DURATION tag

[Kevin.Hanrahan at novainfo.com]

I have been seeing what I think is a problem with the "DURATION" tag. I keep
getting alerted for very short outages on different tests when I have a
duration tag that I don't think is ever exceeded. For instance, I have the
following rule:


HOST=$UNIXPROD
        MAIL $SYSADMIN COLOR=red EXSERVICE=cpu,iostat,vmio,oracle,oracle9
REPEAT=30m RECOVERED
        MAIL $SYSADMIN COLOR=red SERVICE=oracle DURATION>10m REPEAT=30m
RECOVERED
        MAIL $SYSADMIN COLOR=red SERVICE=oracle9 DURATION>10m REPEAT=30m
RECOVERED
        MAIL $SYSADMIN COLOR=red SERVICE=cpu DURATION>1h REPEAT=1h RECOVERED
TIME=W:0800:1700
        MAIL $SYSADMIN COLOR=purple REPEAT=1h RECOVERED


Then I got this alert:

red Sat Mar 26 21:23:09 EST 2005 Oracle test on "RM01": WARNING


And here is the data from the "hist" log


[root at sknxmon02 hist]# tail sfdomain2.oracle
Sat Mar 26 20:43:05 2005 yellow 1111887785 2404
Sat Mar 26 21:23:09 2005 red 1111890189


I get alerted immediately upon a red state! I have put in durations of up to
5 hours, just to be sure but when a test goes red, I get the alert right
away.


Does anybody else have these problems?


I am running RC5 with all patches


Thanks

Kevin

Note:  The information contained in this email and in any attachments is
intended only for the person or entity to which it is addressed and may
contain confidential and/or privileged material.  Any review,
retransmission, dissemination or other use of, or taking of any action in
reliance upon, this information by persons or entities other than the
intended recipient is prohibited.  The recipient should check this email and
any attachments for the presence of viruses.  Sender accepts no liability
for any damages caused by any virus transmitted by this email. If you have
received this email in error, please notify us immediately by replying to
the message and delete the email from your computer.  This e-mail is and any
response to it will be unencrypted and, therefore, potentially unsecure.
Thank you.  NOVA Information Systems, Inc.