[Xymon] Annyoing logic in alerts.cfg

[Even Hauge Juberg]

Sadly, I spoke to soon. It is definitely nagging with the recovered-messages, even though there is no RECOVERED tag in the alerts.cfg file.

Sincerely,
Even

Fra: Xymon [mailto:xymon-bounces at xymon.com] På vegne av Even Hauge Juberg
Sendt: tirsdag 28. mars 2017 11.28
Til: Galen Johnson <Galen.Johnson at sas.com>; xymon at xymon.com
Emne: Re: [Xymon] Annyoing logic in alerts.cfg


Thank you for your reply!



Yes, I believe I did try that, but it actually sending a "recovered" to all users in the list, but I must've misconfigured something or simply remembering wrong. It seems to be working just as I want it now, I did add the "RECOVERED" to one user on the list - som maybe that did the trick?



Sincerely

Even





________________________________
Fra: Galen Johnson <Galen.Johnson at sas.com<mailto:Galen.Johnson at sas.com>>
Sendt: 27. mars 2017 15:49
Til: Even Hauge Juberg; xymon at xymon.com<mailto:xymon at xymon.com>
Emne: Re: Annyoing logic in alerts.cfg


Have you tried removing the recovered stanza?  I thought Xymon only sent a recovered message if you explicitly tell it to on the alert itself:


HOST=*
     MAIL someuser at example.com<mailto:someuser at example.com> DURATION>10 REPEAT=30 RECOVERED UNMATCHED



Check other rules to see if you are overriding it somewhere by telling it to explicitly send recover messages.



NB: I had thought there was a global setting somewhere that would default it to on but I can't find it



Basically, try commenting out


HOST=* RECOVERED=1
        IGNORE HOST=*​

and see if it behaves like you want.



=G=



________________________________
From: Xymon <xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>> on behalf of Even Hauge Juberg <even.juberg at ntnu.no<mailto:even.juberg at ntnu.no>>
Sent: Monday, March 27, 2017 8:04 AM
To: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: [Xymon] Annyoing logic in alerts.cfg


Hi!



I've been using Xymon for years and have recently begun to play around with the alerts.cfg, however, there is something I have been banging my head against the wall with, for weeks now. So I am reaching out to this list in the hopes that someone out there might have the key to save me from eternal frustration.



*snippet from my alerts.cfg*


HOST=* RECOVERED=1
        IGNORE HOST=*

HOST=one-host SERVICE=http
        MAIL someuser at domain.local<mailto:someuser at domain.local> COLOR=red
        MAIL someuser at domain.local<mailto:someuser at domain.local> DURATION>5 COLOR=red

What I'm trying to accomplish is to stop the "I'm OK - recovered" messages. Those messages are irrelevant, so I want those filtered out. The problem though, is that the logic is completely off on this point. The first rule for some reason takes presedense, even though I have explicitly told it to only use that rule IF the host has recovered, no?

I want it to skip that rule, if it has not yet recovered, send mail to the first user immediately, then to the other user after 5 minutes, but leave those users alone if the service is OK again. Is there a way to accomplish this?

Sincerely,
Even


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20170330/e1fc8822/attachment.html>