Strange Rule Matching Issue

[Chris Strzelczyk]

Hello, I have a strange rule matching issue.

I have a rule in my hobbit-alert file which looks like this:

*HOST=* SERVICE=*
        MAIL $test COLOR=red REPEAT=10*

The rule **SHOULD** only send when the disk (or any other service) reaches
red color.  I have disk defined in my hobbit-clients.cfg as:

*DISK * 90 95
*
I have a server that currently has a filesystem filled to 91%.  The server
name is 'stflnx1d'.  I am getting the following emails:

*yellow Wed Sep  3 08:52:24 EDT 2008 - Filesystems NOT ok
&yellow /var (91% used) has reached the WARNING level (90%)*

I ran the bin/hobbitd_alert and got the following:

*00011596 2008-09-03 09:24:20 Matching host:service:page
'stflnx1d:disk:AIXDev' against rule line 138
00011596 2008-09-03 09:24:20 *** Match with 'MAIL $test COLOR=red REPEAT=10'
***
00011596 2008-09-03 09:24:20 Mail alert with command
'/var/spool/mail/mrhobbit "Hobbit [12345] stflnx1d:disk CRITICAL (RED)"
chris at xxxxx.com'*


As you can see it matches the rule as RED even though I an the warning state
of yellow for the disk on the server.  It also sends me the email with
Yellow status.  It doesn't match any other rule.    I tried setting the
COLOR=yellow in the rule and it didn't match.  Can anybody tell me why
Hobbit thinks this is RED when it is really Yellow????

Thank You,
-cs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20080903/03e47fd4/attachment.html>