syntax to query list of hosts with active check disabled ?

[nagmoto]

Hi

I like to write a script to pull out similar result like following via webgui

https://nagios.test.com/nagios/cgi-bin/ ... stprops=16

but from following output, I don't know how to specify the query sentence.

https://nagios.test.com/nagios/cgi-bin/ ... query=help

[Box293]

If you have Nagios Core 4.0.7 or later you can use the statusjson.cgi

Go to this URL:
https://nagios.test.com/nagios/jsonquery.html

Here you can build the query and it'll give you the URL you need.

Select Status JSON CGI
Query: servicelist
Show Details: True
Click Send Query

The screen will refresh and you'll get the URL at the top of the page and also the results (better if you open another tab to open the URL).

If a service has active checks disabled it'll have "checks_enabled": false

So using a script (like perl) you could issue a CURL to get the URL and then you can parse the data received as it'll be in a JSON object.

Does this help?

[nagmoto]

Thanks, I was able to see "checks_enabled:" via following command line, using python script with requests and json module.

https://nagios.test.com/nagios/cgi-bin/ ... tails=true

The next question is

How can I find out which nagios admin disabled active check and when ?

Goal is to auto send out reminding email to all the nagios admins

[mcapra]

In Nagios XI you could get that info via the audit log, but I can't think of a way to do it in Nagios Core. In the event log, you can find the *when* but not the *who*. There isn't anything regarding which user submit the "Disable Active Checks" command (only that the command was submit):

Code: Select all

[07-27-2016 12:08:05] EXTERNAL COMMAND: DISABLE_SVC_CHECK;localhost;HTTP

One option would be to notify the contacts or contact_groups for that service which has active checks disabled. This would likely cause a lot of unwanted message, but at least someone would be notified if active checks are disabled for an extended period of time.

Say I find that a particular Service object has checks_enabled:false. Using the host_name and description fields, you could then get the proper Service object via objectjson.cgi which will contain the contacts and contact_groups arrays. You could then use SEND_CUSTOM_SVC_NOTIFICATION to notify a particular contact or group when active checks are disabled for too long.

[nagmoto]

>One option would be to notify the contacts or contact_groups for that service which has active checks disabled.
>This would likely cause a lot of unwanted message, but at least someone would be notified if active checks are disabled for an extended period of time.

This option looks least costly in general, can you provide more detail on how to trigger email if a host/service got disabled with "active check" ?

Thanks

[mcapra]

how to trigger email if a host/service got disabled with "active check" ?

As this isn't a feature of Core, it would likely involve writing a script that gets run as a cron job.

In my mind, you would write a script that does the following:

• Get all services
• Iterate over every service, check if active checks are enabled
• If no active checks, get the host's contact info
• send custom notification

And gets run at the beginning of the day.

You could also consider configuring freshness for your checks to make sure they are eventually run, but this doesn't solve the issue of people disabling active checks and forgetting about it.
https://assets.nagios.com/downloads/nag ... hness.html

[nagmoto]

Thanks for the clarification. I will write this script myself since no existing work/scrip I can reuse.
This approach is better than taking out "disable active check" from default menu on the right.

R1: https://support.nagios.com/forum/viewto ... 18&t=39395


Please close out this email thread.

[mcapra]

Closing this per your request