Alert Config Issues

[Andy France]

I am getting some dead.letter issues as it seems hobbit is mis-reading my
alert config... either that or I have laid out my hobbit-alerts.cfg file
badly!

It's still a bit of a shambles from an organisation point of view, with a
lot of repitition rather than macros, so I'll use a small example:


EXTRACT FROM hobbit-alerts.cfg :

  HOST=zd1sv1,zt1sv1,zp1sv1,zp1sv2
        MAIL    andy            REPEAT=60m RECOVERED FORMAT=TEXT
        MAIL    ernstd          REPEAT=60m RECOVERED FORMAT=TEXT
SERVICE=disk COLOR=red DURATION>60m
        SCRIPT  /export/home/hobbit/bin/qpage   support-pg      REPEAT=60m
RECOVERED FORMAT=SMS COLOR=red
        SCRIPT  /export/home/hobbit/bin/etxt    andy-ph         RECOVERED
FORMAT=SMS COLOR=red


RESULTS OF ~/server/bin/bbcmd hobbitd_alert --test zp1sv1 disk :

  00013427 2005-05-23 15:28:04 send_alert zp1sv1:disk state Paging
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 109
  00013427 2005-05-23 15:28:04 *** Match with
'HOST=zd1sv1,zt1sv1,zp1sv1,zp1sv2' ***
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 110
  00013427 2005-05-23 15:28:04 *** Match with 'MAIL
andy            REPEAT=60m RECOVERED FORMAT=TEXT' ***
  00013427 2005-05-23 15:28:04 Mail alert with command '/opt/csw/bin/nail
-s "Hobbit [12345] zp1sv1:disk CRITICAL (RED)" andy'
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 110
  00013427 2005-05-23 15:28:04 *** Match with 'MAIL
andy            REPEAT=60m RECOVERED FORMAT=TEXT' ***
  00013427 2005-05-23 15:28:04 Mail alert with command '/opt/csw/bin/nail
-s "Hobbit [12345] zp1sv1:disk CRITICAL (RED)"  REPEAT=60m'
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 111
  00013427 2005-05-23 15:28:04 Failed 'MAIL
ernstd          REPEAT=60m RECOVERED FORMAT=TEXT SERVICE=disk COLOR=red
DURATION>60m' (min. duration 0<3600)
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 111
  00013427 2005-05-23 15:28:04 Failed 'MAIL
ernstd          REPEAT=60m RECOVERED FORMAT=TEXT SERVICE=disk COLOR=red
DURATION>60m' (min. duration 0<3600)
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 112
  00013427 2005-05-23 15:28:04 *** Match with 'SCRIPT
/export/home/hobbit/bin/qpage   support-pg      REPEAT=60m RECOVERED
FORMAT=SMS COLOR=red' ***
  00013427 2005-05-23 15:28:04 Script alert with command
'/export/home/hobbit/bin/qpage' and recipient support-pg
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 113
  00013427 2005-05-23 15:28:04 *** Match with 'SCRIPT
/export/home/hobbit/bin/etxt    andy-ph         RECOVERED FORMAT=SMS
COLOR=red' ***
  00013427 2005-05-23 15:28:04 Script alert with command
'/export/home/hobbit/bin/etxt' and recipient andy-ph
  00013427 2005-05-23 15:28:04 Matching host:service:page
'zp1sv1:disk:sap/sap-r3' against rule line 113
  00013427 2005-05-23 15:28:04 *** Match with 'SCRIPT
/export/home/hobbit/bin/etxt    andy-ph         RECOVERED FORMAT=SMS
COLOR=red' ***
  00013427 2005-05-23 15:28:04 Script alert with command
'/export/home/hobbit/bin/etxt' and recipient     RECOVERED


As you can see, I get some funny duplications and errors:

- Why does the first MAIL line pick up the correct recipient "andy", and
then send to user "REPEAT=60m" as well?
- Why does ernstd not get matched when SERVICE=disk is on his config line?
- Why does the etxt script get called for both "andy-ph" and "RECOVERED"
while the qpage script is OK?
- Although it's not shown here, I am getting repeat emails to "andy" every
30 minutes even though the config says 60.

I'm starting to suspect it is to do with the order of the arguments, or
maybe whitespace issues.  Or, God forbid, oddball control characters which
have somehow ended up in the file.

If anyone can help out in getting this working I would appreciate it.

Currently running Hobbit 4.03. on Solaris 9 x86 (SunOS zpnz-mtm-bb01 5.9
Generic_117172-05 i86pc i386 i86pc).  Short to long mail name handling is
done via entries in /etc/mail/aliases.

Cheers,
Andy.

#####################################################################################

This email is intended for the person to whom it is addressed
only. If you are not the intended recipient, do not read, copy
or use the contents in any way. The opinions expressed may not
necessarily reflect those of ZESPRI Group of Companies ('ZESPRI').

While every effort has been made to verify the information
contained herein, ZESPRI does not make any representations 
as to the accuracy of the information or to the performance
of any data, information or the products mentioned herein.
ZESPRI will not accept liability for any losses, damage or
consequence, however, resulting directly or indirectly from
the use of this e-mail/attachments.
#####################################################################################