[Xymon] Xymon alerting when it's been told not to

[Ward, Martin]

My apologies, I hit the "Send" button accidentally, a bit more info would have helped :-(

I ran the " xymoncmd xymond_alert --test" as you suggested and it is definitely matching on the right entry:

00019291 2013-05-13 15:52:53 *** Match with 'PAGE=SMARTS        HOST=%sm[0-9]* EXSERVICE=files,msgs,ports,cpu' ***

The lines in the logfile there are:

PAGE=SMARTS     HOST=%sm[0-9]* EXSERVICE=files,msgs,ports,cpu
        SCRIPT /opt/xymon/server/ext/html_mail.pl internalitnoc at colt.net DURATION>1h COLOR=red RECOVERED STOP

AFAIK this means that the alert should only be sent once, however it is being sent every thirty minutes as the lines from the log file show:
Mon May 13 00:11:27 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368400263 300
Mon May 13 00:41:31 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368402066 300
Mon May 13 01:11:50 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368403886 300
Mon May 13 01:42:03 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368405699 300
Mon May 13 02:12:13 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368407508 300
Mon May 13 02:42:21 2013 sm9.lon.oss.colt.net.procs (212.74.77.85) internalitnoc at colt.net 1368409316 300

I cannot fathom why it repeats at all so rather that look for something that isn't there, for now I have forced every alert to repeat every seven days but I would like to understand more about why this is working the way it is rather than the way it is supposed to (or I think it is supposed to!).

|\/|artin
--  
Martin Ward
Manager, Technical Services
Service Operations

DDI:+44 (0) 20 7863 5218 / Fax: +44 (0)20 7863 9999 /  www.colt.net
Colt Technology Services, Unit 12, Powergate Business Park, Volt Avenue, Park Royal, London, NW10 6PW, UK.

Help reduce your carbon footprint | Think before you print. Registered in England and Wales, registered number 02452736, VAT number GB 645 4205 50


> -----Original Message-----
> From: Ward, Martin
> Sent: 13 May 2013 16:02
> To: 'henrik at hswn.dk'
> Cc: xymon at xymon.com
> Subject: RE: [Xymon] Xymon alerting when it's been told not to
> 
> I cannot fathom why it repeats at all so rather that look for something that
> isn't there I have forced every alert to repeat every seven days to see if that
> resolves the issue!
> 
> |\/|
> --
> Martin Ward
> Manager, Technical Services
> Service Operations
> 
> DDI:+44 (0) 20 7863 5218 / Fax: +44 (0)20 7863 9999 /  www.colt.net Colt
> Technology Services, Unit 12, Powergate Business Park, Volt Avenue, Park
> Royal, London, NW10 6PW, UK.
> 
> Help reduce your carbon footprint | Think before you print. Registered in
> England and Wales, registered number 02452736, VAT number GB 645 4205
> 50
> 
> 
> > -----Original Message-----
> > From: henrik at hswn.dk [mailto:henrik at hswn.dk]
> > Sent: 04 March 2013 11:27
> > To: Ward, Martin
> > Cc: xymon at xymon.com
> > Subject: Re: [Xymon] Xymon alerting when it's been told not to
> >
> > On Mon, 4 Mar 2013 09:19:25 +0000, "Ward, Martin"
> > <Martin.Ward at colt.net>
> > wrote:
> > > Hi all,
> > >
> > > I have the following in my alerts.cfg:
> > [snip]
> > > Yet I am still getting CPU alerts from ivma2.lon.osspriv.colt.net
> >
> > Try running
> >    xymoncmd xymond_alert --test ivma2.lon.osspriv.colt.net cpu and
> > look for lines like
> >
> > 00004226 2013-03-04 12:24:11 Matching host:service:dgroup:page
> > 'cscxymweb3.csc.dk:disk:Xymon
> > servers:cscdk/mwsmonitor,cscdk/mwsmonitor'
> > against rule line 1260
> > 00004226 2013-03-04 12:24:11 *** Match with 'MAIL $XYMONADM
> > $XYMONADMREPEAT' ***
> > 00004226 2013-03-04 12:24:11 Mail alert with command '/usr/bin/mail -s
> > "Xymon [12345] cscxymweb3.csc.dk:disk CRITICAL (RED)"
> > 29236260 at sms.csc.dk'
> > 00004226 2013-03-04 12:24:11 Matching host:service:dgroup:page
> > 'cscxymweb3.csc.dk:disk:Xymon
> > servers:cscdk/mwsmonitor,cscdk/mwsmonitor'
> > against rule line 126
> >
> > to see which rule triggers the alert.
> >
> >
> > Regards,
> > Henrik


[Colt Disclaimer]
This email is from an entity of the Colt group of companies.
Colt Group S.A., K2 Building, Forte 1, 2a rue Albert Borschette, L-1246 Luxembourg, R.C.S. B115679.
Corporate and contact information for our entities can be found at
http://colt.net/uk/en/Colt-Group-of-Companies/index.htm.
Internet communications are not secure and Colt does not accept
responsibility for the accurate transmission of this message. Content
of this email or its attachments is not legally or contractually binding
unless expressly previously agreed in writing by Colt