Host recovery emails being sent while host is unreachable

[tgriep]

The only thing I can think of is a routing table corruption and the ping is testing a bad entry in the table.
If you see if happen again, can you login to the XI server and run a ping to that IP address and see if it gets any replies?
Just a standard ping, not a plugin.
Thanks

[BIB]

No, there is no ping reply. Here are notifications for last occurence of this problem, after I changed check period parameters as you suggested.
The host is powered off for last 2 weeks, and has not been powered on since then.
Important thing is that we have another Nagios Core running, old version, and there is no problem. Configuration is migrated from old version of Nagios Core to new instance of Nagios XI. Problem occurs only on the new Nagios XI.

First notification received:
Notification Type: RECOVERY
Host: TLC_s_BG_146_2
State: UP
Address: 10.34.146.5
Info: WARNING - 10.34.146.5: rta 11.397ms, lost 80%
Date/Time: 2017-01-24 16:25:52

Second notification received:
Notification Type: PROBLEM
Service: TLC_PING 5000-70 10000-100
State: CRITICAL
Host: TLC_s_BG_146_2
Info: PING CRITICAL - Packet loss = 100%
Address: 10.34.146.5
Date/Time: 2017-01-24 16:27:43

Third notification received:
Notification Type: PROBLEM
Host: TLC_s_BG_146_2
State: DOWN
Address: 10.34.146.5
Info: CRITICAL - 10.34.146.5: rta nan, lost 100%
Date/Time: 2017-01-24 16:32:46

[tgriep]

Couple of things to try, can you edit that host's check command and change it to check_ping and see if after the change, the host exhibits the same issue?
Or, you can upgrade to the latest plugins and see if it is fixed there.
You can download the plugins from the link below.
https://www.nagios.org/downloads/nagios-plugins/

[BIB]

We tried changing host's check command previosly, no success. We tried now also, same result.
After plugins upgrade, there is no change, problem still exists.

We have another instance of Nagios XI running on remote site, we will configure same hosts and services and monitor the situation.

[rkennedy]

We tried changing host's check command previosly, no success. We tried now also, same result.
After plugins upgrade, there is no change, problem still exists.

We have another instance of Nagios XI running on remote site, we will configure same hosts and services and monitor the situation.

Really odd. Are things working properly at the new site?

[tmcdonald]

Just checking in since we have not heard from you in a while. Are things at the new site going well?

[BIB]

Sorry for not replying long time.

On the remote site there is no problems with this FALSE RECOVERY.
We performed packet capture on problematic Nagios XI server, but at that time it became reachable, it was plugged in again.
We will perform packet capture again, this time we will monitor another host whitch is unreachable and where we experience this problem, and provide you feedback as soon as possible.

[tmcdonald]

We'll keep it open for you.

[BIB]

During last 16 hours we captured traffic on our Nagios XI server. There was no ping reply packet captured, and there were 3 FALSE RECOVERY notifications.
Any other suggestion?

[avandemore]

I think tgriep is right about there being some type of arp funny business going on. It's entirely possible(and valid) to get an ICMP echo reply from an address you didn't send to.

Perhaps if we turning on stalking we'd be able to get some more detail out of this.

https://assets.nagios.com/downloads/nag ... lking.html

I'd also like to see an updated Nagios log file containing these entries. You can PM or another tech them if you have privacy concerns.