Re: [hobbit] unexpected green mails

[Robin Wood <discardable1 (at) gmail.com>]

Just a bit to add to this, the things which are alerting as being
green are showing up in the monitor as green smilies, the rest that
aren't alerting their green status are green diamonds.

Does this matter?

Robin


On Sat, 19 Feb 2005 20:09:27 +0000, Robin Wood <discardable1 (at) gmail.com> wrote:
> The version is 4.0-RC1.
> 
> I monitor 3 external boxes and an internal one.
> 
> here are the last 2 batches of entries from teh notifications.log file:
> 
> Fri Feb 18 22:14:43 2005 another.domain.com.imap (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 843
> Fri Feb 18 22:14:43 2005 third.domain.com.http (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 600
> Fri Feb 18 22:14:43 2005 another.domain.com.ssh (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 722
> Fri Feb 18 22:14:43 2005 internal.domain.int.conn (192.168.0.8)
> robin (at) mydomain.com 1108764882 500
> Fri Feb 18 22:14:43 2005 another.domain.com.http (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 600
> Fri Feb 18 22:14:43 2005 internal.domain.int.http (192.168.0.8)
> robin (at) mydomain.com 1108764882 600
> Fri Feb 18 22:14:43 2005 internal.domain.int.ssh (192.168.0.8)
> robin (at) mydomain.com 1108764882 722
> Fri Feb 18 22:14:43 2005 alerts.mydomain.com.bbd (192.168.0.8)
> robin (at) mydomain.com 1108764882 0
> Fri Feb 18 22:14:43 2005 internal.domain.int.smtp (192.168.0.8)
> robin (at) mydomain.com 1108764882 725
> Fri Feb 18 22:14:43 2005 another.domain.com.smtp (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 725
> Fri Feb 18 22:14:43 2005 third.domain.com.ftp (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 721
> Fri Feb 18 22:14:43 2005 third.domain.com.conn (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 500
> Fri Feb 18 22:14:43 2005 another.domain.com.conn (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108764882 500
> Fri Feb 18 22:14:43 2005 internal.domain.int.rpc (192.168.0.8)
> robin (at) mydomain.com 1108764882 0
> Fri Feb 18 22:14:43 2005 alerts.mydomain.com.conn (192.168.0.8)
> robin (at) mydomain.com 1108764882 500
> Fri Feb 18 22:14:43 2005 alerts.mydomain.com.http (192.168.0.8)
> robin (at) mydomain.com 1108764882 600
> Fri Feb 18 22:14:43 2005 alerts.mydomain.com.ssh (192.168.0.8)
> robin (at) mydomain.com 1108764882 722
> Fri Feb 18 22:14:43 2005 internal.domain.int.imap (192.168.0.8)
> robin (at) mydomain.com 1108764882 843
> Fri Feb 18 22:14:43 2005 internal.domain.int.dns (192.168.0.8)
> robin (at) mydomain.com 1108764882 800
> Fri Feb 18 22:14:43 2005 alerts.mydomain.com.bbtest (192.168.0.8)
> robin (at) mydomain.com 1108764882 0
> Sat Feb 19 05:45:08 2005 third.domain.com.ftp (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 721
> Sat Feb 19 05:45:08 2005 third.domain.com.http (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 600
> Sat Feb 19 05:45:08 2005 another.domain.com.http (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 600
> Sat Feb 19 05:45:08 2005 another.domain.com.smtp (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 725
> Sat Feb 19 05:45:08 2005 another.domain.com.ssh (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 722
> Sat Feb 19 05:45:08 2005 internal.domain.int.http (192.168.0.8)
> robin (at) mydomain.com 1108791908 600
> Sat Feb 19 05:45:08 2005 another.domain.com.imap (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108791908 843
> Sat Feb 19 05:45:09 2005 internal.domain.int.rpc (192.168.0.8)
> robin (at) mydomain.com 1108791908 0
> Sat Feb 19 05:45:09 2005 internal.domain.int.ssh (192.168.0.8)
> robin (at) mydomain.com 1108791908 722
> Sat Feb 19 05:45:09 2005 alerts.mydomain.com.ssh (192.168.0.8)
> robin (at) mydomain.com 1108791908 722
> Sat Feb 19 05:45:09 2005 internal.domain.int.smtp (192.168.0.8)
> robin (at) mydomain.com 1108791908 725
> Sat Feb 19 05:45:09 2005 internal.domain.int.imap (192.168.0.8)
> robin (at) mydomain.com 1108791908 843
> Sat Feb 19 05:45:09 2005 internal.domain.int.dns (192.168.0.8)
> robin (at) mydomain.com 1108791908 800
> Sat Feb 19 05:45:09 2005 alerts.mydomain.com.bbd (192.168.0.8)
> robin (at) mydomain.com 1108791909 0
> Sat Feb 19 05:45:09 2005 alerts.mydomain.com.http (192.168.0.8)
> robin (at) mydomain.com 1108791909 600
> Sat Feb 19 05:45:09 2005 alerts.mydomain.com.bbtest (192.168.0.8)
> robin (at) mydomain.com 1108791909 0
> Sat Feb 19 06:15:08 2005 another.domain.com.conn (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108793708 500
> Sat Feb 19 06:15:08 2005 internal.domain.int.conn (192.168.0.8)
> robin (at) mydomain.com 1108793708 500
> Sat Feb 19 06:15:08 2005 third.domain.com.conn (xxx.xxx.xxx.xxx)
> robin (at) mydomain.com 1108793708 500
> Sat Feb 19 06:15:08 2005 alerts.mydomain.com.conn (192.168.0.8)
> robin (at) mydomain.com 1108793708 500
> 
> The only rule in the alerts file is
> 
> HOST=*
>      MAIL robin (at) mydomain.com
> 
> The histories are showing that the status for most of them is
> unchanged in the last 14 hours which counting back is when the mails
> were sent out. The graphs seem to show a gap in monitoring from around
> 21:30 (just before the first set of notifications entered the logs but
> no mails were sent out) to around 04:30 (again just before the
> notifications entered the log).
> 
> I know that the servers do a log rotate but that is around midnight.
> 
> I can't understand why the status would have changed 14 hours ago and
> why there should be no log data for any period.
> 
> My update period is 30 mins. The rest of the install is virtually
> straight out of the box with nothing more than what the instructions
> say to change.
> 
> If you want any more info just ask.
> 
> Ta
> 
> Robin
> 
> 
> On Fri, 18 Feb 2005 23:12:48 +0100, Henrik Stoerner <henrik (at) hswn.dk> wrote:
> > On Fri, Feb 18, 2005 at 07:04:47PM +0000, Robin Wood wrote:
> >
> > > I installed hobbit around a week ago and am very impressed with it but
> > > I have a question.
> > >
> > > I am occasionally getting a set of emails from it telling me things
> > > have a status of green. These aren't after a state change as far as I
> > > can tell as there are no other mails before them.
> > >
> > > I am getting these once every couple of days, not at any particular time.
> >
> > Sounds a bit odd, but I'd need some more information before trying to
> > track it down.
> >
> > Which version are you using ?
> >
> > What's in the ~/data/acks/notifications.log file ?
> >
> > What are your rules in hobbit-alerts.cfg for sending out alert-
> > and recovery-messages ?
> >
> > What does the history show for a host that you get one of these
> > messages for ?
> >
> > Regards,
> > Henrik
> >
> > To unsubscribe from the hobbit list, send an e-mail to
> > hobbit-unsubscribe (at) hswn.dk
> >
> >
>