Help required for expression

[alex.derbyshire]

Hi,
I’m not sure if this is possible but our business currently uses host monitor to monitor our client’s environments and have around 1000+ tests in situ. We host our monitoring server in our data centre, we see quite lot of anomalies for tests and have managed to resolve the bad test from alerting with the following expression; ('%SimpleStatus%'=="DOWN") and (%Recurrences%>5). The test will only alert us on the 5th bad down, this works well now and we don’t the usual bad alert notification. The problem I now have is that if a test goes bad for 2 attempts the good alert will send a notification alerting us that the test is good as I have the good test set to alert on the first detection of a good status. I’m sure there is a way to use an expression where the alert would only send on a detection of good after a bad alert has been sent, this would then ensure that any anomalies aren't seen as good statuses. Sorry if the above is confusing as it’s a tricky one to write down! Anybody have any ideas? I'm using v9.40

[KS-Soft Europe]

Solution is pretty simple:
1. You do not need to use expression for the action (advanced mode).
Standard mode allows you to start alert after 5th Bad recurrence:
Condition to start action: standard mode
"Start when 5 consecutive "Bad" results occur"
2. Enable "Action depends on "bad" one" option for Good action.

Quote from Manual:
=========================
Action depends on "bad" one
This optional parameter is available for "Good" actions only. You can set "Good" action dependable on a "Bad" action. Why do you need it? For example you defined "Bad" action to send an e-mail notification to the network administrator when test fails 3 times consecutively (start when 3 consecutive "Bad" results occur), also you defined «Good» action to send a notification when the test status changes to "Good". What will happen if test fails 1 or 2 times and after this it restores "Good" status? HostMonitor will not send a notification about failure (because test did not fail 3 times) but the program will send notification about restoring "Good" status. To avoid unnecessary "Good" action execution you can mark "Action depends on "bad" one" option and select "Bad" action. In this case HostMonitor will start "Good" action only if corresponding "Bad" action was executed.
=========================

Please check for details at:
http://www.ks-soft.net/hostmon.eng/mframe.htm#actions.htm#StartWhen
http://www.ks-soft.net/hostmon.eng/mframe.htm#actions.htm#DependsOnBad

[alex.derbyshire]

Thanks for the reply, that would be a good way to do it. However, we use an advanced expression for the bad detection as follows;

('%SimpleStatus%'=="DOWN" OR "UNKNOWN") and (((%Recurrences%>3) and (%Recurrences%<11)) or ((%Recurrences%<60) and ((%Recurrences% mod 10)==0)) or ((%Recurrences% mod 60)==0))

The above expression means that the bad alert will send every test for the first hour and then after that hour it will only send once an hour to save our inboxes from being spammed by the alert. If i switch to standard test i will lose this functionality, is there another way? I've been looking into using the following expression for the good expression;

("%Status%"=="Ok") and (%PreviousStatusDuration_Sec%>300)

This doesn't appear to send though.

Thanks for your help

[KS-Soft Europe]

"Action depends on "bad" one" option does not work with advanced mode actions.

In such case you may use Advanced mode Good action.
Your expression will not work with different test methods (Good status can be Ok, Host is alive, Normal). It's better to use %SimpleStatus% instead.

You may try the following expression for Good action:
('%SimpleStatus%'=='UP') and (%Recurrences%==1) and (%PreviousStatusDuration_Sec%>300)

[alex.derbyshire]

That's worked a treat - thanks for your help

[KS-Soft Europe]

You are welcome.