I would like to configure notifications so that alerts triggered by the rule “Network interfaces and switch ports” are excluded when they cause an interface service to become WARN or CRIT (because Predicting Monitoring).
However, it seems that I can only exclude notifications for the entire Interface service. If I do that, I also stop receiving notifications when the interface itself goes up or down, which I still want to be notified about.
Is it possible to exclude notifications generated by a specific rule for a service, while still keeping notifications enabled for the service itself and its state changes?
Your Network interfaces and switch ports rules influence the notifications being sent.
Rule 0, ignore speed, will make sure no notifications are sent regarding speed.
Rule 1, predictive, will make notifications when certain conditions match.
Unless I don’t understand what you’re trying to achieve, no separate notification rule is needed. At most a change or addition of a Network interfaces and switch ports rule to include/exclude certain conditions.
Regarding your notification rule, Exclude services will take Interface as a regex pattern. Any service name starting with Interface will be matched.
Actually, please ignore the Network Interfaces and Switch Ports rules for this case. As you can see, I have defined several rules that can cause the Interface service to enter a WARN or CRIT state. However, I do not want to receive email notifications when the Interface service becomes WARN or CRIT as a result of those specific rules.
On the other hand, if the Interface service becomes CRIT for a different reason, such as the interface going offline, then I do want to receive an email notification.
That is why I’m asking whether it is possible to exclude specific rules (for example, the Network Interfaces and Switch Ports rules) from the notification logic while still allowing notifications for other Interface service issues.
If I exclude the entire Interface service from notifications (like in the image), then I would not receive any notifications for that service at all, including cases where the interface goes offline. That is the behavior I would like to avoid.
there is no direct way of excluding the resulting state by the rule that created it, but you can filter notifications by the plugin output.
Hence you could create discard notification rules for the Interface service output (maybe for all of it, as that might be easier then to list the different outputs that you want to ignroe) and then create another rule that specifically only matches DOWN events for interfaces and creates a notification.
Not the most beautiful thing, but maybe that works for you.
I’m not a huge fan of very specific notification rules, so I would probably question wether using the “WARN” state for all sorts of thresholds suffices and then set the CRIT threshold so that it is practically impossible for the Interface service to go CRIT unless it is DOWN.
