How does one remove the “got worse” text from the subject field for email alerts
That part is not configurable. So, you need someone to update the templates to allow that to be specified.
Does it make a difference that I’m using syslog messages as the source of the alerts.
I’m sending alerts based on OSPF syslog messages.
Facing the same issue, and yes alerting based on syslog.
Basically the rule checks all the syslog messages and generates the alert unless you specify a cut off timestamp.
If you add syslog.timestamp gt or eq macros.past_5m then you should be good.
This behavior is very unfriendly since most of us just want sent out one DOWN alert for a specific syslog message and one UP alert for a specific syslog message.
Libre keeps checking all the syslog messages in a loop.
I think what the system is missing is that if when see a syslog message:
- Go over all the rules and if it didn’t match mark it as “done”.
- If a rule matched, apply the rule and mark it as “done”.
“Done” syslogs should not be repeated against the same rules.