[smokeping-users] startloss,bigloss,endloss

[James Cornick - JCHost.net]

Peter,

Thanks for your explanation this makes perfect sense and works as expected!

Peter Kristolaitis wrote:
> Yeah, your pattern isn't written properly for edgetrigger use.
>
> The thing to understand here is that the values you provide in your 
> pattern are the number of previous samples to look at in the history.  
> The last pattern argument you list is the 'current' sample, then as 
> you move backwards in the list, Smokeping examines more and more 
> historical data.   There's no additional logic here -- you're simply 
> matching current data against a pattern, and seeing if it matches or not.
>
> So what your pattern is saying here is "This alert is TRUE when you 
> see exactly 3 samples with 0% packet loss followed by exactly 4 
> samples with more than 50% packet loss".  Note that it's NOT "4 or 
> more samples with >50% packet loss".     If the alert triggers at some 
> point, but the host continues to be down (i.e. >50% loss), you will be 
> matching the data "100% 100% 100% 100% 100% 100% 100%" against the 
> rule -- but since the first 3 samples are NOT 0% loss, you no longer 
> match the pattern, and the alert un-triggers itself!
>
> The proper way to write edgetriggers is simply 
> ">50%,>50%,>50%,>50%".   Because edgetriggers only send you an email 
> when the event happens, then again when it stops happening, there is 
> no need to check for 0% packet loss at the beginning of the pattern.  
> Checking for 0% loss at the beginning of patterns is useful when 
> you're NOT using edgetrigger -- otherwise you'll get an alert for 
> every sample!
>
> - Peter
>
>
> On 3/25/2010 12:50 PM, James Cornick - JCHost.net wrote:
>> Peter thank you I have tried this and it is 'kind of working' here is 
>> my bigloss alert config currently.
>>
>> +bigloss
>> type = loss
>> # in percent
>> pattern = ==0%,==0%,==0%,>50%,>50%,>50%,>50%
>> comment = Suddenly there is some packet loss!
>> edgetrigger = yes
>> However the alert seems to immediately clear even when the host does 
>> not come back online?  Do you know if I am doing something 
>> incorrectly here?
>>
>> Regards,
>>
>> James
>>
>> Peter Kristolaitis wrote:
>>> Look at the 'edgetrigger' option for alerts.   This will cause 
>>> alerts to send out 2 emails -- one when the trigger is 'true', then 
>>> another when it becomes 'not true'.
>>>
>>> - Peter
>>>
>>> On 3/25/2010 11:50 AM, James Cornick - JCHost.net wrote:
>>>> Hello all I'm new here however I have been using smokeping for quite
>>>> some time.  I was curious if anyone had come up with way to get an 
>>>> email
>>>> alert on 'endloss'.  For example smokeping detects bigloss on a 
>>>> host and
>>>> then 10 minutes later the host comes up again.  I'm almost certain 
>>>> there
>>>> would be a way to configure this but all my attempts so far have
>>>> failed.  If anyone has any ideas that would be much appreciated.
>>>>
>>>> Best Regards,
>>>>
>>>> James
>>>>
>>>> _______________________________________________
>>>> smokeping-users mailing list
>>>> smokeping-users at lists.oetiker.ch
>>>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
>>>
>>>
>>> ------------------------------------------------------------------------ 
>>>
>>>
>>> _______________________________________________
>>> smokeping-users mailing list
>>> smokeping-users at lists.oetiker.ch
>>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
>>
>
>