Note: This file is only used on the Hobbit server - it is not used by the Hobbit client, so there is no need to distribute it to your client systems.
LOAD warnlevel paniclevel
If the system load exceeds "warnlevel" or "paniclevel", the "cpu" status will go yellow or red, respectively. These are decimal numbers.
Defaults: warnlevel=5.0, paniclevel=10.0
UP bootlimit toolonglimit
The cpu status goes yellow if the system has been up for less than "bootlimit" time, or longer than "toolonglimit". The time is in minutes, or you can add h/d/w for hours/days/weeks - eg. "2h" for two hours, or "4w" for 4 weeks.
Defaults: bootlimit=1h, toolonglimit=-1 (infinite).
Example: Go yellow if the load average exceeds 5, and red if it exceeds 10. Also, go yellow for 10 minutes after a reboot, and after 4 weeks uptime.
LOAD 5 10 UP 10m 4w
DISK filesystem warnlevel paniclevel
If the utilization of "filesystem" is reported to exceed "warnlevel" or "paniclevel", the "disk" status will go yellow or red, respectively. "warnlevel" and "paniclevel" are the percentage filled. "filesystem" is the mount-point where the filesystem is mounted, e.g. "/usr" or "/home". A filesystem-name that begins with "%" is interpreted as a Perl-compatible regular expression; e.g. "%^/oracle.*/" will match any filesystem whose mountpoint begins with "/oracle".
Defaults: warnlevel=90, paniclevel=95
MEMPHYS warnlevel paniclevel
MEMACT warnlevel paniclevel
MEMSWAP warnlevel paniclevel
If the memory utilization exceeds the "warnlevel" or "paniclevel", the "memory" status will change to yellow or red, respectively. Note: The words "PHYS", "ACT" and "SWAP" are also recognized.
Example: Go yellow if more than 20% swap is used, and red if more than 40% swap is used or the actual memory utilisation exceeds 90%. Dont alert on physical memory usage.
MEMSWAP 20 40 MEMACT 90 90 MEMPHYS 101 101
Defaults:
MEMPHYS warnlevel=100 paniclevel=101 (i.e. it will never go red). MEMSWAP warnlevel=50 paniclevel=80 MEMACT warnlevel=90 paniclevel=97
PROC processname minimumcount maximumcount color
The "ps" listing sent by the client will be scanned for how many processes containing "processname" are running, and this is then matched against the min/max settings defined here. If the running count is outside the thresholds, the color of the "procs" status changes to "color".
To check for a process that must NOT be running: Set minimum and maximum to 0.
"processname" can be a simple string, in which case this string must show up in the "ps" listing as a command. The scanner will find a ps-listing of e.g. "/usr/sbin/cron" if you only specify "processname" as "cron". "processname" can also be a Perl-compatiable regular expression, e.g. "%java.*inst[0123]" can be used to find entries in the ps-listing for "java -Xmx512m inst2" and "java -Xmx256 inst3". In that case, "processname" must begin with "%" followed by the reg.expression. If "processname" contains whitespace (blanks or TAB), you must enclose the full string in double quotes - including the "%" if you use regular expression matching. E.g.
PROC "%hobbitd_channel --channel=data.*hobbitd_rrd" 1 1 yellow
or
PROC "java -DCLASSPATH=/opt/java/lib" 2 5
You can have multiple "PROC" entries for the same host, all of the checks are merged into the "procs" status and the most severe check defines the color of the status.
Example: Check that "cron" is running:
PROC cron
Example: Check that at least 5 "httpd" processes are running, but not more than 20:
PROC httpd 5 20
Defaults:
mincount=1, maxcount=-1 (unlimited), color="red".
Note that no processes are checked by default.
DEFAULT UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97
PAGE=targetstring Rule matching an alert by the name of the page in BB. "targetstring" is the path of the page as defined in the bb-hosts file. E.g. if you have this setup:
page servers All Servers subpage web Webservers 10.0.0.1 www1.foo.com subpage db Database servers 10.0.0.2 db1.foo.com
Then the "All servers" page is found with PAGE=servers, the "Webservers" page is PAGE=servers/web and the "Database servers" page is PAGE=servers/db. Note that you can also use regular expressions to specify the page name, e.g. PAGE=%.*/db would find the "Database servers" page regardless of where this page was placed in the hierarchy.
The top-level page has a the fixed name /, e.g. PAGE=/ would match all hosts on the Hobbit frontpage. If you need it in a regular expression, use PAGE=%^/ to avoid matching the forward-slash present in subpage-names.
EXPAGE=targetstring Rule excluding an alert if the pagename matches.
HOST=targetstring Rule matching an alert by the hostname. "targetstring" is either a comma-separated list of hostnames (from the bb-hosts file), "*" to indicate "all hosts", or a Perl-compatible regular expression. E.g. "HOST=dns.foo.com,www.foo.com" identifies two specific hosts; "HOST=%www.*.foo.com EXHOST=www-test.foo.com" matches all hosts with a name beginning with "www", except the "www-test" host.
EXHOST=targetstring Rule excluding an alert by matching the hostname.
TIME=timespecification Rule matching an alert by the time-of-day. This is specified as the DOWNTIME time specification in the bb-hosts file. E.g. "TIME=W:0800:2200" applied to a rule will make this rule active only on week-days between 8AM and 10PM.
LOAD 8.0 12.0 HOST=db.foo.com TIME=*:0800:1600
If you have multiple settings that you want to apply the same rules to, you can write the rules *only* on one line, followed by the settings. E.g.
HOST=%db.*.foo.com TIME=W:0800:1600 LOAD 8.0 12.0 DISK /db 98 100 PROC mysqld 1
will apply the three settings to all of the "db" hosts on week-days between 8AM and 4PM. This can be combined with per-settings rule, in which case the per-settings rule overrides the general rule; e.g.
HOST=%.*.foo.com LOAD 7.0 12.0 HOST=bax.foo.com LOAD 3.0 8.0
will result in the load-limits being 7.0/12.0 for the "bax.foo.com" host, and 3.0/8.0 for all other foo.com hosts.
The entire file is evaluated from the top to bottom, and the first match found is used. So you should put the specific settings first, and the generic ones last.