[hobbit] more alert config questions

[Henrik Stoerner]

On Mon, May 09, 2005 at 05:16:03PM -0400, Sue Bauer-Lee wrote:
> Can someone provide some hobbit-alerts.cfg examples that show a setup
> similar to BB as in:
> 
> hostgroup	services	1st pager	delay	
> hg-ntprod;;procs disk svcs;;*;*;pg-supportemail:~10-30 pg-ntadminpager:~05-10 pg-oncallpager:~30-60

The most direct conversion of host- and page-groups is to make them
be Hobbit "macros", like this:

$HG_NTPROD=nt1,nt2,nt3
$PG_SUPPORTEMAIL=support1 at foo.com support2 at foo.com
$PG_NTADMINPAGER=123456
$PG_ONCALLPAGER=987654

So a direct conversion of your setup above would be

HOST=$HG_NTPROD SERVICE=procs,disk,svcs
	MAIL $PG_SUPPORTEMAIL DURATION>10m REPEAT=30m
	SCRIPT /usr/local/bin/sendpage $PG_NTADMINPAGER DURATION>5m REPEAT=10m
	SCRIPT /usr/local/bin/sendpage $PG_ONCALLPAGER DURATION>30m REPEAT=1h

The /usr/local/bin/sendpage script is something you'll have to create
yourself; unlike BB, Hobbit does not have built-in support for
communicating with pagers (we dont use those over here on the east side
of the Big Pond).

> Can someone also provide an example of using the PAGE or SUBPAGE instead of
> providing a HOST list with conventions similar to te above?

Say this is your bb-hosts file:

   page ntweb NT Web server
   10.0.0.1  web1.foo.com
   10.0.0.2  web2.foo.com
   10.0.0.3  testweb.foo.com

   page db Database servers

   subpage oracle
   10.1.0.1  db1.foo.com
   10.1.0.2  db2.foo.com

   subpage mssql
   10.1.0.10 sql1.foo.com


Then you can define a rule for all of the webservers like this:

PAGE=ntweb
	MAIL support at foo.com

And this one for the oracle DB servers:

PAGE=db/oracle
	MAIL oracle-dba at foo.com


> Can I mix both in the alerts config file?

Yes. E.g. if the "testweb.foo.com" server is only supposed to run on
weekdays 8 AM - 6 PM, and you're personally responsible for it:

PAGE=ntweb EXHOST=testweb.foo.com
	MAIL support at foo.com
HOST=testweb.foo.com TIME=W:0800:1800
	MAIL sue at foo.com

The "EXHOST" excludes the testweb server from the rule, even though it
is matched by "PAGE=ntweb". It is then caught by the next rule matching 
it on the hostname.


> and for my really dumb question of the day - is there a line continuation 
> character that can be used, recognized and properly parsed? 

There are no dumb questions. And no, there is no continuation character
for alert rules. Everything goes on one line (which is why you'll
probably want to use macros and regular expressions).


Regards,
Henrik