Blank lines and lines starting with a hash mark (#) are treated as comments and ignored. Long lines can be broken up by putting a backslash at the end of the line and continuing the entry on the next line.
PAGE=targetstring Rule matching an alert by the name of the page in BB. This is the path of the page as defined in the bb-hosts file. E.g. if you have this setup:
page servers All Servers subpage web Webservers 10.0.0.1 www1.foo.com subpage db Database servers 10.0.0.2 db1.foo.com
Then the "All servers" page is found with PAGE=servers, the "Webservers" page is PAGE=servers/web and the "Database servers" page is PAGE=servers/db. Note that you can also use regular expressions to specify the page name, e.g. PAGE=%.*/db would find the "Database servers" page regardless of where this page was placed in the hierarchy.
The top-level page has a the fixed name /, e.g. PAGE=/ would match all hosts on the Hobbit frontpage. If you need it in a regular expression, use PAGE=%^/ to avoid matching the forward-slash present in subpage-names.
EXPAGE=targetstring Rule excluding an alert if the pagename matches.
HOST=targetstring Rule matching an alert by the hostname.
EXHOST=targetstring Rule excluding an alert by matching the hostname.
SERVICE=targetstring Rule matching an alert by the service name.
EXSERVICE=targetstring Rule excluding an alert by matching the service name.
COLOR=color[,color] Rule matching an alert by color. Can be "red", "yellow", or "purple". The forms "!red", "!yellow" and "!purple" can also be used to NOT send an alert if the color is the specified one.
TIME=timespecification Rule matching an alert by the time-of-day. This is specified as the DOWNTIME timespecification in the bb-hosts file.
DURATION>time, DURATION<time Rule matcing an alert if the event has lasted longer/shorter than the given duration. E.g. DURATION>1h (lasted longer than 1 hour) or DURATION<30 (only sends alerts the first 30 minutes). The duration is specified as a number, optionally followed by 'm' (minutes, default), 'h' (hours) or 'd' (days).
RECOVERED Rule matches if the alert has recovered from an alert state.
NOTICE Rule matches if the message is a "notify" message. This type of message is sent when a host or test is disabled or enabled.
The "targetstring" is either a simple pagename, hostname or servicename, OR a '%' followed by a Perl-compatible regular expression. E.g. "HOST=%www(.*)" will match any hostname that begins with "www".
MAIL address[,address] Recipient who receives an e-mail alert. This takes one parameter, the e-mail address.
SCRIPT /path/to/script recipientID Recipient that invokes a script. This takes two parameters: The script filename, and the recipient that gets passed to the script.
FORMAT=formatstring Format of the text message with the alert. Default is "TEXT" (suitable for e-mail alerts). "PLAIN" is the same as text, but without the URL link to the status webpage. "SMS" is a short message with no subject for SMS alerts. "SCRIPT" is a brief message template for scripts.
REPEAT=time How often an alert gets repeated. As with DURATION, time is a number optionally followed by 'm', 'h' or 'd'.
UNMATCHED The alert is sent to this recipient ONLY if no other recipients received an alert for this event.
STOP Stop looking for more recipients after this one matches.
Rules You can specify rules for a recipient also. This limits the alerts sent to this particular recipient.
$MYMACRO=text extending to end of line
After the definition of a macro, it can be used throughout the file. Wherever the text $MYMACRO appears, it will be substituted with the text of the macro before any processing of rules and recipients.
It is possible to nest macros, as long as the macro is defined before it is used.
BBALPHAMSG The full text of the status log triggering the alert
ACKCODE The "cookie" that can be used to acknowledge the alert
RCPT The recipientID from the SCRIPT entry
BBHOSTNAME The name of the host that the alert is about
MACHIP The IP-address of the host that has a problem
BBSVCNAME The name of the service that the alert is about
BBSVCNUM The numeric code for the service. From the SVCCODES definition.
BBHOSTSVC HOSTNAME.SERVICE that the alert is about.
BBHOSTSVCCOMMAS As BBHOSTSVC, but dots in the hostname replaced with commas
BBNUMERIC A 22-digit number made by BBSVCNUM, MACHIP and ACKCODE.
RECOVERED Is "1" if the service has recovered.
SECS Number of seconds the service has been down.
DOWNSECSMSG When recovered, holds the text "Event duration : N" where N is the DOWNSECS value.
CFID Line-number in the hobbit-alerts.cfg file that caused the script to be invoked. Can be useful when troubleshooting alert configuration rules.