Re: [xymon] Odd issue with Release Candidate one and alerts

[Henrik Størner <henrik (at) hswn.dk>]

On Mon, 24 Jan 2011 14:06:14 -0500, Clark, Sean wrote:

> It seems like it isn't following the DURATION flag for alerts
> 
> I have some rules for a host, it matches on two lines:
> 
> 
> ./xymond_alert --test hostname.subdomain.domain.com disk 00003158
> 2011-01-24 13:51:05 send_alert hostname.subdomain.domain.com:disk state
> Paging 00003158 2011-01-24 13:51:05 Matching host:service:page
> 'hostname.subdomain.domain.com:disk:unified-tex' against rule line 128
> 00003158 2011-01-24 13:51:05 *** Match with 'HOST=%

"HOST=%" really is invalid. You're matching against an empty regular
expression, which I guess will match anything. So you could just as
well have "HOST=*" or completely drop the HOST criteria.

And if you want to test DURATION rules, you must use the "--
duration=SECONDS" option for xymond_alert - see the man-page.

Finally, I'd suggest that you use the "--cfid" option to get an
indication of which line in the alert configuration is triggering
the alerts. You can use that on the normal alert task as well, 
in which case it will be included in the subject line for the alerts.

And you can always look at the "info" status for a host to see how the 
alert configuration is interpreted. That is often easier to understand 
than the output from the xymond_alert "test" function.


Regards,
Henrik