[Xymon] Order of values in analysis.cfg

[Jeremy Laidman]

Hi Christian

TL;DR: Xymon will use the first line for the test in the analysis.cfg file
that matches either hostname or class.

As far as I can tell, it's the first matching line that wins. For instance,
the MEMACT line that will match a Linux host called LINUX-1 will be the
line in CLASS=linux, setting MEMACT=80/85. If you moved the HOST=LINUX-1
above CLASS=linux then that would match instead, so MEMACT=85/90. And if
you moved the DEFAULT entry above that, then you would have MEMACT=90/95.
This is why the example analysis.cfg says that the DEFAULT section "must be
placed at the end of the file". It's also why you can have two lines for
the same test in the same section, and only the first one will be used.

Internally, Xymon converts every rule line into a certain structure. You
can dump this structure using "xymond_client --dump-config", with the
format being "<TESTNAME> <alert parameters> [HOST|CLASS]=<section>". You
can then check each line to see if it is the test you're interested in, and
if it matches either class or hostname then those are the parameters it
will use for colour selection.

Also note that the class defaults to the OS name, but can be different. So
in essence the flow is effectively like this:

Repeat for each line:
    Is the line for the test we're interested in? (eg MEMACT)?
    If so, does the section name match the OS or the class or the hostname?
    If so, this is the line for you -> exit

Cheers
Jeremy

On Fri, 11 Dec 2020 at 22:26, Becker Christian <
christian.becker at rhein-zeitung.net> wrote:

> Hello to the list,
>
>
>
> this is probably the 50st question about this…..
>
>
>
> Can anybody guide me to understand, how individual machine thresholds,
> default thresholds and class thresholds are interpreted in analysis.cfg for
> different servers and in which order?
>
>
>
> Let me say this is my analysis.cfg (*this is not my working analysis.cfg,
> it’s shown here just to ask my question*):
>
>
>
>
>
> # Drop windows servers below here
>
>     CLASS=win32
>
>             MEMACT  85 90
>
>             MEMACT  85 90
>
>             MEMSWAP 85 90
>
>
>
>     HOST=WINDOWS-1
>
>             MEMACT  97 98
>
>
>
> # Drop powershell configured servers below here
>
>     CLASS=powershell
>
>             MEMACT  90 95
>
>             MEMACT  90 95
>
>             MEMSWAP 90 95
>
>
>
>     HOST=WINDOWS-2
>
>             MEMACT  90 92
>
>
>
> # Drop linux servers below here
>
>     CLASS=linux
>
>            PROC    %(syslogd|syslog-ng|rsyslogd)
>
>             PROC   sshd
>
>             MEMACT  80 85
>
>             MEMACT  80 85
>
>             MEMSWAP 80 85
>
>
>
>     HOST=LINUX-1
>
>             MEMACT  85 90
>
>
>
> # Default values
>
>     DEFAULT
>
>             DISK    * 90 95
>
>             MEMSWAP 80 90
>
>             MEMACT  90 95
>
>
>
> I have difficulties to understand, how the values would be applied. Is it
> that way, that it looks to the class of a host and applies the values of
> the class first, then the rule per hostname, and then the default? Or does
> it stop at the first match?
>
>
>
> Regards, greetings from Germany
>
> Christian
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20201214/907cfe7a/attachment.htm>