[Xymon] Problem with NOTICE rule in alerts.cfg

[Bill Arlofski]

I noticed that the xymon_alerts docs show there is a NOTICE keyword which is
described as:

NOTICE	Rule matches if the message is a "notify" message. This type of message
is sent when a host or test is disabled or enabled.


I wanted to be alerted via a custom SMS script of any test as soon as it is
enabled or disabled. So in the alerts.cfg file I had initially set up a line
that I thought would trigger whenever a test was enabled or disabled like so:


HOST=*
   SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS NOTICE


As I was testing enabling and disabling, it appeared that I had gotten the
syntax correct and I was off to the next thing.

However, when a normal test went yellow, I received two SMS alerts for it.

My logs shows that the CFID environment variable was showing that my new alert
listed above was triggering the SMS as well as the PAGE=%firewalls/* alert
that was supposed to trigger it.


I then tried

NOTICE
   SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS

as well as

NOTICE=*
   SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS

and finally

HOST=* NOTICE
   SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS


But it seems that ANY status change including normal green, yellow, red,
purple triggers this alert as well as any other correctly matching alert.


I did some additional testing with all three above configurations using:

xymond_alert --test fw.example.com testname

And each of them showed (in order):

*** Match with 'HOST=*' ***
*** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours
FORMAT=SMS NOTICE' ***


*** Match with 'NOTICE' ***
*** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours
FORMAT=SMS' ***

*** Match with 'NOTICE=*' ***
*** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours
FORMAT=SMS' ***

*** Match with 'HOST=* NOTICE' ***
 *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours
FORMAT=SMS' ***




Would love to get this working correctly and appreciate any help!


-- 
Bill Arlofski
Reverse Polarity, LLC
http://www.revpol.com/