-
Type:
Incident report
-
Resolution: Won't fix
-
Priority:
Major
-
None
-
Affects Version/s: 1.8.8
-
Component/s: None
-
None
Item key: log[/var/log/messages]
Trigger expression:
{hostname:log[/var/log/messages].str(error)}=1
Event generation: Normal + Multiple PROBLEM event
Action escalation: enable
Action escalation period: 60
Action condition: default
Action operation: Infinity send email to Admin
In this case (Multiple PROBLEM event + escalation enable), if multiple error line is output to /var/log/message, prevoius escalation is deleted every PROBLEM event. (it looks escalation step is reset for user.)
- output log
--------------
error A
error B
error C
-------------
- status of escalation table
- error A
-----------------------------------------------------------------------+
| escalationid | actionid | triggerid | eventid | r_eventid | nextcheck | esc_step | status |
-----------------------------------------------------------------------+
| 106 | 4 | 13047 | 3864 | 0 | 1320650061 | 1 | 0 |
-----------------------------------------------------------------------+
- 60 sec after
-----------------------------------------------------------------------+
| escalationid | actionid | triggerid | eventid | r_eventid | nextcheck | esc_step | status |
-----------------------------------------------------------------------+
| 106 | 4 | 13047 | 3864 | 0 | 1320650122 | 2 | 0 |
-----------------------------------------------------------------------+
- error B
-----------------------------------------------------------------------+
| escalationid | actionid | triggerid | eventid | r_eventid | nextcheck | esc_step | status |
-----------------------------------------------------------------------+
| 107 | 4 | 13047 | 3867 | 0 | 1320650322 | 1 | 0 |
-----------------------------------------------------------------------+
- 60 sec after
-----------------------------------------------------------------------+
| escalationid | actionid | triggerid | eventid | r_eventid | nextcheck | esc_step | status |
-----------------------------------------------------------------------+
| 107 | 4 | 13047 | 3867 | 0 | 1320650382 | 2 | 0 |
-----------------------------------------------------------------------+
- error C
-----------------------------------------------------------------------+
| escalationid | actionid | triggerid | eventid | r_eventid | nextcheck | esc_step | status |
-----------------------------------------------------------------------+
| 108 | 4 | 13047 | 3874 | 0 | 1320650400 | 1 | 0 |
-----------------------------------------------------------------------+