[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
hobbit-alerts parsing order
- To: hobbit (at) hswn.dk
- Subject: hobbit-alerts parsing order
- From: Rob Munsch <rmunsch (at) solutionsforprogress.com>
- Date: Thu, 18 May 2006 14:59:43 -0400
- User-agent: Mozilla Thunderbird 1.0.7 (X11/20051111)
hello list,
i'm having some trouble with my alert priorities. I can't find anything
definitive in docs or archives about the order that hobbit-alerts is
parsed in (frex, should Service come before Host?). Generally, some
rules aren't getting matched on events, and no "STOP"ped rules before
them are matching, so I'm not sure why.
ATM i have some host-specific rules near the top that have NO rules for
conn.
Later in the file is a SERVICE=conn.
When one of the hosts that matches for HOST= loses conn, i get no alerts.
I had assumed that if a service was left out of a HOST block, then the
SERVICE= blocks would catch them. Was this wrong, or have I done
something else..?
Thanks,
--
Rob Munsch
Solutions For Progress IT