Not a bug but expected behaviour.
In the case of RPCping, the host was reachable and hence UP (there are
only two states that a site pinged by RPCping can be in i.e. up or down).
There are no thresholds to compare against.
In the case of hostmon and pingmon and most of the other monitors, there
are multiple thresholds to check and compare against. In your case,
PageOuts exceeded the Critical threshold and hence went into critical
state and was logged. However, after that it dropped to *Error* state, NOT
into *Info* since it still was exceeding the Warn and Error thresholds.
Hence, the site is not Critical, but still in Error condition. It is
deemed 'UP' only when it goes back into Info mode.
For your scripting, you can look at the LEVEL and LOGLEVEL lines. It is
up to you to decide if you want to get paged about it coming back out of
Critical or going back into Info mode.
-vikas
> I've noticed what seems like broken behaviour with logging by noclogd
> with hostmon events. Here's an example.
>
> In this case with portmapper, when the site came back up the level moved
> to Info and was marked up
>
> Fri Sep 4 03:09:00 1998 [rpcpingmon]: SITE mail.xxx mail.xxx.com VAR
> Portmapper 0 3 Status LEVEL Critical LOGLEVEL Critical NOCOP down
> Fri Sep 4 05:59:00 1998 [rpcpingmon]: SITE mail.xxx mail.xxx.com VAR
> Portmapper 1 3 Status LEVEL Info LOGLEVEL Critical NOCOP up
>
> Whereas, this example shows a hostmon incident where page outs went
> critical for a while. In this case the last entry is still down, though
> it moved to Level Error from Critical.
>
> Thu Sep 3 22:24:00 1998 [hostmon]: SITE mail1.toronto.xxx - VAR
> PageOut 1219 999 po LEVEL Critical LOGLEVEL Critical NOCOP down
> Thu Sep 3 22:34:00 1998 [hostmon]: SITE mail1.toronto.xxx - VAR
> PageOut 34 10 po LEVEL Error LOGLEVEL Critical NOCOP down
>
> Is this a bug? I've been working on a script to reformat the noclogd
> output into an email message for emailing and sending to a pager gateway
> and this is messing me up. ;)
|