/etc/prelude-lml/ruleset/cacti-thold.rules is in prelude-lml-rules 4.1.0-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 | #FULLNAME: Cacti Thold
#VERSION: 1.0
#DESCRIPTION: Cacti is a web-based network monitoring and graphing tool designed as a front-end application for the data logging tool RRDtool. The Thold plugin is for the alerting of data found within any graph within Cacti. The rules included here were developed using thold 0.3.0. The rules assume you haven't modified the default format for graph names significantly...some modification is acceptable, but the default location for hostname has been used to gather that info.
#####
#
# Copyright (C) 2006 G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####
#DESCRIPTION:Service threshold CRITICAL
#CATEGORY:Monitoring
#LOG:Oct 2 05:26:15 smf-syslog-02 172/172 CactiTholdLog[19647]: smf-core-02 - 5 Minute CPU went above threshold of 85 with 90.8067 at trigger 1 out of 1
regex=(\S+) - (.+) went above threshold of ([\d\.]+) with ([\d\.]+) at trigger; \
classification.text=Service CRITICAL; \
id=4500; \
revision=1; \
analyzer(0).name=Cacti thold; \
analyzer(0).manufacturer=www.cactiusers.org; \
analyzer(0).class=State Monitoring; \
assessment.impact.severity=medium; \
assessment.impact.type=dos; \
assessment.impact.description=Service $2 on $1 has exceeded a pre-defined threshold; \
target(0).node.name=$1; \
additional_data(0).type=string; \
additional_data(0).meaning=Service name; \
additional_data(0).data=$2; \
additional_data(1).type=string; \
additional_data(1).meaning=Threshold; \
additional_data(1).data=$3; \
additional_data(2).type=string; \
additional_data(2).meaning=Current value; \
additional_data(2).data=$4; \
last
#DESCRIPTION:Service OK
#CATEGORY:Monitoring
#LOG:Oct 2 05:30:46 smf-syslog-02 172/172 CactiTholdLog[25849]: smf-core-02 - 5 Minute CPU restored to normal with 68.1533 at trigger 1 out of 1
regex=(\S+) - (.+) restored to normal with ([\d\.]+) at trigger; \
classification.text=Service OK; \
id=4501; \
revision=1; \
analyzer(0).name=Cacti thold; \
analyzer(0).manufacturer=www.cactiusers.org; \
analyzer(0).class=State Monitoring; \
assessment.impact.severity=medium; \
assessment.impact.type=dos; \
assessment.impact.description=Service $2 on $1 has returned to normal; \
target(0).node.name=$1; \
additional_data(0).type=string; \
additional_data(0).meaning=Service name; \
additional_data(0).data=$2; \
additional_data(1).type=string; \
additional_data(1).meaning=Current value; \
additional_data(1).data=$3; \
last
|