[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
DURATION rules for specific host alerts
- To: hobbit (at) hswn.dk
 
- Subject: DURATION rules for specific host alerts
 
- From: "Gary Baluha" <gumby3203 (at) gmail.com>
 
- Date: Fri, 22 Jun 2007 10:49:43 -0400
 
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed;        d=gmail.com; s=beta;        h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type;        b=tbvbxCH7eG5INsmX/HhWUkcm3OD+U3dZpzaqKUmQKztaswCHAVW7aOZEbIniRWEje91OBcs7rfMQQQ+zNdV29jS7mikXsaeiuFthn7HSXwwAxHqqwnXroeB7S6j16AML/oa+dRPgG7AHzyH5h8gKRQxLq/2hlT4nDou+tpTNkkI=
 
- Domainkey-signature: a=rsa-sha1; c=nofws;        d=gmail.com; s=beta;        h=received:message-id:date:from:to:subject:mime-version:content-type;        b=t2CN3tlNrF+/ShXs9U9f548ZlsbcKZekBGuF1g7dm7T1da+1C43LfyCE+TXJydzlLrGsUJPLVfqAUtyvieEZDQTVGgF/InxdJqMZIs3f8wT3tObO6a5QAoo26Ncb6FkFZInr7r6YQb6Jcp/kZP8DIVNh2MwrrZ1Isy8GZZNLzsU=
 
Is there a [non-messy] way to set a DURATION rule for a specific host
alert?  Basically, what I'm thinking of is something like this:
In hobbit-clients.cfg
HOST=myhost
   LOAD 20 30 DURATION>5m
The effect being, the status of the "myhost" cpu alert will only change to
yellow/red if the load is above the appropriate threshold for more than 5
minutes.
There are a few hosts that occasionally will spike above the cpu load
thresholds, but only for a few minutes (usually around 5 min at most), and
then recover on its own.  However, I don't want to raise the thresholds,
because a sustained load (more than 10 minutes) at this level _is_ actually
a critical event.  It's just not critical if it is just a momentary spike.
My specific example is with cpu load, but it could be for other things too,
such as process counts, memory, or even in some situations, disk space.