RE: {bb} "unmatched" emails

["Kimberly McKinnis" <kmckinnis@macrovision.com>]

> Generally, the unmatched is for alerts/messages that have no
corresponding 
> entry in bb-hosts. Check the Big Brother name on the alert and make
sure 
> it exists in the bb-hosts file (spelling is most common mistake.)

I went so far as to paste the alerts into files and diff them. The only
thing different is the alert number and the timestamp. Maybe I'm
misunderstanding this. It looks like a regular alert but it's sent to
only my email. The only place my email exists in any BB rules is for
unmatched results. 

> Check for a bbaliasname on the host (are you using them) and that it
has 
> the correct spelling.

Nope. 

> Are you using a group-only in bb-hosts?

Nope.

> Are you using fully-qualified domain names (FQDN)?

Yes, always.

> Finally, check the machine where the alert is coming from to see 
> if the hostname is hard-coded in the script (you didn't say what the
test 
> was) and spelled correctly.

No. I use variables. The test wgets a webpage and checks for an "ok" or
"error" inserted into the title. It's essentially the 3dmd shell script
from Deadcat, only I changed the search strings. 

Thanks again.

~Kim



--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=
To unsubscribe from this list, or to subscribe to the bb-digest list
send e-mail to mailto:majordomo@bb4.com with unsubscribe bb -and/or-
subscribe bb-digest in the BODY of the message.