The most simple form of a pattern is a host.check pattern.
foo.cpu mail=nobody |
(where foo.cpu is the pattern and mail=nobody is the description) for instance matches only status changes for the host foo and the cpu check. The above rule tells Big Sister to forward alarms for foo.cpu to the user nobody.
*.cpu mail=nobody |
Now let's assume you do not want to list each individual system and check in the rule file. The Alarm Generator accepts one single wildcard - * - matching any check or any host
foo.* mail=nobody |
And for matching any status change for any host.
*.* mail=nobody |
Of course you may want to address a group of hosts - haven't you spent hours setting up groups after reading section 2.2.3? Exactly these groups are also visible to the alarm generator.
By prefixing a host name with a '@' character you point Big Sister to match a group rather than a single host so that a rule like
@USA.* mail=nobody |
for instance applies to any status change reported for any system being member of the group USA.
So far so good. Sometimes it is very useful to be able to make alarming behave different depending on when a status change is detected - maybe you just refuse to be woken up by your beeper during the night or you want get alarms via another medium during working hours.
For this purpose the patterns can contain so-called pre-conditions. In the rule
@USA.*{weekday Sat,Sun} mail=pikett |
the stuff in parenthesis is a pre-condition. The rule will only match status changes for any system being member of the group USA reported during the weekend. An- other useful precondition is the daytime condition. This rule
*.*{daytime 17:00-07:00} down=never |
for instance will suppress (down=never) any status change reported between 5pm and 7am. Of course conditions can be combined using and and or, so
*.*{daytime 17:00-07:00 or weekday Sat,Sun} \ down=never |
will suppress any status change reported between 5pm and 7am or during week-end.