Once you have configured bbwarnsetup.cfg, you can create notification rules in bbwarnrules.cfg.
Tip. We suggest you get basic e-mail notification working (replace the e-mail recipient in the rule towards the bottom of the bbwarnrules.cfg file) before you try more advanced options.
Rules are written in the following format:
hosts;exhosts;services;exservices;day;time;recipients
or (pre 3.20)
hosts;exhosts;services;exservices;day;time;recipients
|
Field |
Description |
|
hosts |
Send notifications for these hosts (* is a wildcard for all hosts). |
|
exhosts |
Exclude these hosts. |
|
services |
Send notifications for these services (* is wildcard for all services). |
|
exservices |
Exclude these services. |
|
colors |
colors that are valid for this rule. (this is a new field, * will match against colors in pagelevels token in etc\bbwarnsetup.cfg.) |
|
day |
Send notifications on these days: 0-6 (Sunday -- Saturday) |
|
time |
Send notifications during these times: 0000-2359 |
|
recipients |
e-mail address, numeric pager, page group, SNMP trap server or external script recipient e-pager recipients are listed as ep-<recipient> (an e-pager recipient will receive an abbreviated message). Page groups are listed as pg-groupname. SNMP traps are defined as trap-<ip address or hostname of SNMP trap server) To indicate a recipient should be notified using an external notification script, enter ext-scriptname-recipient. For example, ext-ex1-sample@bb4.com to send a notification to the recipient called sample@bb4.com using the ex1 script. If you are using the qpage application to send SMS notifications, you can enter SMS recipients in the format qp-recipient. If you are using the smsclient application for SMS recipients, use the format smsclient-recipient. Note that both qpage and smsclient are third-party applications, and are not supported by Quest Software. Specify all recipients that do not allow long messages in the briefrcpt token in etc/bbwarnsetup.cfg. You can define an initial delay (which determines how long before the next notification occurs) for a specific recipient by appending the time value to the recipient: recipient:XX where XX is the value in minutes. |
Note. The default field delimiter is the semi-colon ( ; ), as shown. You can change this using the cfgdelim setting in bbwarnsetup.cfg. Even though egrep regular expressions are allowed, do not use the .* construct, just use *. It will be replaced with .* in the regexp.
For example, to notify recipients in the group unixadmins for all hosts in the host group unix, and all recipients in the group winadmins for all hosts in the host group windows, enter these two rules:
hg-unix;;*;;*;*;*;pg-unixadmins
hg-windows;;*;;*;*;*;pg-winadmins
You can use a special hostname, unmatched-, to create a rule for any hosts which are not listed in the server's bb-hosts file:
unmatched-*;;*;;*;*;*;bbadmin@localhost.com
Here is a more complex sample rule:
*;win34 unix12;*;cpu disk;*;0 5 6;*;backupadmin@quest.com 555-9999
This rule send notifications for all hosts except win34 and unix12, and all tests except the cpu and disk tests, on Sunday, Friday, and Saturday only, via e-mail to backupadmin@quest.com and to a pager with the number 555-9999.
There's also a special format of the rule line:
!hosts;exhosts;services;exservices;colors:day;time;recipients
If a rule line starts with !, the event that matches the rule line will disable notification to any recipient defined on that rule line. If the recipients field is * then no notification will occur for that event. Here's an example:
!*;;*;;*;*;*;*
This will in effect disable all notifications and render useless any other rule that you have defined. Here's another example:
!*;;*;;red;*;*;robert@localhost 9999999
This will remove robert@localhost and 9999999 from the list of recipients for the current event if they were defined in another rule that matched the same event.
If you notice that Big Brother doesn't wait long enough before it sends the numeric digits on a beeper message, add delays of 2 seconds by appending commas ( , ) to the beeper number. Add as many commas as needed to send the message properly.
To escalate a notification, use the following format for the recipient:
recipient:^XX[-YY]
XX is the initial wait before sending the notification
YY is the delay for each subsequent call. If it is not specified then the pagedelay value from bbwarnsetup.cfg is used.
An escalation can only be acknowledged by the recipient, not by someone else using a global acknowledgement..
You can override the page delay default (from bbwarnsetup.cfg) for any recipient. The format is:
recipient:~XX[-YY]
XX is the initial delay before sending the notification
YY is the delay for each subsequent call. If it is not specified then the pagedelay value from bbwarnsetup.cfg is used.
An initial delay can be reset if a recipient acknowledges a notification for all recipients of that notification.
If you want to use Big Brother's manual paging feature, you must define the recipient for the manual notification. You do this by creating a recipient definition for the host notify-admin, like this:
notify-admin;;pagehelp;;*;*;bbadmin@localhost
The line must start with notify-admin, and must include pagehelp as the service. You can include one or more recipients who will receive manual pages sent from the display Web page.
Big Brother includes a program to check the format of the entries in bbwarnrules.cfg. it checks each line to make sure it has the correct number of fields. To run it:
cd $BBHOME/etc
./bbchkwarnrules.cfg
For examples and complete information on notification, please refer to the etc/bbwarnrules.cfg and etc/bbwarnsetup.cfg files.