Alert Syntax and Notification log mismatch

[Asif Iqbal]

Hi All

I did a bbcmd hobbit_alert --dump-config and looked for particular host testhost1

HOST=%.* EXHOST=%testhost1(.*)
	MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30 SERVICE=msgs DURATION>10

HOST=%testhost1(.*) EXSERVICE="msgs,vmio"
        MAIL sysadmin at here.net,oncall at here.net FORMAT=TEXT REPEAT=30
        MAIL user at here.com,123456789 at skytel.com FORMAT=TEXT REPEAT=30 

HOST=%testhost1(.*) SERVICE="vmio"
        MAIL sysadmin at here.net FORMAT=TEXT REPEAT=30 DURATION>10

HOST=%testhost2(.*)|testhost1(.*) SERVICE="msgs"
        SCRIPT /export/home/hobbit/server/bin/script user at here.com,12345678 at skytel.com FORMAT=TEXT REPEAT=30

So only sysadmin at here.net and oncall at here.net should get any alert
related to testhost1.here.net's vmio service. But I am seeing
user at here.com and 123456789 at skytel.com are also getting those alerts per
my notification log

(hobbit)@hobbitserver:~/server/etc$ tail -100 /var/log/hobbit/notifications.log

Wed Oct 12 09:23:33 2005 testhost1.here..net.vmio (1.2.1.251) sysadmin at here.net,oncall at here.net 1129123412 0
Wed Oct 12 09:23:35 2005 testhost1.here.net.vmio (1.2.1.251) user at here.com,12345678 at skytel.com 1129123412 0
Thu Oct 13 09:23:48 2005 testhost1.here..net.vmio (1.2.1.251) sysadmin at here.net,oncall at here.net 1129209826 0
Thu Oct 13 09:23:50 2005 testhost1.here.net.vmio (1.2.1.251) user at here.com,12345678 at skytel.com 1129209826 0

Any help to demystify this would be appreciated

I am using 4.1.2 for hobbit server and BB 1.9c for testhost1.here.net 

Thanks

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
"..there are two kinds of people: those who work and those who take the credit...try
 to be in the first group;...less competition there."  - Indira Gandhi