[Check_mk (english)] Different threshold when counting event console messages

Trahan, Jonathan Trahan.Jonathan at hydro.qc.ca
Mon Jul 18 19:34:47 CEST 2016


Swapping rules as the same behaviour.

Let's say there is 13 events that are sent to the Event Console with the text to match "ORA-00060".  What will happen with the rules swapped is the the CRIT rule will appear in the Event Console with the 13 messages and the icon "This event has not reached the target count yet".

The WARN rule is then just ignored.

Cheers,
Jonathan


De : Thomas Mashos [mailto:TMashos at navexglobal.com] 
Envoyé : 18 juillet 2016 13:24
À : Trahan, Jonathan; checkmk-en at lists.mathias-kettner.de
Objet : Re: [Check_mk (english)] Different threshold when counting event console messages

Courriel provenant de l’externe
ATTENTION, avant d’accéder à une pièce jointe ou à un lien de ce courriel, assurez-vous que celui-ci provient d’un tiers de confiance.
Couldn't you just swap the rules so rule #1 was the crit at 200 messages in 10 minutes?
________________________________________
From: checkmk-en-bounces at lists.mathias-kettner.de <checkmk-en-bounces at lists.mathias-kettner.de> on behalf of Trahan, Jonathan <Trahan.Jonathan at hydro.qc.ca>
Sent: Monday, July 18, 2016 10:15:16 AM
To: checkmk-en at lists.mathias-kettner.de
Subject: [Check_mk (english)] Different threshold when counting event console messages 
 
Hi,
        Is there any way to apply different threshold (warning vs. critical) when couting event console messages for the same text to match?

        Let's say I make those two rules in the Event Console:
                - Rule #1
                        O State: WARN
                        o Text to match: ORA-00060
                        o Count messages in defined interval: 10 messages in 10 minutes interval
                - Rule #2
                        O State: CRIT
                        o Text to match: ORA-00060
                        o Count messages in defined interval: 200 messages in 10 minutes interval

        Rule #2 will never be applied since Rule #1 will grab all incoming messages after the 10 count.  Same thing happens if you reverse the order of the rules.

        We need to have different states (WARN/CRIT) in our case since depending on which state it is, the alert is sent to a different team (level 1 support vs. level 2 support).

Best regards,
Jonathan
_______________________________________________
checkmk-en mailing list
checkmk-en at lists.mathias-kettner.de
http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en
Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of NAVEX Global® Inc. and the intended recipients and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. 


More information about the checkmk-en mailing list