alter3d at alter3d.ca
Thu Mar 25 18:03:18 CET 2010
Yeah, your pattern isn't written properly for edgetrigger use.
The thing to understand here is that the values you provide in your
pattern are the number of previous samples to look at in the history.
The last pattern argument you list is the 'current' sample, then as you
move backwards in the list, Smokeping examines more and more historical
data. There's no additional logic here -- you're simply matching
current data against a pattern, and seeing if it matches or not.
So what your pattern is saying here is "This alert is TRUE when you see
exactly 3 samples with 0% packet loss followed by exactly 4 samples with
more than 50% packet loss". Note that it's NOT "4 or more samples with
>50% packet loss". If the alert triggers at some point, but the
host continues to be down (i.e. >50% loss), you will be matching the
data "100% 100% 100% 100% 100% 100% 100%" against the rule -- but since
the first 3 samples are NOT 0% loss, you no longer match the pattern,
and the alert un-triggers itself!
The proper way to write edgetriggers is simply ">50%,>50%,>50%,>50%".
Because edgetriggers only send you an email when the event happens, then
again when it stops happening, there is no need to check for 0% packet
loss at the beginning of the pattern. Checking for 0% loss at the
beginning of patterns is useful when you're NOT using edgetrigger --
otherwise you'll get an alert for every sample!
On 3/25/2010 12:50 PM, James Cornick - JCHost.net wrote:
> Peter thank you I have tried this and it is 'kind of working' here is
> my bigloss alert config currently.
> type = loss
> # in percent
> pattern = ==0%,==0%,==0%,>50%,>50%,>50%,>50%
> comment = Suddenly there is some packet loss!
> edgetrigger = yes
> However the alert seems to immediately clear even when the host does
> not come back online? Do you know if I am doing something incorrectly
> Peter Kristolaitis wrote:
>> Look at the 'edgetrigger' option for alerts. This will cause alerts
>> to send out 2 emails -- one when the trigger is 'true', then another
>> when it becomes 'not true'.
>> - Peter
>> On 3/25/2010 11:50 AM, James Cornick - JCHost.net wrote:
>>> Hello all I'm new here however I have been using smokeping for quite
>>> some time. I was curious if anyone had come up with way to get an
>>> alert on 'endloss'. For example smokeping detects bigloss on a host
>>> then 10 minutes later the host comes up again. I'm almost certain
>>> would be a way to configure this but all my attempts so far have
>>> failed. If anyone has any ideas that would be much appreciated.
>>> Best Regards,
>>> smokeping-users mailing list
>>> smokeping-users at lists.oetiker.ch
>> smokeping-users mailing list
>> smokeping-users at lists.oetiker.ch
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 6444 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.oetiker.ch/pipermail/smokeping-users/attachments/20100325/f0e6d7f5/attachment-0001.bin
More information about the smokeping-users