Passive checks log?

[emartine]

I don't recall ever creating any passive service checks... But according to the Monitoring engine check statistics there are 302 passive service checks occurring.

passive checks.png

Any idea where I can see what services they are?

I understand that nagios does keep an eye on passive check results for a service and actively performs a check if Nagios hasn't heard from the passively monitored host for a specific amount of time.

[Box293]

Great question which made me go learn something.

There are two parts to this answer.

Go to the home page.
Hold Ctrl and click Service Detail
This opens up the services in a new tab/window
In the URL, at the end of the URL add &serviceattr=65536 and then press Enter

Now this should show all Passive Services.

How did I get this number?
Open up the file
/usr/local/nagiosxi/html/includes/constants.inc.php
Go to about line number 349
This should have a list of attributes and codes

Code: Select all

 define("SERVICESTATUSATTR_PASSIVECHECK", 65536);

[abrist]

If you use snmptraps, they are considered passive fyi.
You can check for "PASSIVE" in the nagios logs (or the XI Home --> Event Log), but passive logging must be enabled first. Check to see if it is:

Code: Select all

grep log_passive /usr/local/nagios/etc/nagios.cfg

If it is not set to "1", edit nagios.cfg, change it to one, and restart nagios:

Code: Select all

sed -i 's/log_passive_checks=.*/log_passive_checks=1/g' /usr/local/nagios/etc/nagios.cfg
grep log_passive /usr/local/nagios/etc/nagios.cfg
service nagios restart

Now you will have to wait until more passive checks are received. Afterwards, check the XI event log or the nagios.log file:

Code: Select all

grep PASSIVE /usr/local/nagios/var/nagios.log | tail -25

You can decide to leave passive logging on if you wish. If you want to turn it back off, run:

Code: Select all

sed -i 's/log_passive_checks=.*/log_passive_checks=0/g' /usr/local/nagios/etc/nagios.cfg
grep log_passive /usr/local/nagios/etc/nagios.cfg
service nagios restart

[emartine]

Thank you for your reply box293.

I checked to see if this number was the same on my server by going to the constants file and sure enough it was.
So I tried:
https://<servername>/nagiosxi/includes/components/xicore/status.php?show=services&serviceattr=65536
This is showing me every single service check on my system since it says 6,399 total records. So this is telling me that everything is configured to do passive checks and active checks apparently?

I know that some services/servers are being retired or worked on by folks legitimately and they have disabled alerts/check and some have set passive checks (who think this is the method of disabling checks/notifications - user training mitigation will happen on my part when I find these folks).
So to find what people have set to passive is a bit of a challenge.

[emartine]

abrist thank you for your reply. I do not have any SNMP traps configured. I have set the configuration file to 1 for passive check logging.... and am going through all of the checks.. I found the culprits and have re-enabled them. All is well.

But wouldn't it be nice to have a section of URLs that would lead to things like these for all hosts/services? I'll put in a feature request... Some folks around here like to see these and might want reports for those kind of items.

[lmiltchev]

I am glad your issue has been resolved!

I'll put in a feature request... Some folks around here like to see these and might want reports for those kind of items.

Please, let us know when you do so that we can lock the topic. Thanks!

[emartine]

Please feel free to lock this. I submitted a feature request.