Re: [hobbit] Getting doubled alerts

[henrik (at) hswn.dk (Henrik Stoerner)]

On Fri, Oct 07, 2005 at 09:45:32AM -0700, Brehm, Scott wrote:
> > > alerts. My hobbit-alerts.cfg includes the following:
> > >  
> > > HOST=* SERVICE=conn
> > >         MAIL sbrehm (at) titan.com COLOR=red
> > >  
> > > HOST=%atscm
> > >         MAIL sbrehm (at) titan.com COLOR=red
> > >         MAIL person2 (at) titan.com COLOR=red
> > >  
> > > HOST=%atscs
> > >         MAIL sbrehm (at) titan.com COLOR=red
> > >         MAIL person3 (at) titan.com COLOR=red
> > >  
> > > I want alerts for any connection problems, but only want alerts for
> > > other hosts if they come from two specific sets of hosts. 
> > 
> > As you've found out yourself, EXSERVICE=conn on the two host-specific
> > rules will do it. Instead, you could also use the keyword "STOP" with
> > the "conn" rule - like
> > 
> >  HOST=* SERVICE=conn
> >          MAIL sbrehm (at) titan.com COLOR=red STOP
> >   
> > This will make the alert-handler stop looking for recipients 
> > after your general "conn" rule has been matched.
>
> Will placing the STOP as shown stop looking for just conn events or all
> events? And for just sbrehm or for all persons? In the example I still
> need to notify person2 and person3 of connection problems with their
> systems.

The STOP condition triggers when it is used - i.e. it will only have
effect for "conn" tests, since it is inside a rule that has
"SERVICE=conn". But if you need to alert person2 and person3 of "conn"
problems, then you cannot use the STOP keyword.

Another way to avoid the duplicate alerts might be to restrict your 
general rule to not include the two special hosts:

	HOST=* EXHOST=atscm,atcsc SERVICE=conn
        	MAIL sbrehm (at) titan.com COLOR=red
 
	HOST=%atscm
        	MAIL sbrehm (at) titan.com COLOR=red
        	MAIL person2 (at) titan.com COLOR=red
 
	HOST=%atscs
        	MAIL sbrehm (at) titan.com COLOR=red
        	MAIL person3 (at) titan.com COLOR=red

So ... several ways of doing the same thing. You choose which one
matches your thinking best :-)


Regards,
Henrik