excludeMonitors still sends alert

[andrewmgee]

Describe the bug
Alerts still get sent out (slack in our case) on a prefix for monitors that are set to be excluded.

Provide an example
config.yml

monitors:
  - file: monitorRPKI
    channel: rpki
    name: rpki-monitor
    params:
      thresholdMinPeers: 1
      checkUncovered: true

  - file: monitorROAS
    channel: rpki
    name: roas-monitor

prefixes.yml

111.222.333.0/24:
  description: myprefix
  asn:
    - 394256
  ignoreMorespecifics: false
  ignore: false
  excludeMonitors:
    - rpki-monitor
    - roas-monitor

Slack alert

rpki
The route 111.222.333.0/24 announced by AS394256 is not covered by a ROA. Top 1 most used AS paths: [redacted].

Expected behavior
No alert to be sent for prefixes that have excludeMonitors set. So no rpki/ROA alerts for prefixes with "rpki-monitor" set.

Are you using the binary or the source code?
Binary - 1.27.0

Thanks
Andrew
Tech Futures / AS394256

[massimocandela]

Hi @andrewmgee,

Thanks for reporting this. The only way I was able to reproduce this is if there is the option to monitor the AS in addition to the prefix. Could you confirm that you have in prefixes.yml something like:

options:
  monitorASns:
    '394256':
      group: noc

In that case, the alert is sent (despite the excludeMonitors set in prefixes.yml) because it gets matched by AS and not by prefix.
I can push a fix for monitorRPKI (not for monitorROAS) if you confirm me what described above.

Happy new year!

[andrewmgee]

Hey @massimocandela

Yes, I do have the below in the prefixes.yml:

options:
  monitorASns:
    '394256':
      group: default

Fix for monitorRPKI would be much appreciated.

Thanks!

Happy new year!

[massimocandela]

This is fixed, currently in release branch. It will go out with v1.27.1
Thanks again for reporting.