Random emails

[JohnFLi]

In attemping to figure out how to be able to acknowledge alerts via email, I created a mailbox on my exchange server for nagios.

Since then, I have been watching the mailbox so I can see if the acknowledgement get to the mailbox (it does)

but the odd thing is, I am also seeing many NDRs.

Code: Select all

Delivery has failed to these recipients or groups:
$@mycompany.com
The e-mail address you entered couldn't be found. Please check the recipient's e-mail address and try to resend the message. If the problem continues, please contact your helpdesk.

I check the "Notification" link and it does not show that any notification were sent out. Why would Nagios be sending random emails? The emails that it is sending is reporting that hosts or either up, or down and the hosts it is reporting on is random.

[sreinhardt]

Do you have a contact with an invalid email address that might be causing this? Could you show an example of one of the emails? Also when these emails are being sent, is the host or service at that time actually down or recovering as the email states?

[JohnFLi]

Nope, the host machines are fine. All contacts have valid emails address's

the NDR that is returned says: (yes, that dollar sign $ is what it really shows in the NDR)
my Nagios server = g1vpnag01
my Exchange server = G1VPEXC02

Delivery has failed to these recipients or groups:

$@mycomapany.com
The e-mail address you entered couldn't be found. Please check the recipient's e-mail address and try to resend the message. If the problem continues, please contact your helpdesk.








Diagnostic information for administrators:

Generating server: G1VPEXC02.mycompany.local

$@mycomapany.com
#550 5.1.1 RESOLVER.ADR.RecipNotFound; not found ##rfc822;$

Original message headers:

Received: from g1vpnag01.mycompany.local (10.100.1.227) by
G1VPEXC02.mycompany.local (10.100.1.107) with Microsoft SMTP Server id
14.2.347.0; Fri, 25 Jul 2014 08:59:50 -0700
Received: by g1vpnag01.mycompany.local (Postfix, from userid 501) id
1DBC914195E; Fri, 25 Jul 2014 08:59:50 -0700 (PDT)
Date: Fri, 25 Jul 2014 08:59:50 -0700
To: <$@mycomapany.com>
Subject: ** Host Alert: G1POSTAGE01 is UP **
User-Agent: Heirloom mailx 12.4 7/29/08
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-ID: <20140725155950.1DBC914195E@g1vpnag01.mycompany.local>
From: <nagios@mycomapany.com>
Return-Path: nagios@mycomapany.com

[Box293]

Is there anything useful being logged?

Code: Select all

tail /var/log/messages

What command is being used by your contacts? Here is the one used by generic-contact template.

Code: Select all

host_notification_commands	notify-host-by-email    ; send host notifications via email

Code: Select all

# 'notify-host-by-email' command definition 
define command{
	command_name notify-host-by-email
	command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /usr/local/bin/sendEmail -s $USER7$ -xu $USER9$ -xp '$USER10$' -t $CONTACTEMAIL$ -f $USER5$ -l /var/log/sendEmail -u "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" -m "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" 
	}

Also, if you are able to reproduce the problem, it might be helpful to turn on debugging and catch what is happening in the debug log.
In nagios.cfg set:

Code: Select all

debug_level=-1

The debug file should be:

Code: Select all

debug_file=/usr/local/nagios/var/nagios.debug

[JohnFLi]

Code: Select all

/usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n\nName:$NOTIFICATIONAUTHOR$\nNote:$NOTIFICATIONCOMMENT$" | /bin/mail -s "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" $CONTACTEMAIL$

/usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$\n\nName:$NOTIFICATIONAUTHOR$\nNote:$NOTIFICATIONCOMMENT$" | /bin/mail -s "** $NOTIFICATIONTYPE$ Service Alert: $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" $CONTACTEMAIL$

From the mail log

Code: Select all

Jul 28 07:39:51 g1vpnag01 postfix/pickup[23545]: 4144C14195E: uid=501 from=<nagios>
Jul 28 07:39:51 g1vpnag01 postfix/cleanup[12158]: 4144C14195E: message-id=<20140728143951.4144C14195E@g1vpnag01.mycompany.local>
Jul 28 07:39:51 g1vpnag01 postfix/qmgr[7732]: 4144C14195E: from=<nagios@mycompany.com>, size=696, nrcpt=1 (queue active)
Jul 28 07:39:51 g1vpnag01 postfix/smtp[12160]: 4144C14195E: to=<$@mycompany.com>, orig_to=<$>, relay=10.100.9.19[10.100.9.19]:25, delay=0.73, delays=0.02/0/0.01/0.7, dsn=2.6.0, status=sent (250 2.6.0 <20140728143951.4144C14195E@g1vpnag01.mycompany.local> [InternalId=7757010] Queued mail for delivery)
Jul 28 07:39:51 g1vpnag01 postfix/qmgr[7732]: 4144C14195E: removed

[sreinhardt]

Interesting, let's check few places in the flat files:

grep -Ri '\$' /usr/local/nagios/etc/ <- probably will come up with a lot of results.
grep -Ri '\$\@' /usr/local/nagios/etc/
grep -Ri '\@companyname.com' /usr/local/nagios/etc/ <- obviously change companyname. This is to see if there are any empty addresses.

If both of those comeback clean we will need to look at user settings opposed to contact settings.

[JohnFLi]

the bottom line came back with nothing.

As for user settings on the Linux box (CentOS) there is only my account and the Nagios account.

[sreinhardt]

I keep writing users, thinking this is the XI forum, my mistake. If the second one came back with a result, you should absolutely look into that one, as it is likely the culprit. Otherwise if you want to PM one of us the contacts.cfg we can certainly take a look. Being as this is core only, and no XI users to worry about, the only place contact definitions should be is in contacts.cfg unless you chose to make a second file to hold contacts.

[JohnFLi]

oops, I'm sorry, the last two lines came back with no results.

[Box293]

Can you post the results of:

Code: Select all

grep -Ri '\@' /usr/local/nagios/etc/