Peter, Thanks for your explanation this makes perfect sense and works as expected!
Peter Kristolaitis wrote: > Yeah, your pattern isn't written properly for edgetrigger use. > > The thing to understand here is that the values you provide in your > pattern are the number of previous samples to look at in the history. > The last pattern argument you list is the 'current' sample, then as > you move backwards in the list, Smokeping examines more and more > historical data. There's no additional logic here -- you're simply > matching current data against a pattern, and seeing if it matches or not. > > So what your pattern is saying here is "This alert is TRUE when you > see exactly 3 samples with 0% packet loss followed by exactly 4 > samples with more than 50% packet loss". Note that it's NOT "4 or > more samples with >50% packet loss". If the alert triggers at some > point, but the host continues to be down (i.e. >50% loss), you will be > matching the data "100% 100% 100% 100% 100% 100% 100%" against the > rule -- but since the first 3 samples are NOT 0% loss, you no longer > match the pattern, and the alert un-triggers itself! > > The proper way to write edgetriggers is simply > ">50%,>50%,>50%,>50%". Because edgetriggers only send you an email > when the event happens, then again when it stops happening, there is > no need to check for 0% packet loss at the beginning of the pattern. > Checking for 0% loss at the beginning of patterns is useful when > you're NOT using edgetrigger -- otherwise you'll get an alert for > every sample! > > - Peter > > > On 3/25/2010 12:50 PM, James Cornick - JCHost.net wrote: >> Peter thank you I have tried this and it is 'kind of working' here is >> my bigloss alert config currently. >> >> +bigloss >> type = loss >> # in percent >> pattern = ==0%,==0%,==0%,>50%,>50%,>50%,>50% >> comment = Suddenly there is some packet loss! >> edgetrigger = yes >> However the alert seems to immediately clear even when the host does >> not come back online? Do you know if I am doing something >> incorrectly here? >> >> Regards, >> >> James >> >> Peter Kristolaitis wrote: >>> Look at the 'edgetrigger' option for alerts. This will cause >>> alerts to send out 2 emails -- one when the trigger is 'true', then >>> another when it becomes 'not true'. >>> >>> - Peter >>> >>> On 3/25/2010 11:50 AM, James Cornick - JCHost.net wrote: >>>> Hello all I'm new here however I have been using smokeping for quite >>>> some time. I was curious if anyone had come up with way to get an >>>> email >>>> alert on 'endloss'. For example smokeping detects bigloss on a >>>> host and >>>> then 10 minutes later the host comes up again. I'm almost certain >>>> there >>>> would be a way to configure this but all my attempts so far have >>>> failed. If anyone has any ideas that would be much appreciated. >>>> >>>> Best Regards, >>>> >>>> James >>>> >>>> _______________________________________________ >>>> smokeping-users mailing list >>>> [email protected] >>>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users >>> >>> >>> ------------------------------------------------------------------------ >>> >>> >>> _______________________________________________ >>> smokeping-users mailing list >>> [email protected] >>> https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users >> > > _______________________________________________ smokeping-users mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users
