livestatus LQL: Select services both in CRITICAL and HARD

[nagmoto]

This on Nagioscore 3.5.1. I am new to the LQL language.

Following example script can pick out CRITICAL service but it also will select CRITICAL service in both SOFT and HARD state.
This is not what I want, I want to ignore the CRITICAL service alerts are in SOFT state.

I read though R1 doc many times. Still failed to select services are in both HARD and CRITICAL state.

Question: How can I modify LQL statement to narrow down to report service are in CRITICAL(state=2) AND HARD(hart_state=2) also ?

Code: Select all

#!/usr/bin/python
import socket
socket_path = '/var/spool/nagios/cmd/livestatus'
def sendQuery(query):
    """
    INPUT: LQL string.
    OUPUT: query result in string.
    REF  : http://stackoverflow.com/questions/24730883/python-errno-23-socket-livestatus
    """
    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    s.connect(socket_path)
    s.send(query)
    s.shutdown(socket.SHUT_WR)

    answer = ''
    while True:
        data = s.recv(1024)
        answer += data
        if len(data) < 1024:
            break
    s.close()
    return answer

LQL = 'GET services\n' + \
      'Columns: host_name description state last_state_change last_time_critical\n' + \
      'Filter: scheduled_downtime_depth = 0 \n'     + \
      'Filter: host_scheduled_downtime_depth = 0\n' + \
      'Filter: in_notification_period = 1\n'        + \
      'Filter: state    = 2 \n'

print sendQuery(LQL)

R1: https://mathias-kettner.de/checkmk_livestatus.html
R2: http://stackoverflow.com/questions/3496 ... 7_34961548

[lgroschen]

In the MK Livestatus link you posted there is this section:

Code: Select all

GET services
Filter: host_groups >= windows
Filter: scheduled_downtime_depth = 0
Filter: host_scheduled_downtime_depth = 0
Filter: in_notification_period = 1
Stats: last_hard_state = 0
Stats: last_hard_state = 1
Stats: acknowledged = 0
StatsAnd: 2
Stats: last_hard_state = 1
Stats: acknowledged = 1
StatsAnd: 2
Stats: last_hard_state = 2
Stats: acknowledged = 0
StatsAnd: 2
Stats: last_hard_state = 2
Stats: acknowledged = 1
StatsAnd: 2
Stats: last_hard_state = 3
Stats: acknowledged = 0
StatsAnd: 2
Stats: last_hard_state = 3
Stats: acknowledged = 1
StatsAnd: 2

have you tried a filter using 'last_hard_state=x' ?

[nagmoto]

>have you tried a filter using 'last_hard_state=x' ?

Thanks for above pointer

I raised max_check_attempts from 2 to 200 for the service check, so /boot disk space alert can last during the testing period.

Code: Select all

1. Adding last_hard_state  = x as extra filter

LQL  = 'GET services\n' + \
      'Columns: host_name host_address host_state contacts description host_groups last_state_change last_time_critical last_hard_state \n' + \
      'Filter: host_groups >= non-prod\n'           + \
      'Filter: scheduled_downtime_depth = 0 \n'     + \
      'Filter: host_scheduled_downtime_depth = 0\n' + \
      'Filter: in_notification_period = 1\n'        + \
      'Filter: state    = 2 \n'                     + \
      'Filter: last_hard_state  = x \n'

1.1 we get ONLY  the SOFT and CRITICAL alert, HARD and CRITICAL are excluded.

bash-4.1$ ./sendquery.py
centos65t1.example.net;100.64.223.23;0;nagiosadmin;check_disk_3A_Check_Boot;non-prod,core-test;1454023987;1454024876;0


2. Attempt to negate the last_hard_state by "!=x" actually select two HARD+CRITICAL alerts and one SOFT+CRITICAL(back to original issue).
LQL  = 'GET services\n' + \
      'Columns: host_name host_address host_state contacts description host_groups last_state_change last_time_critical last_hard_state \n' + \
      'Filter: host_groups >= non-prod\n'           + \
      'Filter: scheduled_downtime_depth = 0 \n'     + \
      'Filter: host_scheduled_downtime_depth = 0\n' + \
      'Filter: in_notification_period = 1\n'        + \
      'Filter: state    = 2 \n'                     + \
      'Filter: last_hard_state  != x \n'

bash-4.1$ ./sendquery.py
centos65t0.example.net;100.64.223.35;0;nagiosadmin;check_disk_3A_Check_Root;non-prod,core-test;1454024315;1454024435;2
sappn202.example.net;100.65.141.172;0;nagiosadmin;[plmtst03] Oracle Tablespace Check 7A;solaris,non-prod,db;1451945972;1454024383;2
sdbnupd01.example.net;100.65.141.176;0;nagiosadmin;[stup011] Oracle Tablespace Check;solaris,non-prod,db;1453828573;1454024413;2

bash-4.1$

[tmcdonald]

LQL scripts are a bit out of scope for this forum, and check_mk is not our project. You'd probably have better luck asking on their forums since they likely deal with this sort of question more than we do (I've never even really seen this before).

[nagmoto]

LQL scripts are a bit out of scope for this forum, and check_mk is not our project. You'd probably have better luck asking on their forums since they likely deal with this sort of question more than we do (I've never even really seen this before).

Please resolve this ticket.

thanks for the suggestion and I did ask help from livestatus people see R3
Following is the code, by adding extra Filer on state_type =1, 1=hard, 0=soft

Code: Select all

LQL = 'GET services\n' + \
      'Columns: host_name host_address host_state contacts description host_groups last_state_change last_time_critical last_hard_state \n' + \
      'Filter: host_groups >= non-prod\n'           + \
      'Filter: scheduled_downtime_depth = 0 \n'     + \
      'Filter: host_scheduled_downtime_depth = 0\n' + \
      'Filter: in_notification_period = 1\n'        + \
      'Filter: state      = 2 \n'                   + \
      'Filter: state_type = 1 \n'

R3: http://lists.mathias-kettner.de/piperma ... 18483.html

[tmcdonald]

Please resolve this ticket.

Just to be clear, are you saying this was resolved? It looks like it was according to the link, but I want to make sure.

[nagmoto]

Yes, it was resolved by adding "Filter: select_type =1" into LQL string in my example.
Please resolve and lock this thread.

[bwallace]

Glad to hear this is resolved. We'll lock this thread now and feel free to open another should you require assistance with anything else.