Keywords: Big Sister, Bigsister, Network Monitor, Network Monitoring, Perl, GPL, Big Brother, manual, SNMP

Patterns - "when to do things"
Prev | Configure Alarming | Next

### Patterns - "when to do things"

The most simple form of a pattern is a `host.check` pattern.

#### Simple rule

     foo.cpu mail=nobody

(where foo.cpu is the pattern and mail=nobody is the description) for instance matches only status changes for the host foo and the cpu check. The above rule tells Big Sister to forward alarms for foo.cpu to the user nobody.

#### Using wildcard in rules

     *.cpu mail=nobody

Now let's assume you do not want to list each individual system and check in the rule file. The Alarm Generator accepts one single wildcard - * - matching any check or any host

     foo.* mail=nobody

And for matching any status change for any host.

     *.* mail=nobody

#### Using groups in rules

Of course you may want to address a group of hosts - haven't you spent hours setting up groups after reading section 2.2.3? Exactly these groups are also visible to the alarm generator.

By prefixing a host name with a '@' character you point Big Sister to match a group rather than a single host so that a rule like

     @USA.* mail=nobody

for instance applies to any status change reported for any system being member of the group USA.

#### Using criteria in rules

So far so good. Sometimes it is very useful to be able to make alarming behave different depending on when a status change is detected - maybe you just refuse to be woken up by your beeper during the night or you want get alarms via another medium during working hours.

For this purpose the patterns can contain so-called pre-conditions. In the rule

     @USA.*{weekday Sat,Sun} mail=pikett

the stuff in parenthesis is a pre-condition. The rule will only match status changes for any system being member of the group USA reported during the weekend. An- other useful precondition is the daytime condition. This rule

     *.*{daytime 17:00-07:00} down=never

for instance will suppress (down=never) any status change reported between 5pm and 7am. Of course conditions can be combined using `and` and `or`, so

     *.*{daytime 17:00-07:00 or weekday Sat,Sun} \ down=never

will suppress any status change reported between 5pm and 7am or during week-end.

Prev | Up | Next
Configure Alarming | Home | Description - "what to do"