More specific exemptions
Posted: 02 Oct 2017, 15:41
I would like to exempt alerting for our own activity in SSH - we keep a window open all day for quick access.
This results in wasteful emails all day
We don't want to exempt our user or IP address from all alerts, nor do we want to exempt all SSH alerts.
The best we can do now is have our mailbox filter on the subject line
Excessive resource usage: XXXXX .* Parent PID: 19420
But we have to update this as the PID changes. Having bash in the subject would be better, but we'd prefer they just not be sent at all.
This results in wasteful emails all day
Code: Select all
Subject: lfd on XXXXXX: Excessive resource usage: XXXXX (19422 (Parent PID:19420))
Time: Mon Oct 2 07:00:11 2017 -0400
Account: XXXXX
Resource: Process Time
Exceeded: 407508 > 1800 (seconds)
Executable: /usr/bin/bash
Command Line: -bashThe best we can do now is have our mailbox filter on the subject line
Excessive resource usage: XXXXX .* Parent PID: 19420
But we have to update this as the PID changes. Having bash in the subject would be better, but we'd prefer they just not be sent at all.