Yeah, your pattern isn't written properly for edgetrigger use.
The thing to understand here is that the values you provide in your pattern are the number of previous samples to look at in the history. The last pattern argument you list is the 'current' sample, then as you move backwards in the list, Smokeping examines more and more historical data. There's no additional logic here -- you're simply matching current data against a pattern, and seeing if it matches or not.
So what your pattern is saying here is "This alert is TRUE when you see exactly 3 samples with 0% packet loss followed by exactly 4 samples with more than 50% packet loss". Note that it's NOT "4 or more samples with >50% packet loss". If the alert triggers at some point, but the host continues to be down (i.e. >50% loss), you will be matching the data "100% 100% 100% 100% 100% 100% 100%" against the rule -- but since the first 3 samples are NOT 0% loss, you no longer match the pattern, and the alert un-triggers itself!
The proper way to write edgetriggers is simply ">50%,>50%,>50%,>50%". Because edgetriggers only send you an email when the event happens, then again when it stops happening, there is no need to check for 0% packet loss at the beginning of the pattern. Checking for 0% loss at the beginning of patterns is useful when you're NOT using edgetrigger -- otherwise you'll get an alert for every sample!
- Peter On 3/25/2010 12:50 PM, James Cornick - JCHost.net wrote:
Peter thank you I have tried this and it is 'kind of working' here is my bigloss alert config currently.+bigloss type = loss # in percent pattern = ==0%,==0%,==0%,>50%,>50%,>50%,>50% comment = Suddenly there is some packet loss! edgetrigger = yesHowever the alert seems to immediately clear even when the host does not come back online? Do you know if I am doing something incorrectly here?Regards, James Peter Kristolaitis wrote:Look at the 'edgetrigger' option for alerts. This will cause alerts to send out 2 emails -- one when the trigger is 'true', then another when it becomes 'not true'.- Peter On 3/25/2010 11:50 AM, James Cornick - JCHost.net wrote:Hello all I'm new here however I have been using smokeping for quitesome time. I was curious if anyone had come up with way to get an email alert on 'endloss'. For example smokeping detects bigloss on a host and then 10 minutes later the host comes up again. I'm almost certain therewould be a way to configure this but all my attempts so far have failed. If anyone has any ideas that would be much appreciated. Best Regards, James _______________________________________________ smokeping-users mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users------------------------------------------------------------------------ _______________________________________________ smokeping-users mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ smokeping-users mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
