check ping service and time periods

[nesornet]

Greetings,

We are getting way too many PROBLEM alert notifications from a ping_check service definition during business hours, triggered by the ping check RTA exceeding some threshold (which is negligible during business hours due to traffic) .

What is the best way to configure nagios so that it only sends us notifications for non-WARNING states (Critical, Unknown) during normal business hours. While any other time it should send notifications regardless of any state.

I've configured our settings as follows. Can someone confirm whether this is the best way to do this or if there a more logical and scalable / manageable solution?

--snip--

define timeperiod{

timeperiod_name timeperiod_chicago_bizhours
alias timeperiod_chicago_bizhours

sunday 22:00-24:00
monday 00:00-06:00,22:00-24:00
tuesday 00:00-06:00,22:00-24:00
wednesday 00:00-06:00,22:00-24:00
thursday 00:00-06:00,22:00-24:00
friday 00:00-06:00

}

define timeperiod{

timeperiod_name timeperiod_chicago_not_bizhours
alias timeperiod_chicago_not_bizhours

monday 00:00-24:00
tuesday 00:00-24:00
wednesday 00:00-24:00
thursday 00:00-24:00
friday 00:00-24:00
saturday 00:00-24:00
sunday 00:00-24:00

exclude timeperiod_chicago_bizhours
}

define service{
use std_ping
name chicago_ping
contact_groups chicago_admins
check_command check_ping!220.0,20%!600.0,60% ; The command used to monitor the service
}

define service{
use chicago_ping
name chicago_ping_not_bizhours
notification_period timeperiod_chicago_not_bizhours
notification_options w,c,r,u
}

define service{
use chicago_ping
name chicago_ping_bizhours
notification_period timeperiod_chicago_bizhours
notification_options u,c,r
}

define service {
use chicago_ping_bizhours
host_name CHI1SWCOR01
}

-- snip --

Thanks in advance!

[jsmurphy]

Realistically what you have done is fine, you could probably remove some layers of inheritance for sanity purposes if you really wanted. But that will depend on the size of your environment and your config change rate... it may be necessary to keep it as it is. To solve the problem at hand however just move your check_command definition into the chicago_ping_bizhours and chicago_ping_not_bizhours service definitions and increase the values for bizhours.

Monitoring is always a bit of a black art in terms of finding the right levels for your metrics and inheritance complexity. If you feel like you are spending more time worrying about how to abstract things rather than just solving the problem you may need to rationalize a bit on whether the layers of abstraction are providing anything or if they are ever likely to provide anything.