[hobbit] content tests

[Richard Leyton]

You're probably overwriting one with the other by naming them both  
'http'. I'd suggest you use different heading names, or don't specify  
any heading names at all, in which case (I think), it defaults to  
cont/cont2/cont3/etc, ie.

1.2.3.4    web-8  # ssh pulldata TRENDS:*,disk:disk|disk1  
cont=monitor;http://prodsite.foo.com/monitor.php;SUCCESS  
cont=amialiveornot;http://prodsite2.foo.com/amialiveornot.php;SUCCESS

... perhaps even a separate group for content tests, if you think  
it'd crowd things out too much, then use a combotest to check them  
both or combine them in a meaningful way.

To answer your other question, *if* they are overwriting each other,  
you'll perhaps wind up with a 'flip flop' of alerts going red, then  
green. That said, I don't know for sure how Hobbit server side   
status messages to the server as it moves through the various sytem  
tests.

r.

--
Richard Leyton - richard at leyton.org
http://www.leyton.org




On 10 Aug 2006, at 01:02, Charles Jones wrote:

> Also while I'm mucking about with content checks, I have another  
> question.  I added two content checks:
>
> 1.2.3.4    web-8  # ssh pulldata TRENDS:*,disk:disk|disk1  
> cont=http;http://prodsite.foo.com/monitor.php;SUCCESS  
> cont=http;http://prodsite2.foo.com/amialiveornot.php;SUCCESS
>
> When I check the http status, I see the first content check only. :
> Wed Aug 9 23:55:58 2006: Content OK http://prodsite.foo.com/ 
> monitor.php - Testing yields: SUCCESS
> However, when I go to the "info" column, it shows that both URLs  
> are being checked:
>
> Checked with ping:Yes
> Content checks: MailScanner has detected a possible fraud attempt  
> from "aqmt-prod.cisco.com" claiming to be http://prodsite.foo.com/ 
> monitor.php  must return 'SUCCESS'
>                              MailScanner has detected a possible  
> fraud attempt from "reports-prod.cisco.com" claiming to be http:// 
> prodsite2.foo.com/amialiveornot.php  must return 'SUCCESS'
>
> How do I get both content checks to display in the http status area?
> If this is not possible, will alerts still be sent if either  
> content check fails?
>
> -Charles
>
> Charles Jones wrote:
>> FYI Just for fun I gave it a try (specifying the column name as  
>> "http"), and it appears to work - rather I get the content check  
>> in the http column, but the "normal" http status that shows the  
>> header and whatnot isn't there, so I'm guessing that hobbit just  
>> displays the last status type it received for that column.
>>
>> Since the content check will still turn red and trigger an alert  
>> if http itself goes down, this may be all that I need. The only  
>> problem I could foresee is maybe someone could click the http  
>> status in between the times that the normal status is reported,  
>> and the content status is reported, so they would get just the  
>> normal status...due to the timing of that I doubt it would ever  
>> happen so I'm not too worried.
>>
>> I'm open to any other suggestions or comments.
>>
>> -Charles
>>
>> Charles Jones wrote:
>>> Is it possible to have the results of the HTTP test as well as  
>>> the CONT test both displayed in the http status area?
>>> In other words, "cont=http;http://www.foo.com/blah/;SUCCESS"
>>>
>>> I'm not suggesting that the default be that way, I can think of  
>>> many cases where it would be desirable to have a separate "http"  
>>> and "content" columns. I'm just trying to have as few columns as  
>>> possible :-)
>