<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Some more digging and here is what I have found. Prior to the upgrade to 4.3.30, I had groups with underscores in the names and groups with more than 7 characters. Since the upgrade I can no longer do that. I have re-written my analysis.cfg
and alerts.cfg files to shorten the names and the commands to test the alerter now function correctly again, as do my alerts.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It’s a bad workaround so can anyone explain why I might be seeing this issue?<o:p></o:p></p>
<p class="MsoNormal">Test cases and results:<o:p></o:p></p>
<p class="MsoNormal">Group name < 4 characters = FAIL<o:p></o:p></p>
<p class="MsoNormal">Group name > 7 characters = FAIL<o:p></o:p></p>
<p class="MsoNormal">Group name containing an underscore = FAIL<o:p></o:p></p>
<p class="MsoNormal">Group name containing a hyphen = FAIL<o:p></o:p></p>
<p class="MsoNormal">Group name with 4-7 characters and no underscores or hyphens = SUCCESS.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Running 4.3.30 on RHEL7 64bit. Compiled from source.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Xymon <xymon-bounces@xymon.com> <b>On Behalf Of
</b>James, Tim A.<br>
<b>Sent:</b> Friday, August 14, 2020 11:42 PM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> [Xymon] alerts.cfg GROUP not matching<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I had all of this working and “something” changed and now the majority of my groups defined in my analysis.cfg file no longer alert. I’m hoping it wasn’t when I upgraded from 4.3.28 to 4.3.30 but I’m not ruling anything out.<o:p></o:p></p>
<p class="MsoNormal">I have sanitized the server name to foo.bar.com<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Analysis.cfg snippet:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">HOST=foo*<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/9.4 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/9.4/depot2 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/saslanding 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/saslanding/in 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/saslanding/out 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/sasmain 90 99 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/sassecure 90 99 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/sassecure/modelingcrm 95 98 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/sassecure/servicing 95 99 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/sassecure/servicing/SCRA/MOENDs 90 95 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"> DISK /opt/sas/saswork 50 70 GROUP=sas_support<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Alerts.cfg snippet:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">GROUP=sas_support SERVICE=disk COLOR=red # SAS Application support team<o:p></o:p></p>
<p class="MsoNormal">SCRIPT /usr/local/xymon-server/server/ext/Create_SN_Ticket_From_Xymon-YP2-RP1.sh sas_support FORMAT=SMS DURATION>30 REPEAT=24h stop<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">GROUP=sas_support SERVICE=disk COLOR=yellow # SAS Application support team<o:p></o:p></p>
<p class="MsoNormal">MAIL <a href="mailto:helpdesk@foo.com">helpdesk@foo.com</a> FORMAT=SMS DURATION<20 REPEAT=24h stop<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Obligatory test from the terminal:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[/usr/local/xymon-server/server/etc]<o:p></o:p></p>
<p class="MsoNormal">--> ../bin/xymoncmd xymond_alert --test foo.bar.com disk --color=yellow --group=sas_support<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">00103435 2020-08-14 23:11:06 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 165<o:p></o:p></p>
<p class="MsoNormal">00103435 2020-08-14 23:11:06 Failed 'GROUP=sas_support SERVICE=disk COLOR=red' (group not in include list)<o:p></o:p></p>
<p class="MsoNormal">00103435 2020-08-14 23:11:06 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 168<o:p></o:p></p>
<p class="MsoNormal">00103435 2020-08-14 23:11:06 Failed 'GROUP=sas_support SERVICE=disk COLOR=yellow' (group not in include list)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--> ../bin/xymoncmd xymond_alert --test foo.bar.com disk --group=sas_support<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 165<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Failed 'GROUP=sas_support SERVICE=disk COLOR=red' (group not in include list)<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 168<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Failed 'GROUP=sas_support SERVICE=disk COLOR=yellow' (group not in include list)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However the “red” second test, does match further along in the alerts file, just not with a GROUP definition, and the failure there is expected as I didn’t specify the duration.<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 304<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 *** Match with 'HOST=%^.* SERVICE=disk COLOR=red' ***<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 305<o:p></o:p></p>
<p class="MsoNormal">00104898 2020-08-14 23:26:59 Failed 'SCRIPT /usr/local/xymon-server/server/ext/Create_SN_Ticket_From_Xymon-YP2-RP1.sh UNIX FORMAT=SMS DURATION>5 REPEAT=25h' (min. duration 0<301)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now get this. Here are two more examples from the alerts.cfg file:<o:p></o:p></p>
<p class="MsoNormal">GROUP=satellite SERVICE=disk #test comment<o:p></o:p></p>
<p class="MsoNormal">MAIL <a href="mailto:coworker@foo.com">coworker@foo.com</a> FORMAT=SCRIPT stop<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">GROUP=unix # Linux Team support (default contact)<o:p></o:p></p>
<p class="MsoNormal">MAIL <a href="mailto:unix-alert@lists.foo.com">unix-alert@lists.foo.com</a> FORMAT=SMS DURATION<20 stop<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And the respective tests from the terminal:<o:p></o:p></p>
<p class="MsoNormal">../bin/xymoncmd xymond_alert --test foo.bar.com disk --color=yellow --group=satellite<o:p></o:p></p>
<p class="MsoNormal">00104439 2020-08-14 23:21:49 Matching host:service:dgroup:page foo.bar.com:disk:NONE:PROD/PSAS' against rule line 147<o:p></o:p></p>
<p class="MsoNormal">00104439 2020-08-14 23:21:49 Failed 'GROUP=satellite SERVICE=disk' (group not in include list)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">../bin/xymoncmd xymond_alert --test foo.bar.com disk --color=yellow --group=unix<o:p></o:p></p>
<p class="MsoNormal">00104535 2020-08-14 23:23:08 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 150<o:p></o:p></p>
<p class="MsoNormal">00104535 2020-08-14 23:23:08 *** Match with 'GROUP=unix' ***<o:p></o:p></p>
<p class="MsoNormal">00104535 2020-08-14 23:23:08 Matching host:service:dgroup:page 'foo.bar.com:disk:NONE:PROD/PSAS' against rule line 151<o:p></o:p></p>
<p class="MsoNormal">00104535 2020-08-14 23:23:08 *** Match with 'MAIL <a href="mailto:unix-alert@lists.foo.com">
unix-alert@lists.foo.com</a> FORMAT=SMS DURATION<20 stop' ***<o:p></o:p></p>
<p class="MsoNormal">00104535 2020-08-14 23:23:08 Mail alert with command 'mail <a href="mailto:unix-alert@lists.foo.com">
unix-alert@lists.foo.com</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m stumped. Anyone out there have any idea what might be incorrect?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#313131">Tim James<br>
</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#313131">Senior System Administrator<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#313131">Navient</span><span style="font-size:8.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><br>
This E-Mail has been scanned for viruses.<o:p></o:p></p>
</div>
</body>
</html>