[Xymon] server-side message pre-processor?

[John Thurston]

On 11/3/2015 6:11 AM, Henrik Størner wrote:
> Den 03-11-2015 01:59, John Thurston skrev:
>> Is there a mechanism through which I can dump certain host+test
>> combinations to /dev/null ?
>
> Remove the host from your hosts.cfg, then Xymon will ignore updates from
> it. Yes, it will still receive messages from it, but dropping them
> immediately when the hostname is not found doesn't cost much processing.
>
> Too bad if you do want to monitor *some* elements, but dropping the host
> entirely from Xymon at least gives you some bargaining power towards the
> people who mis-manage their monitored server.

Therein lies the rub. Xymon accepts all messages from a client, or it 
accepts none.

A host which has one business-critical test to report may also report an 
infinite number of bits of garbage. All of that garbage fills my logs 
and pushes everything else useful out of the "X events received in the 
past Y minutes" portion of the non-green screen. I beat, cajole, beg, 
but I can find no means by which to make an uncaring-host owner clean up 
their act.

re: Spam mail alerts back to the offending host owner
That will just add load to my alert-handler and mailer. The recipient 
will create a mail-server-side rule to flush my noise to /dev/null. This 
is a very ineffective whip unless the target email audience is very large.

It would be cool if there were a per-host "accept" tag. I could stick it 
in a .default. line in hosts.cfg, "accept=disk,cpu,conn,http". Any other 
test reported for the host would be dropped.

The underlying problem is Xymon assumes a friendly environment. Some of 
my host-owners are not being friendly :(

-- 
    Do things because you should, not just because you can.

John Thurston    907-465-8591
John.Thurston at alaska.gov
Enterprise Technology Services
Department of Administration
State of Alaska