Use status Warning on RMA: Connection error

[Kapz]

Hi !

Running HM 6.82 on Win2003:

I am working with a test, where HM asks an agent running at a name server called NS4 to perform a check:

Method = DNS
;--- Common properties ---
;DestFolder = Root\DC Produktion\NS4\DNS Checks\
RMAgent = NS4
Title = ns.dk.net resolve ns4.anet.dk
Comment =
RelatedURL =
ScheduleMode= Regular
Schedule = Mo-Su 0000-2359
Interval = 60
Alerts = Send SMS Mo-Su 0000-2359
ReverseAlert= No
UnknownIsBad= Yes
WarningIsBad= No
UseWarning = Yes
WarningExpr = ('%SuggestedSimpleStatus%'=='DOWN') and ('%SuggestedReply%'=='RMA: Cannot read data')
UseCommonLog= Yes
PrivLogMode = Default
CommLogMode = Default
SyncCounters= Yes
SyncAlerts = No
DependsOn = list
MasterTest-Alive = NS4 Port 3456 (RMA)
;--- Test specific properties ---
Server = ns.dk.net
Port = 53
Timeout = 60
Protocol = UDP
Hostname = ns4.anet.dk
CheckResult = 80.198.71.24
QueryType = A

The test itself works fine, however from time to time I receive alerts that the test has status "Down" and the reply is "RMA: Connection error". Usually within the next minute I receive an Up alert.

Now I'm trying to tell HM to use Warning status on this condition but so far with no luck. As you can see from the test properties I'm using the string

('%SuggestedSimpleStatus%'=='DOWN') and ('%SuggestedReply%'=='RMA: Cannot read data')

- but if I shut down the agent on the name server to force the test to fail it doesn't get status "Warning" so probably I'm not using the right expression. Could you assist me on this one ?

Thanks in advance !

Kasper

[KS-Soft Europe]

('%SuggestedSimpleStatus%'=='DOWN') and ('%SuggestedReply%'=='RMA: Cannot read data')

You should use the following expression: ('%SuggestedSimpleStatus%'=='UNKNOWN') and ('%SuggestedReply%'=='RMA: Cannot read data')

In fact, HostMonitor sets the different "Reply" for different situation. It's hard to count them all: "RMA: Cannot read data", "RMA: Connection error", etc. For instance, when you shutdown the agent to force the test to fail, it will not show you the "Warning" status because "Reply" will be "RMA: Connection error". So, probably it is not much sense to check the %SuggestedReply% variable.
Hovewer, if you want to set the "Warning" status when the "Reply" is "RMA: Cannot read data", you may use foregoing variable as well.

Regards,
Max

[Kapz]

Max,

Thanks for your reply and for the clarification.

However, I have tested your expression with various RMA connection error strings but still without any luck. In fact, even if I cut down the expression to ('%SuggestedSimpleStatus%'=='UNKNOWN') it still doesn't work - status changes to Unknown when the agent is shut down.

Any ideas ?

Regards

Kasper

[KS-Soft Europe]

However, I have tested your expression with various RMA connection error strings but still without any luck. In fact, even if I cut down the expression to ('%SuggestedSimpleStatus%'=='UNKNOWN') it still doesn't work - status changes to Unknown when the agent is shut down.

Expression only works when "Treat Unknown status as Bad" option is disabled.

Regards,
Max

[KS-Soft]

Version 7.00 will support new operator 'in', you will be able to use expression like ('%SuggestedSimpleStatus%'=='DOWN') and ('RMA:' in '%SuggestedReply%')

Regards
Alex

[Kapz]

Alex,

I've now had the time to test the 'in' operator that you mentioned in the example ('RMA:' in '%SuggestedReply%')

Using the example with a colon in it doesn't seem to work but if I remove the colon making the string look like this ...

('RMA' in '%SuggestedReply%')

... it seems to work (having tested it for a week now).

Could there be something with colon and perhaps other characters as well ?

My aim is in general to avoid having alerts send "just" because of connection error to the agent (usually beacuse they are temporary anyway), but before I start applying a string like the one mentioned to all of my tests I'd like make just a little sure that it ctually covers my needs.
So my question is if there are any scenarios where the letters 'RMA' will not be a part of an RMA connection error message ?

Thanks !

Kasper

[KS-Soft]

My aim is in general to avoid having alerts send "just" because of connection error to the agent

Then you don't need any expressions. Simply unmark "Treat Unknown status as Bad" option.

I've now had the time to test the 'in' operator that you mentioned in the example ('RMA:' in '%SuggestedReply%'). Using the example with a colon in it doesn't seem to work

As I see it works just fine. What version of HostMonitor do you use?

Regards
Alex

[Kapz]

Alex,

> Then you don't need any expressions. Simply unmark "Treat Unknown status as Bad" option.
We used to not have this checked but from time to time we missed alarms because for certain tests Unknown actually ment Bad.
I don't recall the exact circumstances but I recall angry customers
After the option was marked we started catching such alarms.

> As I see it works just fine. What version of HostMonitor do you use?
We're running 7.52 on Win2003SP1 - if it works at your end I'll try with colons again tomorrow and see if I can reproduce it.

Meanwhile I could ask if all possible errors related to the connection to an agent start with 'RMA:' ?

Thank you so far !

Kasper

[KS-Soft]

Its hard to list all possible messages. There could be various winsock and WinAPI errors...
Theoretically HostMonitor may set the following error descriptions:
RMA: Protocol is not supported
RMA: Bind Error
RMA: Winsock error
RMA: Connection error
RMA: Cannot read data
RMA: Cannot send data
RMA: Cannot create socket
RMA: Cannot resolve host name to IP address
RMA: Cannot init WinSock
RMA: Timeout
RMA: Invalid reply
plus various WinAPI errors

BTW I have never seen all these errors. Just 3 of them "RMA: Connection error", "RMA: Cannot read data", "RMA: Cannot resolve host name to IP address".
"RMA: Invalid reply" may appear when you mistmatch software components (using components from different versions).

Regards
Alex

[Kapz]

Alex,

Thanks for the list.
It seems like if I manage to get ('RMA:' in '%SuggestedReply%') to work (which I havn't had the time to test today) I should be pretty much home free

/Kasper