Example:
Right now, if i want to push an Alert for an informational event (/etc/passwd was updated) for example. I need to have an action that specifically filters informational events, and doesn't have a recovery action.
Then for other alerts, i have a seperate action with recovery messages enabled.
It would be nice if i could have ONE action. And specify for severity average + above, assume i will need a recovery message. For severity Information, do not send recovery messages
Right now, if i want to push an Alert for an informational event (/etc/passwd was updated) for example. I need to have an action that specifically filters informational events, and doesn't have a recovery action.
Then for other alerts, i have a seperate action with recovery messages enabled.
It would be nice if i could have ONE action. And specify for severity average + above, assume i will need a recovery message. For severity Information, do not send recovery messages