[Xymon] Alert issue

[David Welker]

jc,

Using your idea...
PAGE=mypage COLOR=red,yellow
   MAIL me at here.com

...when cpu is green, yellow, purple, or red --test now always returns a
mail -s with CRITICAL (RED) message.

which may actually BE correct, since elsewhere on the page there is a red
status and I've now put the COLOR on the main line referencing the whole
page. In an attempt to narrow it back down to the one host, however, I used
HOST=^Server1*, instead of PAGE=, but STILL get the CRITICAL (RED) message
in the --test run, but actually got an email regarding the yellow cpu
status (and not for a different yellow status on the same page).

--dump-config returns...
HOST=^Server1* COLOR=yellow,red     <---- NOTICE REVERSED COLORS (see
above)??
MAIL me at here.com FORMAT=TEXT REPEAT=30

Interestingly enough, when I use a --color parameter with the --test, it
performs correctly...
If --color of cpu is yellow, --test returns a warning (YELLOW) message.
If --color of cpu is red, --test returns a CRITICAL (RED) message.
If --color of cpu is green or purple, --test returns a FAILED (due to
color) message.

By the way, my ALERTCOLORS="red,yellow,purple"

Could it possibly be that the --test feature needs more testing, and that
the alerting is actually working the way I expect it should?

Thanks,
David


On Thu, Nov 12, 2015 at 10:41 AM, J.C. Cleaver <cleaver at terabithia.org>
wrote:

> On Thu, November 12, 2015 6:44 am, David Welker wrote:
>
> > Thanks!  Makes sense.  I guess the alerts.cfg.5.html file needs to be
> > changed?  That's where I was looking...
> > *COLOR=color[,color]* Rule matching an alert by color. Can be "red",
> > "yellow", or "purple". The forms "!red", "!yellow" and "!purple" can also
> > be used to NOT send an alert if the color is the specified one.
> >
> > Well, that fixed my first issue.  Now when the cpu is reporting green,
> the
> > --test gives me a "Failed" message as expected, but with the cpu
> reporting
> > yellow, I get the same "Failed" message - failed due to color!
> >
> > Even took xymoncmd out of the equation and the result is the same.
> > Took out EXSERVICE as well.
> >
> > Now all I have in alerts.cfg:
> > PAGE=mypage
> >   MAIL me at here.com COLOR=%(red|yellow)
> >
> > ..yet when I run:
> >  xymond_alert --test server.com cpu
> > I get..
> > #### DATE TIME Failed 'MAIL me at here.com COLOR=%(red|yellow)' (color)
> >
> > Any other suggestions?  For example, do I have to restart the server
> after
> > making changes to the alerts.cfg file?
>
>
> I believe the proper syntax there is simply:
>
> PAGE=mypage COLOR=red,yellow
>    MAIL me at here.com
>
> COLOR can be a list of options, unlike most of the other filters (such as
> EXSERVICE) which must either lexically match OR have to be prepended with
> a '%' to enter "pcre-regex" mode. Additionally, COLOR= appears to not be
> allowed as a per-recipient filter; in this case, it'll need to be on the
> main line.
>
> One easy way to check the syntax and rule logic is to run xymoncmd
> xymond_alert --dump-config . What shows up in the result will be how the
> alert system interprets it.
>
> Also, to actually enable 'yellow' alerts, you'll want to ensure the color
> is added to "$ALERTCOLORS" in xymonserver.cfg if it's not already.
>
>
> HTH,
> -jc
>
>
>
>
> >
> > Thanks,
> > David
> >
> >
> > On Wed, Nov 11, 2015 at 10:10 PM, Martin Lenko <lenko99 at gmail.com>
> wrote:
> >
> >> Hi David,
> >> to specify multiple color values you will have to use regular
> >> expression.
> >> Use something like this in your alert config:
> >> COLOR=%(yellow|red)
> >>
> >> The '%' character instructs xymon that following string is a regular
> >> expression.
> >>
> >> Regards,
> >> Martin
> >>
> >> On 11 November 2015 at 18:46, David Welker <dewelker at gmail.com> wrote:
> >>
> >>> I admit, this is my first attempt at alerting, so this may or may not
> >>> be
> >>> user error.  It also could be an issue that is fixed in the latest
> >>> upgrade
> >>> (I'm still on 4.3.21), but before I resort to that (which will be soon
> >>> enough), I wanted to make sure I was at least thinking along the right
> >>> line...
> >>>
> >>> The cpu column is reporting green.
> >>> The entry in alerts.cfg includes a COLOR=yellow parameter.
> >>> Running the xymond_alert --test reports (as expected)...
> >>> Failed 'MAIN me at here COLOR=yellow EXSERVICE=conn,disk' (color)
> >>>
> >>> If, however, I change the COLOR to red, or even if I just add it
> >>> (COLOR=yellow,red), I get the "Mail alert with command 'mail -s...'"
> >>> line
> >>> rather than the failed.  Did I do something wrong?
> >>>
> >>> Funny though, either way I don't actually get the email.
> >>>
> >>> Thanks,
> >>> David
> >>>
> >>> _______________________________________________
> >>> Xymon mailing list
> >>> Xymon at xymon.com
> >>> http://lists.xymon.com/mailman/listinfo/xymon
> >>>
> >>>
> >>
> > _______________________________________________
> > Xymon mailing list
> > Xymon at xymon.com
> > http://lists.xymon.com/mailman/listinfo/xymon
> >
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20151112/961865a5/attachment.html>