Blacklist-Rules
You can specify here whether certain messages received via the Icinga services informix-checkalert or informix-alarmprg are sent by mail. Without these rules all alarmprg mails will be sent which are not explicitly disabled via the class/uniqid in the 'alarm settings' of the connection. With checkalert all messages are sent which have a higher alarm type than INFO. Here, only the messages coming from the cas_mon_performance sensor can be switched off.
All defined rules are listed in the table above the mask. A click on a record enters the data of the rule into the form and starts the editing mode. This can be recognized by the label of the left button. If a new rule is to be entered, the entry is started by clicking on 'New'. All fields will be cleared.
Rules can be captured for messages retrieved from the sysadmin:ph_alert (infomix-checkalert) (on = 'Alarm') or for messages resulting from an alarm program run (on = 'Event'). For messages that are triggered by an event in evidence.sh, no rule can be entered. In this case an alarm is always sent by mail.
Generally, a rule can only prevent the message from being sent. The message remains visible in the appropriate places.
When checking whether a rule applies, all fields defined for the type (above operator beetween keyword1/keyword2) are compared with those in the message. Only if all fields are the same or the rule is set to 'All', the check continues.
Subsequently, it is checked whether the keyword1 occurs in the message text. In case of an alarm there is only one text, in case of an event you can choose with the combo box in front of the keyword if it is checked in the message, in the additional text or both.
If a keyword2 is specified, the same applies to keyword2. The result is linked with the AND/OR operator.
If a search term is specified under 'Keyword must not contained', the notification is only prevented if this is not found.
Under 'Test Rules on Alarms' you can see how the rules would have affected the last 40 alarms and events. The list shows which rule would have been applied to a message.
The 1st rule that hits is always displayed.