running -1 instance if there is not one running. So far so good!</span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span lang="EN-US"><span style="">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">Now I want John to be alerted if notepad is not running so I have edited the alert.cfg in the following way:</span></p>
<p class="MsoListParagraph" style="margin-left:72.0pt; text-indent:-18.0pt"><span lang="EN-US"><span style="">a.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">HOST=myhostname(the same as in hosts.cfg NAME:myhostname) SERVICE=notepad.exe MAIL
<a href="mailto:john@testlab.local">john@testlab.local</a> DURATION>10 COLOR=red</span></p>
<p class="MsoListParagraph" style="margin-left:72.0pt; text-indent:-18.0pt"><span lang="EN-US"><span style="">b.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">As “notepad.exe is not a service, but a process this is not working. AS “procs” is not a valid argument(at least not listed in the documentation, SERVICE was the closest thing that came to mind. So my question is simply,
is there a way to filter alerts by the procs column or will I have to attack this in another way?
</span></p>
<p class="MsoListParagraph" style="margin-left:72.0pt; text-indent:-18.0pt"><span lang="EN-US"><span style="">c.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span lang="EN-US">I would like to avoid John getting nagged by any other red-alerts from this host, as his responsibility is notepad.
</span><span style="font-family:Wingdings" lang="EN-US">J</span><span lang="EN-US"></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">Any pointers would be highly appreciated!
</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span style="" lang="EN-US">Sicnerely,</span></p>
<p class="MsoNormal"><span style="" lang="EN-US">Even Hauge Juberg</span></p>
<p class="MsoNormal"><span style="" lang="EN-US">Senior Engineer</span></p>
<p class="MsoNormal"><span style="">Norwegian Biodiversity Information Centre</span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</body>
</html>