[smokeping-users] startloss,bigloss,endloss

[Peter Kristolaitis]

Yeah, your pattern isn't written properly for edgetrigger use.

The thing to understand here is that the values you provide in your 
pattern are the number of previous samples to look at in the history.  
The last pattern argument you list is the 'current' sample, then as you 
move backwards in the list, Smokeping examines more and more historical 
data.   There's no additional logic here -- you're simply matching 
current data against a pattern, and seeing if it matches or not.

So what your pattern is saying here is "This alert is TRUE when you see 
exactly 3 samples with 0% packet loss followed by exactly 4 samples with 
more than 50% packet loss".  Note that it's NOT "4 or more samples with 
 >50% packet loss".     If the alert triggers at some point, but the 
host continues to be down (i.e. >50% loss), you will be matching the 
data "100% 100% 100% 100% 100% 100% 100%" against the rule -- but since 
the first 3 samples are NOT 0% loss, you no longer match the pattern, 
and the alert un-triggers itself!

The proper way to write edgetriggers is simply ">50%,>50%,>50%,>50%".   
Because edgetriggers only send you an email when the event happens, then 
again when it stops happening, there is no need to check for 0% packet 
loss at the beginning of the pattern.  Checking for 0% loss at the 
beginning of patterns is useful when you're NOT using edgetrigger -- 
otherwise you'll get an alert for every sample!

- Peter


On 3/25/2010 12:50 PM, James Cornick - JCHost.net wrote:
> Peter thank you I have tried this and it is 'kind of working' here is 
> my bigloss alert config currently.
>
> +bigloss
> type = loss
> # in percent
> pattern = ==0%,==0%,==0%,>50%,>50%,>50%,>50%
> comment = Suddenly there is some packet loss!
> edgetrigger = yes
>
> However the alert seems to immediately clear even when the host does 
> not come back online?  Do you know if I am doing something incorrectly 
> here?
>
> Regards,
>
> James
>
> Peter Kristolaitis wrote:
>> Look at the 'edgetrigger' option for alerts.   This will cause alerts 
>> to send out 2 emails -- one when the trigger is 'true', then another 
>> when it becomes 'not true'.
>>
>> - Peter
>>
>> On 3/25/2010 11:50 AM, James Cornick - JCHost.net wrote:
>>> Hello all I'm new here however I have been using smokeping for quite
>>> some time.  I was curious if anyone had come up with way to get an 
>>> email
>>> alert on 'endloss'.  For example smokeping detects bigloss on a host 
>>> and
>>> then 10 minutes later the host comes up again.  I'm almost certain 
>>> there
>>> would be a way to configure this but all my attempts so far have
>>> failed.  If anyone has any ideas that would be much appreciated.
>>>
>>> Best Regards,
>>>
>>> James
>>>
>>> _______________________________________________
>>> smokeping-users mailing list
>>> smokeping-users at lists.oetiker.ch
>>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> smokeping-users mailing list
>> smokeping-users at lists.oetiker.ch
>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
>


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6444 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.oetiker.ch/pipermail/smokeping-users/attachments/20100325/f0e6d7f5/attachment-0001.bin