[Xymon] Alert rules, clarification on STOP

[john.r.rothlisberger at accenture.com]

Env: Ubuntu 12.04
Xymon 4.3.0

All of my alert rules run external scripts for email/page/etc.

I have the alerts.cfg file setup with the most granular items at the top (host specific, followed by page specific).

When I have a rule such as:
HOST=webserver1,webserver2 SERVICE=procs COLOR=red,yellow
   SCRIPT /home/xymon/server/ext/pg/exalert_web exalert_web REPEAT=30 COLOR=red FORMAT=TEXT DURATION>240
   SCRIPT /home/xymon/server/ext/pg/exdigest_web exdigest_web REPEAT=120 FORMAT=TEXT DURATION>120
STOP

I expect that any alert for "procs" that matches red/yellow will run those scripts if it fits the DURATION or REPEAT rule.  If those have not been satisfied, then I expect the searching of rules to go no farther.  Well, it seems that STOP doesn't really mean STOP.

In my "info" screen where it shows what alerts are triggered for "procs" I see this:
procs   exalert_web     4h      -       30m     -       red
exdigest_web (S)        2h      -       2h      -       yellow,red
BMC_BEM (R)     30m     -       3d      -       yellow
BMC_BEM (R)     -       -       1d      -       red
exalert_OTHCRIT 15m     -       15m     -       red
Exwarn_OTHCRIT  15m     -       3d      -       yellow
exdigest_OTHCRIT (S)    15m     -       2h      -       yellow,red


The items in white above (first 2 lines if the colors don't appear correctly) are what I expect to run and nothing else.  The final 5 items (in blue, again if the colors show up correctly) are rules that would match the page etc.

Why are rules being processed beyond the STOP?
Why are some in blue (I've always wondered this)?
And, as long as I am asking, what does the "(S)" represent?


Thanks,
John
Upcoming PTO: None
_____________________________________________________________________
John Rothlisberger
IT Strategy, Infrastructure & Security - Technology Growth Platform
TGP for Business Process Outsourcing
Accenture
312.693.3136 office
_____________________________________________________________________




________________________________
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited.

Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.

______________________________________________________________________________________

www.accenture.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20130620/c37a1624/attachment.html>