[hobbit] unexpected green mails

[Robin Wood]

The version is 4.0-RC1.

I monitor 3 external boxes and an internal one.

here are the last 2 batches of entries from teh notifications.log file:

Fri Feb 18 22:14:43 2005 another.domain.com.imap (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 843
Fri Feb 18 22:14:43 2005 third.domain.com.http (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 600
Fri Feb 18 22:14:43 2005 another.domain.com.ssh (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 722
Fri Feb 18 22:14:43 2005 internal.domain.int.conn (192.168.0.8)
robin at mydomain.com 1108764882 500
Fri Feb 18 22:14:43 2005 another.domain.com.http (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 600
Fri Feb 18 22:14:43 2005 internal.domain.int.http (192.168.0.8)
robin at mydomain.com 1108764882 600
Fri Feb 18 22:14:43 2005 internal.domain.int.ssh (192.168.0.8)
robin at mydomain.com 1108764882 722
Fri Feb 18 22:14:43 2005 alerts.mydomain.com.bbd (192.168.0.8)
robin at mydomain.com 1108764882 0
Fri Feb 18 22:14:43 2005 internal.domain.int.smtp (192.168.0.8)
robin at mydomain.com 1108764882 725
Fri Feb 18 22:14:43 2005 another.domain.com.smtp (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 725
Fri Feb 18 22:14:43 2005 third.domain.com.ftp (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 721
Fri Feb 18 22:14:43 2005 third.domain.com.conn (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 500
Fri Feb 18 22:14:43 2005 another.domain.com.conn (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108764882 500
Fri Feb 18 22:14:43 2005 internal.domain.int.rpc (192.168.0.8)
robin at mydomain.com 1108764882 0
Fri Feb 18 22:14:43 2005 alerts.mydomain.com.conn (192.168.0.8)
robin at mydomain.com 1108764882 500
Fri Feb 18 22:14:43 2005 alerts.mydomain.com.http (192.168.0.8)
robin at mydomain.com 1108764882 600
Fri Feb 18 22:14:43 2005 alerts.mydomain.com.ssh (192.168.0.8)
robin at mydomain.com 1108764882 722
Fri Feb 18 22:14:43 2005 internal.domain.int.imap (192.168.0.8)
robin at mydomain.com 1108764882 843
Fri Feb 18 22:14:43 2005 internal.domain.int.dns (192.168.0.8)
robin at mydomain.com 1108764882 800
Fri Feb 18 22:14:43 2005 alerts.mydomain.com.bbtest (192.168.0.8)
robin at mydomain.com 1108764882 0
Sat Feb 19 05:45:08 2005 third.domain.com.ftp (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 721
Sat Feb 19 05:45:08 2005 third.domain.com.http (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 600
Sat Feb 19 05:45:08 2005 another.domain.com.http (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 600
Sat Feb 19 05:45:08 2005 another.domain.com.smtp (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 725
Sat Feb 19 05:45:08 2005 another.domain.com.ssh (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 722
Sat Feb 19 05:45:08 2005 internal.domain.int.http (192.168.0.8)
robin at mydomain.com 1108791908 600
Sat Feb 19 05:45:08 2005 another.domain.com.imap (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108791908 843
Sat Feb 19 05:45:09 2005 internal.domain.int.rpc (192.168.0.8)
robin at mydomain.com 1108791908 0
Sat Feb 19 05:45:09 2005 internal.domain.int.ssh (192.168.0.8)
robin at mydomain.com 1108791908 722
Sat Feb 19 05:45:09 2005 alerts.mydomain.com.ssh (192.168.0.8)
robin at mydomain.com 1108791908 722
Sat Feb 19 05:45:09 2005 internal.domain.int.smtp (192.168.0.8)
robin at mydomain.com 1108791908 725
Sat Feb 19 05:45:09 2005 internal.domain.int.imap (192.168.0.8)
robin at mydomain.com 1108791908 843
Sat Feb 19 05:45:09 2005 internal.domain.int.dns (192.168.0.8)
robin at mydomain.com 1108791908 800
Sat Feb 19 05:45:09 2005 alerts.mydomain.com.bbd (192.168.0.8)
robin at mydomain.com 1108791909 0
Sat Feb 19 05:45:09 2005 alerts.mydomain.com.http (192.168.0.8)
robin at mydomain.com 1108791909 600
Sat Feb 19 05:45:09 2005 alerts.mydomain.com.bbtest (192.168.0.8)
robin at mydomain.com 1108791909 0
Sat Feb 19 06:15:08 2005 another.domain.com.conn (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108793708 500
Sat Feb 19 06:15:08 2005 internal.domain.int.conn (192.168.0.8)
robin at mydomain.com 1108793708 500
Sat Feb 19 06:15:08 2005 third.domain.com.conn (xxx.xxx.xxx.xxx)
robin at mydomain.com 1108793708 500
Sat Feb 19 06:15:08 2005 alerts.mydomain.com.conn (192.168.0.8)
robin at mydomain.com 1108793708 500

The only rule in the alerts file is

HOST=*
     MAIL robin at mydomain.com

The histories are showing that the status for most of them is
unchanged in the last 14 hours which counting back is when the mails
were sent out. The graphs seem to show a gap in monitoring from around
21:30 (just before the first set of notifications entered the logs but
no mails were sent out) to around 04:30 (again just before the
notifications entered the log).

I know that the servers do a log rotate but that is around midnight. 

I can't understand why the status would have changed 14 hours ago and
why there should be no log data for any period.

My update period is 30 mins. The rest of the install is virtually
straight out of the box with nothing more than what the instructions
say to change.

If you want any more info just ask.

Ta

Robin



On Fri, 18 Feb 2005 23:12:48 +0100, Henrik Stoerner <henrik at hswn.dk> wrote:
> On Fri, Feb 18, 2005 at 07:04:47PM +0000, Robin Wood wrote:
> 
> > I installed hobbit around a week ago and am very impressed with it but
> > I have a question.
> >
> > I am occasionally getting a set of emails from it telling me things
> > have a status of green. These aren't after a state change as far as I
> > can tell as there are no other mails before them.
> >
> > I am getting these once every couple of days, not at any particular time.
> 
> Sounds a bit odd, but I'd need some more information before trying to
> track it down.
> 
> Which version are you using ?
> 
> What's in the ~/data/acks/notifications.log file ?
> 
> What are your rules in hobbit-alerts.cfg for sending out alert-
> and recovery-messages ?
> 
> What does the history show for a host that you get one of these
> messages for ?
> 
> Regards,
> Henrik
> 
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
> 
>