Further strangeness, problem discovered (Re: [hobbit] Questions about Enable/Disable/NOTICE)

[Charles Jones <jonescr (at) cisco.com>]

I am stiil trying to troubleshoot my missing enable messages, so I 
deleted the NOTICE rule mentioned below and created a new rule:
---
# Send me notice alerts of enable and disable
HOST=*
       MAIL me (at) mydomain.com NOTICE NOALERT
---

I then proceeded to disable 2 services on a host. I observed that I 
received a disable notification, both by actual receipt of the email, 
and by tail -f /var/log/maillog.

Then I enabled the services (by enabling "ALL" for that host), 
and...nothing. No mail was sent, as verified by my tailing of the log.

I then immediately disabled ALL services on another host, and no mail 
was sent.
I then immediately re-enabled ALL services on that same host, and no 
mail was sent.

Through testing I discovered that when you disable or enable _"ALL"_ 
services on a host, no NOTICE message is generated.  If I disable or 
disable _individual_ services, notice messages are generated and an 
email is sent out.

If you need me to do further testing, let me know.

-Charles

Charles Jones wrote:

> 1. When I disable a host in hobbit, it says it was disabled by 
> unknown (at) 1.2.3.4 <mailto:unknown (at) 1.2.3.4>.
> In the bb maint.pl script, it had an option to put a username, but I 
> don't see an option to do this in the Hobbit Maint page, so is 
> "unknown" hard coded, or does it look for it somewhere else?
>  
> 2. I added the "NOTICE" rule to my hobbit-alerts.cfg
>  
> HOST=* SERVICE=* COLOR=red
> MAIL me (at) mydomain.com <mailto:me (at) mydomain.com> RECOVERED NOTICE
>  
> I then tested disabling the cpu service for a host, and I received an 
> email with the disable message:
>  
> -----
> From: hobbit (at) myhost.com <mailto:hobbit (at) myhost.com>
> Sent: Wednesday, November 09, 2005 5:01 PM
> To: me (at) mydomain.com <mailto:me (at) mydomain.com>
> Subject: Hobbit servername:cpu NOTICE
> servername:cpu INFO
> Monitoring of servername:cpu has been DISABLED by unknown for 240 minutes
> Disabled by: unknown @ 1.2.3.4
> Reason: testing disable notice
> -----
>  
> This is what I expected to get.  However, I then went and re-enabled 
> the disabled service, and I did not get an email saying it was 
> re-enabled.  I checked the /var/log/maillog to make sure that it 
> wasn't a mail delay.  There simply was no email sent about the 
> enable.  I assume this isn't normal behavior :)
>  
> -Charles