[Xymon] Alert issue

[J.C. Cleaver]

On Thu, November 12, 2015 6:44 am, David Welker wrote:

> Thanks!  Makes sense.  I guess the alerts.cfg.5.html file needs to be
> changed?  That's where I was looking...
> *COLOR=color[,color]* Rule matching an alert by color. Can be "red",
> "yellow", or "purple". The forms "!red", "!yellow" and "!purple" can also
> be used to NOT send an alert if the color is the specified one.
>
> Well, that fixed my first issue.  Now when the cpu is reporting green, the
> --test gives me a "Failed" message as expected, but with the cpu reporting
> yellow, I get the same "Failed" message - failed due to color!
>
> Even took xymoncmd out of the equation and the result is the same.
> Took out EXSERVICE as well.
>
> Now all I have in alerts.cfg:
> PAGE=mypage
>   MAIL me at here.com COLOR=%(red|yellow)
>
> ..yet when I run:
>  xymond_alert --test server.com cpu
> I get..
> #### DATE TIME Failed 'MAIL me at here.com COLOR=%(red|yellow)' (color)
>
> Any other suggestions?  For example, do I have to restart the server after
> making changes to the alerts.cfg file?


I believe the proper syntax there is simply:

PAGE=mypage COLOR=red,yellow
   MAIL me at here.com

COLOR can be a list of options, unlike most of the other filters (such as
EXSERVICE) which must either lexically match OR have to be prepended with
a '%' to enter "pcre-regex" mode. Additionally, COLOR= appears to not be
allowed as a per-recipient filter; in this case, it'll need to be on the
main line.

One easy way to check the syntax and rule logic is to run xymoncmd
xymond_alert --dump-config . What shows up in the result will be how the
alert system interprets it.

Also, to actually enable 'yellow' alerts, you'll want to ensure the color
is added to "$ALERTCOLORS" in xymonserver.cfg if it's not already.


HTH,
-jc




>
> Thanks,
> David
>
>
> On Wed, Nov 11, 2015 at 10:10 PM, Martin Lenko <lenko99 at gmail.com> wrote:
>
>> Hi David,
>> to specify multiple color values you will have to use regular
>> expression.
>> Use something like this in your alert config:
>> COLOR=%(yellow|red)
>>
>> The '%' character instructs xymon that following string is a regular
>> expression.
>>
>> Regards,
>> Martin
>>
>> On 11 November 2015 at 18:46, David Welker <dewelker at gmail.com> wrote:
>>
>>> I admit, this is my first attempt at alerting, so this may or may not
>>> be
>>> user error.  It also could be an issue that is fixed in the latest
>>> upgrade
>>> (I'm still on 4.3.21), but before I resort to that (which will be soon
>>> enough), I wanted to make sure I was at least thinking along the right
>>> line...
>>>
>>> The cpu column is reporting green.
>>> The entry in alerts.cfg includes a COLOR=yellow parameter.
>>> Running the xymond_alert --test reports (as expected)...
>>> Failed 'MAIN me at here COLOR=yellow EXSERVICE=conn,disk' (color)
>>>
>>> If, however, I change the COLOR to red, or even if I just add it
>>> (COLOR=yellow,red), I get the "Mail alert with command 'mail -s...'"
>>> line
>>> rather than the failed.  Did I do something wrong?
>>>
>>> Funny though, either way I don't actually get the email.
>>>
>>> Thanks,
>>> David
>>>
>>> _______________________________________________
>>> Xymon mailing list
>>> Xymon at xymon.com
>>> http://lists.xymon.com/mailman/listinfo/xymon
>>>
>>>
>>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>