[hobbit] Getting doubled alerts

[Henrik Stoerner]

On Wed, Oct 05, 2005 at 03:27:07PM -0700, Brehm, Scott wrote:
> Is it normal to get two alert messages if an event matches two rules? 

Yes.

> Is there a keyword to suppress multiple alert emails from the same event?
> I've been running 4.0 for a while, but just getting in to configuring
> alerts. My hobbit-alerts.cfg includes the following:
>  
> HOST=* SERVICE=conn
>         MAIL sbrehm at titan.com COLOR=red
>  
> HOST=%atscm
>         MAIL sbrehm at titan.com COLOR=red
>         MAIL person2 at titan.com COLOR=red
>  
> HOST=%atscs
>         MAIL sbrehm at titan.com COLOR=red
>         MAIL person3 at titan.com COLOR=red
>  
> I want alerts for any connection problems, but only want alerts for
> other hosts if they come from two specific sets of hosts. 

As you've found out yourself, EXSERVICE=conn on the two host-specific
rules will do it. Instead, you could also use the keyword "STOP" with
the "conn" rule - like

 HOST=* SERVICE=conn
         MAIL sbrehm at titan.com COLOR=red STOP
  
This will make the alert-handler stop looking for recipients after your
general "conn" rule has been matched.


Henrik