[Xymon] Can't match alerts.cfg rules

[Jake]

On 2016-11-07 18:37, Jake wrote:: 

> On 2016-11-06 16:55, Jake wrote: 
> 
> On 2016-11-06 1:09, J.C. Cleaver wrote: 
> 
> On Sat, November 5, 2016 1:14 pm, Jake wrote:
> I have 4.3.27-1.el7.terabithia running on Centos 7, and can't get any rules in alerts.cfg.to match and fire an alert. I have in hosts.cfg: 192.168.2.31 phone-sales # conn In alerts.cfg: HOST=phone-sales COLOR=red MAIL somebody at gmail.com ## Wildcard rule HOST=%^.*$ COLOR=red MAIL somebody at gmail.com Made the wildcard rule a regexp because "HOST=*" wasn't working, and added the host-specific rule because no wildcard was working. But if I trigger a red on host phone-sales, in alert.log I see: Checking criteria for host 'phone-sales', which is not yet defined; some alerts may not immediately fire What am I missing? I retired a year and a half ago, and have been out of practice, so feel free to start with "You dummy...." 
> 
> Hi,
> 
> Can you show the output of xymoncmd xymond_alert --dump-config ? That
> would help us see what xymond_alert itself is interpreting things as.
> 
> The "Checking criteria for host..." should only apply when xymond_alert
> (via loadhosts) hasn't reloaded the hosts.cfg yet (in this instance). That
> entry looks normal, though. Does the error get shown every time
> xymond_alert starts up?
> 
> Regards,
> -jc
> 
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon [1]

[root at hccmon xymon]# xymoncmd xymond_alert --dump-config
 120 HOST=phone-sales COLOR=red 
 MAIL somebody at gmail.com FORMAT=TEXT REPEAT=30 

 123 HOST=%^.* COLOR=red 
 MAIL somebody at gmail.com FORMAT=TEXT REPEAT=30 

Sorry, I was misinterpreting the "Checking criteria..." message as being
triggered by the red code. Perhaps I'm not waiting long enough for the
alert to fire before deciding it's not working. But the message is not
showing every time I "systemctl restart xymonlaunch.service". Will get
back to this in the morning, EST. 

Thanks, 

Jake 

_______________________________________________
/xymon

The "Checking criteria for host..." message does correlate to the red
condition. If I trigger a red, it occurs several times a minute until I
un-trigger it. 

[root at hccmon xymon]# tail -f /var/log/xymon/alert.log 

2016-11-07 18:23:21 Checking criteria for host 'phone-sales', which is
not yet defined; some alerts may not immediately fire 2016-11-07
18:23:46 Received reload request 

2016-11-07 18:23:50 Checking criteria for host 'phone-sales', which is
not yet defined; some alerts may not immediately fire 2016-11-07
18:23:50 Checking criteria for host 'phone-sales', which is not yet
defined; some alerts may not immediately fire 2016-11-07 18:24:25
Checking criteria for host 'phone-sales', which is not yet defined; some
alerts may not immediately fire 2016-11-07 18:24:25 Checking criteria
for host 'phone-sales', which is not yet defined; some alerts may not
immediately fire 2016-11-07 18:24:59 Checking criteria for host
'phone-sales', which is not yet defined; some alerts may not immediately
fire 2016-11-07 18:24:59 Checking criteria for host 'phone-sales', which
is not yet defined; some alerts may not immediately fire 2016-11-07
18:25:29 Checking criteria for host 'phone-sales', which is not yet
defined; some alerts may not immediately fire 2016-11-07 18:25:29
Checking criteria for host 'phone-sales', which is not yet defined; some
alerts may not immediately fire 2016-11-07 18:26:32 Checking criteria
for host 'phone-sales', which is not yet defined; some alerts may not
immediately fire 2016-11-07 18:26:32 Checking criteria for host
'phone-sales', which is not yet defined; some alerts may not immediately
fire 2016-11-07 18:26:36 Checking criteria for host 'phone-sales', which
is not yet defined; some alerts may not immediately fire 2016-11-07
18:26:36 Checking criteria for host 'phone-sales', which is not yet
defined; some alerts may not immediately fire 

_______________________________________________
Xymon mailing list
Xymon at xymon.com
http://lists.xymon.com/mailman/listinfo/xymon [1]

I ended up finding out that in my situation, a host in a hosts.cfg group
gives the "not yet defined" log and fails to fire an alert. A host not
in a group works as expected. 

hosts.cfg: 

group Phones 

192.168.2.253 phoneserver # conn 

192.168.2.31 phone-sales # conn 

If I move phone-sales out of the group (putting it right after the Xymon
server), the wildcard alert fires. 

alerts.cfg: 

HOST=* COLOR=red 

MAIL alerts at mydomain 

/etc/hosts: 

192.168.2.31 phone-sales 

dnswitch.conf has "hosts: files dns myhostname" and I can "ping
phone-sales" from the command line. 

I'm tearing my hair out over this. It seems such a simple setup, so I
figure it's something stupid I'm overlooking. Does anyone have any
insight into this? 

Thanks, 

Jake 

Links:
------
[1] http://lists.xymon.com/mailman/listinfo/xymon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20161116/32061326/attachment.html>