Instant notification of Service State change

[bryceee]

commands.cfg

(7.66 KiB) Downloaded 212 times

nsclient.cfg

(2.04 KiB) Downloaded 213 times

templates.cfg

(12.74 KiB) Downloaded 225 times

Hi Guys,

I am trying to get notifications as soon as a service goes down but its not working.
I get emails after the service has been down for a while and then don't get notified when it comes back up.
How can I do this?

I have attached three files.
The nsclient.cfg is where i have put the commands for the nsclient checks.
I have added in the check_nrpe into the bottom of the command.cfg.
Templates is what my hosts / services use.

I could only add three files so , please find a copy of my contact.cfg inline
#contacts.cfg
define contact{
contact_name nagiosadmin ; Short name of user
use generic-contact ; Inherit default values from generic-contact template (defined above)
alias Nagios Admin ; Full name of user
service_notification_period 24x7
host_notification_period 24x7
service_notification_options u,r,c
host_notification_options d,r,u
service_notification_commands notify-service-by-email
host_notification_commands notify-host-by-email
email [email protected] ; <<***** CHANGE THIS TO YOUR EMAIL ADDRESS ******
}


########################################################################
###############################################################################
#
# CONTACT GROUPS
#
###############################################################################
###############################################################################

# We only have one contact in this simple configuration file, so there is
# no need to create more than one contact group.

define contactgroup{
contactgroup_name admins
alias Nagios Administrators
members nagiosadmin
}

The server configuration is below
#Server config
# PERSPLUNK01

define host{
use windows-server ; Name of host template to use
; This host definition will inherit all variables that are defined
; in (or inherited by) the linux-server host template definition.
host_name PERSPLUNK01
alias Perth Splunk Server
address 10.1.1.1
hostgroups perth-windows-servers
}


#Define a Service to "Check CPU Load"
define service{
use windows-server-service
host_name PERSPLUNK01
service_description CPU Load Average
check_command check_win_cpuload
}
#Define a Service to "Check Momory Usage"
define service{
use windows-server-service
host_name PERSPLUNK01
service_description Memory Usage
check_command check_nrpe_mem
}

#Define a service to "Check Disk C:\"

define service{
use windows-server-service
host_name PERSPLUNK01
service_description Check Drive C:
check_command check_win_drive!C!90!98
}

#Define a service to "Check Disk S:\"

define service{
use windows-server-service
host_name PERSPLUNK01
service_description Check Drive S:
check_command check_win_drive!S!90!98
}

#Define a service to "Check Splunk Server Services"
define service{
use windows-server-service
host_name PERSPLUNK01
service_description Splunk Server Services
check_command check_splunk_service!Splunkd!splunkweb
}

#Define a service to "Check Windows Services"
define service{
use windows-server-service
host_name PERSPLUNK01
service_description Windows 2012 Server Services
check_command check_win2012_service!DNS Client!Netlogon!Remote Procedure Call (RPC)!Remote Desktop Services!Remote Desktop Configuration
}

#Define a service to "Check EventLog System"
#define service{
# use windows-server-service
# host_name PERSPLUNK01
# service_description Event Log
# check_command check_eventlog
# }

[eloyd]

I'm not sure I understand what you mean by "as soon as it goes down" but if you mean you want notifications at the first sign of trouble, then you need to change "max_check_attempts" from 3 to 1 in your template.

[slansing]

Precisely, if you want more specific help you will need to share your templates that are in use.

Edit: Ah, there it is, thank you.

[bryceee]

Sorry guys,

The attachments and incline snips are what I am using.

And yes I was meaning as soon as the service is in trouble, I will try setting the max_check_attempts to 1

[slansing]

Yeah, give it a shot and let us know, that is the directive you will want to change. Just make sure you do it on the object itself, or the template, if you leave the object at 3, instead of 1, but change the template, it won't be inherited, as objects over-ride templates when the same directive is defined.