mail alerts

[harinarne]

I configured mail alerts for both users and contacts.I am getting alerts .I set it for every one hour for both users and contacts. But for users getting alerts everyone hour but for contacts getting alerts every 3 hours.kindly suggest me.

Below is the config.

define contact {
contact_name genral
alias hari
host_notifications_enabled 1
service_notifications_enabled 1
host_notification_period 24x7
service_notification_period 24x7
host_notification_options d,u,r,f,s,
service_notification_options w,u,c,r,f,s,
email harinarne02@gmail.com
use generic-contact
}

define contact {
contact_name hari
alias Harichandra Narne
host_notifications_enabled 1
service_notifications_enabled 1
host_notification_period hari_notification_times
service_notification_period hari_notification_times
host_notification_options d,u,r,f,s
service_notification_options w,u,c,r,f,s
email xxxxxxxxxx
use xi_contact_generic
}

[tgriep]

The Email Notification Interval is set on the Host and Service objects and not the Contact object.
Go and check the Host or Services and verify that they are set to the Notification Interval you are expecting.

If they are set correctly, try restarting these processes to see if the running configurations are out of sync with the settings.
Run this as root

Code: Select all

service nagios stop
service nsdo2db stop
killall -9 nagios
service ndo2db start
service nagios start

Then see if the Email Notifications are sent when you want them to.

[harinarne]

contact.PNG

service.PNG

Sorry to mention that I set it for hosts and service only.

->service nagios stop
Stopping nagios: .done.

[root@nagios-2.15.26U6.LITF4]:678:/
{Fri Mar 15 13:59:07 MDT 2019}
->service nsdo2db stop
Redirecting to /bin/systemctl stop nsdo2db.service
Failed to stop nsdo2db.service: Unit nsdo2db.service not loaded.

[root@nagios-2.15.26U6.LITF4]:679:/
{Fri Mar 15 13:59:07 MDT 2019}
->killall -9 nagios
nagios: no process found

[root@nagios-2.15.26U6.LITF4]:680:/
{Fri Mar 15 13:59:07 MDT 2019}
->service nagios start
Starting nagios: done.


please find the below screen shots
we are using generic contact for contacts and xi_contact_genric for users.

[tgriep]

It seems that the ndo2db process was not running on the server and that caused the saved config to be out of sync with the running config.
That probably caused the issue.

I did not see that you started the ndo2db process in the server.
Can you run these commands as root to start it up and check the status of it?

Code: Select all

systemctl start ndo2db
systemctl status ndo2db

If the status says that is it not running, run this to remove the lock and the sock file and try starting it again.

Code: Select all

rm -f /usr/local/nagios/var/ndo.sock
rm -f /usr/local/nagios/var/ndo2db.lock
systemctl start ndo2db
systemctl status ndo2db

If it is running, then you will have to check and see if the notifications are sent when you want them to.

[harinarne]

status ndo2db is running. we are seeing the alerts for users continuously, and for the contacts, there is the delay is happening we observed that it alerts are triggering randomly.

below is the mail logs from Nagios server
->tail -f /var/log/maillog
Mar 19 07:00:20 nagios-2 postfix/pickup[442]: 2A87038003012: uid=0 from=<root>
Mar 19 07:00:20 nagios-2 postfix/cleanup[10580]: 2A87038003012: message-id=<20190319130020.2A87038003012@nagios-2.15.26U6.LITF4>
Mar 19 07:00:20 nagios-2 postfix/qmgr[12786]: 2A87038003012: from=<root@nagios-2.15.26U6.LITF4>, size=4175, nrcpt=1 (queue active)
Mar 19 07:00:20 nagios-2 postfix/local[10584]: 2A87038003012: to=<root@nagios-2.15.26U6.LITF4>, orig_to=<root>, relay=local, delay=0.1, delays=0.05/0.01/0/0.04, dsn=5.2.2, status=bounced (cannot update mailbox /var/mail/root for user root. error writing message: File too large)
Mar 19 07:00:20 nagios-2 postfix/cleanup[10580]: 3C3B13800301E: message-id=<20190319130020.3C3B13800301E@nagios-2.15.26U6.LITF4>
Mar 19 07:00:20 nagios-2 postfix/bounce[10586]: 2A87038003012: sender non-delivery notification: 3C3B13800301E
Mar 19 07:00:20 nagios-2 postfix/qmgr[12786]: 3C3B13800301E: from=<>, size=6145, nrcpt=1 (queue active)
Mar 19 07:00:20 nagios-2 postfix/qmgr[12786]: 2A87038003012: removed
Mar 19 07:00:20 nagios-2 postfix/local[10584]: 3C3B13800301E: to=<root@nagios-2.15.26U6.LITF4>, relay=local, delay=0.04, delays=0.01/0/0/0.03, dsn=5.2.2, status=bounced (cannot update mailbox /var/mail/root for user root. error writing message: File too large)
Mar 19 07:00:20 nagios-2 postfix/qmgr[12786]: 3C3B13800301E: removed

[tgriep]

The maillog entries you posted look like they were generated bu a cron job that is sending email to the local root account and it is failing as the inbox for the root account is too large.
Take a look at this file and remove the emails from it.
/var/mail/root

This is what is probably happening. Te contacts are using the local postfix daemon to forward the emails on and that the postfix daemon is getting blocked by the email relay server it is using.

If you login to the XI GUI and go to the Admin > Manage Email Settings menu, it the server setup to use a SMTP server?

If so, I would follow this document to create a new command that will allow contact only accounts the ability to use the SMTP server that is specified in XI.
https://assets.nagios.com/downloads/nag ... Mailer.pdf

[harinarne]

Below is the information that which, i found. we are getting emails alerts randomly for the contacts...

If you login to the XI GUI and go to the Admin > Manage Email Settings menu, it the server setup to use a SMTP server? yes

i used the same document that which you provided to configure the contacts.

I see the below messages from /var/mail/root

/etc/cron.daily/logrotate:

error: skipping "/var/log/snmptt/snmpttsystem.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/snmptt/snmptthandler.debug" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/snmptt/snmptt.debug" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

From root@nagios-2.15.26U6.LITF4 Mon Sep 3 03:14:04 2018
Return-Path: <root@nagios-2.15.26U6.LITF4>
X-Original-To: root
Delivered-To: root@nagios-2.15.26U6.LITF4
Received: by nagios-2.15.26U6.LITF4 (Postfix, from userid 0)
id 13B1438003035; Mon, 3 Sep 2018 03:14:04 -0600 (MDT)
From: Anacron <root@nagios-2.15.26U6.LITF4>
To: root@nagios-2.15.26U6.LITF4
Content-Type: text/plain; charset="UTF-8"
Subject: Anacron job 'cron.daily' on nagios-2.15.26U6.LITF4
Message-Id: <20180903091404.13B1438003035@nagios-2.15.26U6.LITF4>
Date: Mon, 3 Sep 2018 03:14:04 -0600 (MDT)

/etc/cron.daily/logrotate:

error: skipping "/var/log/snmptt/snmpttsystem.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/snmptt/snmptthandler.debug" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/snmptt/snmptt.debug" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

[tgriep]

The permission setting for that folder can be fixed by running the following commands.

Code: Select all

chown snmptt.snmptt /var/log/snmptt
chmod 755 /var/log/snmptt

That should stop the logrotate from creating that email.

[harinarne]

we already same permission on snmptt
>ls -la /var/log/snmptt
total 8
drwxr-xr-x 2 snmptt snmptt 29 Aug 21 2018 .
drwxr-xr-x. 18 root root 4096 Jan 13 03:50 ..
-rw-r--r-- 1 root root 998 Dec 30 09:44 snmpttsystem.log

I have a quick question, we are getting alerts for contacts.

For example:
we got alerts on Friday and got stopped. Again we are getting alerts yesterday(Monday) and got stopped from this morning for contacts

and for users, there is no delay in alerts.

[tgriep]

Login to the Nagios XI GUI and go to the Admin > Manage Email Settings menu and enable the debug log.

If the issue happens again, get this file from the server and post it so we can view it.

Code: Select all

/usr/local/nagiosxi/tmp/phpmailer.log

Could you post your Nagios XI System Profile so we can review it?
To get your system profile. Login to the Nagios XI GUI using a web browser.
Click the "Admin" > "System Profile" Menu
Click the "Download Profile" button
Save the profile.zip file and upload it to the forum post.

Post the name of a contact that is working and the name of a contact that is not working and the name of the Host or Service check that generated the email notification.