Subject: Changeing how long before Argus sends notifications

From: Andy <[email-masked]>
Date: Mon, 1 Aug 2005 16:04:04 +0100

I have a a number of groups within my current Argus config file which
looks something like the following;

Group "one" {
        notify: [email-masked]
        sendnotify: yes
        overridable:    yes
        messagedn:      %i %r %s %t
        Include "/var/argus/one"
}

Group "two" {
        #notify: [email-masked]
        #sendnotify: yes
        overridable:    yes
        messagedn:      %i %r %s %t
        Include "/var/argus/two"
}

As you can see currently group "one" sends out notifications when
anything within that group goes down, group two does not.

What I  am trying to do is set it up so that group "two" would send
notifications if a device in that group has been down for 60 minutes
or more. Would the following config allow me to do that ?

Group "one" {
        notify: [email-masked]
        sendnotify: yes
        overridable:    yes
        messagedn:      %i %r %s %t
        Include "/var/argus/one"
}

Group "two" {
        #notify: [email-masked]
        sendnotify: yes
        escalate: 60 mail:[email-masked]
        overridable:    yes
        messagedn:      %i %r %s %t
        Include "/var/argus/two"
}

If not could anyone suggest a way of setting it so that it does?

I'm trying to avoid changing the number of the "retries:" under the
service, as each of the groups has a couple of hundred entries, and
would like to retain the flexibility of a single change effecting all
of the devices under the group. Also I need to retain logging for when
they go down, I just need to modify how soon the notification goes
out.

Thanks, Andy.

---

From: Jeremy Kister <[email-masked]>
Date: Tue, 02 Aug 2005 03:01:38 -0400

> or more. Would the following config allow me to do that ?
[...]
>         escalate: 60 mail:[email-masked]

retries/frequency is probably the only reasonable way to do it.

A hack would include setting up an email address that throws away mail
(i.e. bitbucket).

Group "two" {
 sendnotify: yes
 notify: [email-masked]
 renotify: 0
 escalate: 60 mail:[email-masked]
 [...]
}

I havent tested the "renotify: 0" -- if it doesnt work, do renotify:
3600 and argus will just send out two notices that will be thrown away.

Then you'll get your escalation notice at 60 minutes.

-- 

Jeremy Kister
http://jeremy.kister.net./
Got DARP?  http://argus.tcp4me.com/darp.html