Nagios alerts for removed services

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
Aikanaro
Posts: 16
Joined: Fri Apr 28, 2017 3:07 pm

Nagios alerts for removed services

Post by Aikanaro »

Hello everyone,

We've been starting having issues with Nagios recently. I have removed service check from one of the hosts and started getting emails for removed check. Check logs and Nagios its not there, checked all configs in /usr/local/nagios/etc but still cant find anything. Is there any suggestions how to fix it?

Tried restarting server. Stopped/Started nagios instance. Added back service check with same service name but looking at interface that up/up still getting an email. Nothing on Nagios dashboard itself. Not in Event Log or Notifications...

Please, someone help me :cry:
User avatar
tgriep
Madmin
Posts: 9177
Joined: Thu Oct 30, 2014 9:02 am

Re: Nagios alerts for removed services

Post by tgriep »

It could be that when the service was removed, it did not get removed from the retention.dat file or the objects.cache file.

Code: Select all

/usr/local/nagios/var/retention.dat
/usr/local/nagios/var/objects.cache
When nagios starts, it reads those files for the running configurations and for the status when the system was shutdown.
What you could do is to stop the Nagios daemon, edit those files and remove the entry and start the Nagios Daemon when you are done.
Try that and let us know if you have anymore questions.
Be sure to check out our Knowledgebase for helpful articles and solutions!
Aikanaro
Posts: 16
Joined: Fri Apr 28, 2017 3:07 pm

Re: Nagios alerts for removed services

Post by Aikanaro »

tgriep wrote:It could be that when the service was removed, it did not get removed from the retention.dat file or the objects.cache file.

Code: Select all

/usr/local/nagios/var/retention.dat
/usr/local/nagios/var/objects.cache
When nagios starts, it reads those files for the running configurations and for the status when the system was shutdown.
What you could do is to stop the Nagios daemon, edit those files and remove the entry and start the Nagios Daemon when you are done.
Try that and let us know if you have anymore questions.
Tgriep - Thanks for reply!

I have tried your option - but no service or host(ive removed it completely from the Nagios to test it) were there. Forgot to mention, since anytime Nagios sends and alert notification information about that mail gets stored in /var/log/mail.log - i checked mail logs and emails for that service that is alerting we are receiving and was removed are not in the mail log. So basically Service is not there, removed and it still alerts and sends emails...

I am open to all suggestions.

Thanks for reply!!!
dwhitfield
Former Nagios Staff
Posts: 4583
Joined: Wed Sep 21, 2016 10:29 am
Location: NoLo, Minneapolis, MN
Contact:

Re: Nagios alerts for removed services

Post by dwhitfield »

Are you using any custom event handlers? See https://assets.nagios.com/downloads/nag ... dlers.html for details.

If not, it seems likely this is a mail issue and not a nagios issue. You might get a quicker resolution with the forums/mailing list of your distro or whatever mail client you use.

That said, what's the output of mailq and alternatives --display mta?
Any other details you can give us about how you typically send mail?

It's possible there's more than one nagios installed on the server. What's the output of find / -name nagios.cfg and ps -aef | grep nagios.cfg?


What's the name of the service/host sending mail?
Please run tar -zcvf /tmp/supporttar.tar.gz /usr/local/nagios/etc /usr/local/nagios/var/ and attach the file. If you are concerned about security, you can PM it to me. If you choose to PM, please make sure you update the thread so it shows back up on our support dashboard.


Lastly, what version of Core are you using? Was it compiled from source or installed from distro repos? On what OS/version is nagios running? cat /etc/*-release may be of use.
Aikanaro
Posts: 16
Joined: Fri Apr 28, 2017 3:07 pm

Re: Nagios alerts for removed services

Post by Aikanaro »

dwhitfield wrote:Are you using any custom event handlers? See https://assets.nagios.com/downloads/nag ... dlers.html for details.

If not, it seems likely this is a mail issue and not a nagios issue. You might get a quicker resolution with the forums/mailing list of your distro or whatever mail client you use.

That said, what's the output of mailq and alternatives --display mta?
Any other details you can give us about how you typically send mail?

It's possible there's more than one nagios installed on the server. What's the output of find / -name nagios.cfg and ps -aef | grep nagios.cfg?


What's the name of the service/host sending mail?
Please run tar -zcvf /tmp/supporttar.tar.gz /usr/local/nagios/etc /usr/local/nagios/var/ and attach the file. If you are concerned about security, you can PM it to me. If you choose to PM, please make sure you update the thread so it shows back up on our support dashboard.


Lastly, what version of Core are you using? Was it compiled from source or installed from distro repos? On what OS/version is nagios running? cat /etc/*-release may be of use.
Hello dwhitfield,

thanks for quick response.

No, on that Nagios server we are not using Event Handlers, it's our network monitoring server.


Here is output of mailq:

Code: Select all

root@ATL-NM-02:/var/log# mailq
MSP Queue status...
/var/spool/mqueue-client is empty
                Total requests: 0
MTA Queue status...
/var/spool/mqueue is empty
                Total requests: 0

alternatives --display mta:
For some reason this command didnt work for me...

root@ATL-NM-02:/etc/alternatives# alternatives --display mta
No command 'alternatives' found, did you mean:
Command 'galternatives' from package 'galternatives' (universe)
alternatives: command not found

So i did it another way:

Code: Select all

root@ATL-NM-02:/etc/alternatives# telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 ATL-NM-02.afy.gbl ESMTP Sendmail 8.14.4/8.14.4/Debian-4.1ubuntu1; Mon, 1 May 2017 10:37:16 -0700; (No UCE/UBE) logging access from: localhost(OK)-localhost [127.0.0.1]

Well we only use this server for Nagios purpose, nothing else is running on it.

regarding find / -name nagios.cfg here is output:

Code: Select all

root@ATL-NM-02:/etc/alternatives# find / -name nagios.cfg
/usr/local/nagios/etc/nagios.cfg
/etc/nagios3/nagios.cfg
/home/administrator/nagios-4.1.1/sample-config/nagios.cfg
/home/administrator/nagios-4.1.1/t/etc/nagios.cfg
/home/administrator/nagios-4.1.1/t-tap/smallconfig/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v3_config/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v2_config/nagios.cfg


ps -aef | grep nagios.cfg:

Code: Select all

root@ATL-NM-02:/etc/alternatives# ps -aef | grep nagios.cfg
nagios    1295     1  0 04:33 ?        00:00:02 /usr/sbin/nagios3 -d /etc/nagios3/nagios.cfg
root      3998  2160  0 10:41 pts/0    00:00:00 grep --color=auto nagios.cfg
nagios   17160     1  0 09:04 ?        00:00:03 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg
nagios   17167 17160  0 09:04 ?        00:00:00 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg


Name of the service that sending email is: smtp.sendgrid.net
Version of Core is Nagios® Core™ 4.1.1

It was compiled from distro repos i think, i am not sure since i didnt install it myself. Is there a way to check it?


OS Version:

Code: Select all

root@ATL-NM-02:/tmp# cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu 14.04.5 LTS"
NAME="Ubuntu"
VERSION="14.04.5 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.5 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
i will pm supporttar.tar.gz file.


Thanks alot for your help!

Please let me know if am missing anything.
Last edited by dwhitfield on Tue May 02, 2017 2:27 pm, edited 1 time in total.
Reason: code blocks FTW
dwhitfield
Former Nagios Staff
Posts: 4583
Joined: Wed Sep 21, 2016 10:29 am
Location: NoLo, Minneapolis, MN
Contact:

Re: Nagios alerts for removed services

Post by dwhitfield »

Aikanaro wrote: regarding find / -name nagios.cfg here is output:
root@ATL-NM-02:/etc/alternatives# find / -name nagios.cfg
/usr/local/nagios/etc/nagios.cfg
/etc/nagios3/nagios.cfg
/home/administrator/nagios-4.1.1/sample-config/nagios.cfg
/home/administrator/nagios-4.1.1/t/etc/nagios.cfg
/home/administrator/nagios-4.1.1/t-tap/smallconfig/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v3_config/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v2_config/nagios.cfg



ps -aef | grep nagios.cfg:
root@ATL-NM-02:/etc/alternatives# ps -aef | grep nagios.cfg
nagios 1295 1 0 04:33 ? 00:00:02 /usr/sbin/nagios3 -d /etc/nagios3/nagios.cfg
root 3998 2160 0 10:41 pts/0 00:00:00 grep --color=auto nagios.cfg
nagios 17160 1 0 09:04 ? 00:00:03 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg
nagios 17167 17160 0 09:04 ? 00:00:00 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg
This is *a* problem. Hard to say at this point if it is your only problem. I suspect running sudo apt remove nagios3 will resolve your issue.

Before you run that command though, I would run a full system backup. If things stop working, do a restore and then we can try to remove things piece by piece.

Code: Select all

rm -f /usr/sbin/nagios3
rm -f /etc/nagios3/nagios.cfg
may be enough, but it's possible running apt update will bring back the issue. If the apt remove doesn't go well, then can you post your /etc/nagios3/nagios.cfg? You might just me able to turn notifications off for nagios3.
Aikanaro
Posts: 16
Joined: Fri Apr 28, 2017 3:07 pm

Re: Nagios alerts for removed services

Post by Aikanaro »

dwhitfield wrote:
Aikanaro wrote: regarding find / -name nagios.cfg here is output:
root@ATL-NM-02:/etc/alternatives# find / -name nagios.cfg
/usr/local/nagios/etc/nagios.cfg
/etc/nagios3/nagios.cfg
/home/administrator/nagios-4.1.1/sample-config/nagios.cfg
/home/administrator/nagios-4.1.1/t/etc/nagios.cfg
/home/administrator/nagios-4.1.1/t-tap/smallconfig/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v3_config/nagios.cfg
/home/administrator/.cpan/build/Nagios-Object-0.21.20-_MeOwq/t/v2_config/nagios.cfg



ps -aef | grep nagios.cfg:
root@ATL-NM-02:/etc/alternatives# ps -aef | grep nagios.cfg
nagios 1295 1 0 04:33 ? 00:00:02 /usr/sbin/nagios3 -d /etc/nagios3/nagios.cfg
root 3998 2160 0 10:41 pts/0 00:00:00 grep --color=auto nagios.cfg
nagios 17160 1 0 09:04 ? 00:00:03 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg
nagios 17167 17160 0 09:04 ? 00:00:00 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg
This is *a* problem. Hard to say at this point if it is your only problem. I suspect running sudo apt remove nagios3 will resolve your issue.

Before you run that command though, I would run a full system backup. If things stop working, do a restore and then we can try to remove things piece by piece.

Code: Select all

rm -f /usr/sbin/nagios3
rm -f /etc/nagios3/nagios.cfg
may be enough, but it's possible running apt update will bring back the issue. If the apt remove doesn't go well, then can you post your /etc/nagios3/nagios.cfg? You might just me able to turn notifications off for nagios3.


dwhitfield,

thanks for quick reply.

I think i remember why we used nagios3 it came with nagios-nrpe-server something like that. After removing Nagios is still running and i dont see any issues so far. weird thing is that when i run command ps -aef | grep nagios.cfg it still points to this:

Code: Select all

root@ATL-NM-02:/usr/local/nagios/etc/objects# ps -aef | grep nagios.cfg
nagios    1295     1  0 04:33 ?        00:00:03 /usr/sbin/nagios3 -d /etc/nagios3/nagios.cfg

Oh and also ive noticed that it take about 6 hours to get an email from Nagios server for this specific service that was removed. All other services are fine.
Last edited by dwhitfield on Tue May 02, 2017 2:26 pm, edited 1 time in total.
Reason: code blocks FTW
User avatar
tgriep
Madmin
Posts: 9177
Joined: Thu Oct 30, 2014 9:02 am

Re: Nagios alerts for removed services

Post by tgriep »

If the issue is still happening, can you post this nagios.cfg file from your server?

Code: Select all

/etc/nagios3/nagios.cfg
Be sure to check out our Knowledgebase for helpful articles and solutions!
Aikanaro
Posts: 16
Joined: Fri Apr 28, 2017 3:07 pm

Re: Nagios alerts for removed services

Post by Aikanaro »

tgriep wrote:If the issue is still happening, can you post this nagios.cfg file from your server?

Code: Select all

/etc/nagios3/nagios.cfg

Sure, here is nagios config:

Code: Select all

#################################################################
#
# CGI.CFG - Sample CGI Configuration File for Nagios 4.1.1
#
#
#################################################################


# MAIN CONFIGURATION FILE
# This tells the CGIs where to find your main configuration file.
# The CGIs will read the main and host config files for any other
# data they might need.

main_config_file=/usr/local/nagios/etc/nagios.cfg



# PHYSICAL HTML PATH
# This is the path where the HTML files for Nagios reside.  This
# value is used to locate the logo images needed by the statusmap
# and statuswrl CGIs.

physical_html_path=/usr/local/nagios/share



# URL HTML PATH
# This is the path portion of the URL that corresponds to the
# physical location of the Nagios HTML files (as defined above).
# This value is used by the CGIs to locate the online documentation
# and graphics.  If you access the Nagios pages with an URL like
# http://www.myhost.com/nagios, this value should be '/nagios'
# (without the quotes).

url_html_path=/nagios



# CONTEXT-SENSITIVE HELP
# This option determines whether or not a context-sensitive
# help icon will be displayed for most of the CGIs.
# Values: 0 = disables context-sensitive help
#         1 = enables context-sensitive help

show_context_help=0



# PENDING STATES OPTION
# This option determines what states should be displayed in the web
# interface for hosts/services that have not yet been checked.
# Values: 0 = leave hosts/services that have not been check yet in their original state
#         1 = mark hosts/services that have not been checked yet as PENDING

use_pending_states=1




# AUTHENTICATION USAGE
# This option controls whether or not the CGIs will use any 
# authentication when displaying host and service information, as
# well as committing commands to Nagios for processing.  
#
# Read the HTML documentation to learn how the authorization works!
#
# NOTE: It is a really *bad* idea to disable authorization, unless
# you plan on removing the command CGI (cmd.cgi)!  Failure to do
# so will leave you wide open to kiddies messing with Nagios and
# possibly hitting you with a denial of service attack by filling up
# your drive by continuously writing to your command file!
#
# Setting this value to 0 will cause the CGIs to *not* use
# authentication (bad idea), while any other value will make them
# use the authentication functions (the default).

use_authentication=1




# x509 CERT AUTHENTICATION
# When enabled, this option allows you to use x509 cert (SSL)
# authentication in the CGIs.  This is an advanced option and should
# not be enabled unless you know what you're doing.

use_ssl_authentication=0




# DEFAULT USER
# Setting this variable will define a default user name that can
# access pages without authentication.  This allows people within a
# secure domain (i.e., behind a firewall) to see the current status
# without authenticating.  You may want to use this to avoid basic
# authentication if you are not using a secure server since basic
# authentication transmits passwords in the clear.
#
# Important:  Do not define a default username unless you are
# running a secure web server and are sure that everyone who has
# access to the CGIs has been authenticated in some manner!  If you
# define this variable, anyone who has not authenticated to the web
# server will inherit all rights you assign to this user!
 
#default_user_name=guest



# SYSTEM/PROCESS INFORMATION ACCESS
# This option is a comma-delimited list of all usernames that
# have access to viewing the Nagios process information as
# provided by the Extended Information CGI (extinfo.cgi).  By
# default, *no one* has access to this unless you choose to
# not use authorization.  You may use an asterisk (*) to
# authorize any user who has authenticated to the web server.

authorized_for_system_information=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn



# CONFIGURATION INFORMATION ACCESS
# This option is a comma-delimited list of all usernames that
# can view ALL configuration information (hosts, commands, etc).
# By default, users can only view configuration information
# for the hosts and services they are contacts for. You may use
# an asterisk (*) to authorize any user who has authenticated
# to the web server.

authorized_for_configuration_information=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn



# SYSTEM/PROCESS COMMAND ACCESS
# This option is a comma-delimited list of all usernames that
# can issue shutdown and restart commands to Nagios via the
# command CGI (cmd.cgi).  Users in this list can also change
# the program mode to active or standby. By default, *no one*
# has access to this unless you choose to not use authorization.
# You may use an asterisk (*) to authorize any user who has
# authenticated to the web server.

authorized_for_system_commands=nagiosadmini,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn



# GLOBAL HOST/SERVICE VIEW ACCESS
# These two options are comma-delimited lists of all usernames that
# can view information for all hosts and services that are being
# monitored.  By default, users can only view information
# for hosts or services that they are contacts for (unless you
# you choose to not use authorization). You may use an asterisk (*)
# to authorize any user who has authenticated to the web server.


authorized_for_all_services=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn
authorized_for_all_hosts=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn



# GLOBAL HOST/SERVICE COMMAND ACCESS
# These two options are comma-delimited lists of all usernames that
# can issue host or service related commands via the command
# CGI (cmd.cgi) for all hosts and services that are being monitored. 
# By default, users can only issue commands for hosts or services 
# that they are contacts for (unless you you choose to not use 
# authorization).  You may use an asterisk (*) to authorize any
# user who has authenticated to the web server.

authorized_for_all_service_commands=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn
authorized_for_all_host_commands=nagiosadmin,imatsenko,NagiosTest,sanjankar,alee,btulman,nocstatus,lmugin,mchapman,nocservice,Wwonchoba,bdunn



# READ-ONLY USERS
# A comma-delimited list of usernames that have read-only rights in
# the CGIs.  This will block any service or host commands normally shown
# on the extinfo CGI pages.  It will also block comments from being shown
# to read-only users.

#authorized_for_read_only=user1,user2




# STATUSMAP BACKGROUND IMAGE
# This option allows you to specify an image to be used as a 
# background in the statusmap CGI.  It is assumed that the image
# resides in the HTML images path (i.e. /usr/local/nagios/share/images).
# This path is automatically determined by appending "/images"
# to the path specified by the 'physical_html_path' directive.
# Note:  The image file may be in GIF, PNG, JPEG, or GD2 format.
# However, I recommend that you convert your image to GD2 format
# (uncompressed), as this will cause less CPU load when the CGI
# generates the image.

#statusmap_background_image=smbackground.gd2




# STATUSMAP TRANSPARENCY INDEX COLOR
# These options set the r,g,b values of the background color used the statusmap CGI,
# so normal browsers that can't show real png transparency set the desired color as
# a background color instead (to make it look pretty).  
# Defaults to white: (R,G,B) = (255,255,255).

#color_transparency_index_r=255
#color_transparency_index_g=255
#color_transparency_index_b=255




# DEFAULT STATUSMAP LAYOUT METHOD
# This option allows you to specify the default layout method
# the statusmap CGI should use for drawing hosts.  If you do
# not use this option, the default is to use user-defined
# coordinates.  Valid options are as follows:
#	0 = User-defined coordinates
#	1 = Depth layers
#       2 = Collapsed tree
#       3 = Balanced tree
#       4 = Circular
#       5 = Circular (Marked Up)

default_statusmap_layout=5



# DEFAULT STATUSWRL LAYOUT METHOD
# This option allows you to specify the default layout method
# the statuswrl (VRML) CGI should use for drawing hosts.  If you
# do not use this option, the default is to use user-defined
# coordinates.  Valid options are as follows:
#	0 = User-defined coordinates
#       2 = Collapsed tree
#       3 = Balanced tree
#       4 = Circular

default_statuswrl_layout=4



# STATUSWRL INCLUDE
# This option allows you to include your own objects in the 
# generated VRML world.  It is assumed that the file
# resides in the HTML path (i.e. /usr/local/nagios/share).

#statuswrl_include=myworld.wrl



# PING SYNTAX
# This option determines what syntax should be used when
# attempting to ping a host from the WAP interface (using
# the statuswml CGI.  You must include the full path to
# the ping binary, along with all required options.  The
# $HOSTADDRESS$ macro is substituted with the address of
# the host before the command is executed.
# Please note that the syntax for the ping binary is
# notorious for being different on virtually ever *NIX
# OS and distribution, so you may have to tweak this to
# work on your system.

ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$



# REFRESH RATE
# This option allows you to specify the refresh rate in seconds
# of various CGIs (status, statusmap, extinfo, and outages).  

refresh_rate=90

# DEFAULT PAGE LIMIT
# This option allows you to specify the default number of results 
# displayed on the status.cgi.  This number can be adjusted from
# within the UI after the initial page load. Setting this to 0
# will show all results.  

result_limit=100


# ESCAPE HTML TAGS
# This option determines whether HTML tags in host and service
# status output is escaped in the web interface.  If enabled,
# your plugin output will not be able to contain clickable links.

escape_html_tags=1




# SOUND OPTIONS
# These options allow you to specify an optional audio file
# that should be played in your browser window when there are
# problems on the network.  The audio files are used only in
# the status CGI.  Only the sound for the most critical problem
# will be played.  Order of importance (higher to lower) is as
# follows: unreachable hosts, down hosts, critical services,
# warning services, and unknown services. If there are no
# visible problems, the sound file optionally specified by
# 'normal_sound' variable will be played.
#
#
# <varname>=<sound_file>
#
# Note: All audio files must be placed in the /media subdirectory
# under the HTML path (i.e. /usr/local/nagios/share/media/).

#host_unreachable_sound=hostdown.wav
#host_down_sound=hostdown.wav
#service_critical_sound=critical.wav
#service_warning_sound=warning.wav
#service_unknown_sound=warning.wav
#normal_sound=noproblem.wav



# URL TARGET FRAMES
# These options determine the target frames in which notes and 
# action URLs will open.

action_url_target=_blank
notes_url_target=_blank




# LOCK AUTHOR NAMES OPTION
# This option determines whether users can change the author name 
# when submitting comments, scheduling downtime.  If disabled, the 
# author names will be locked into their contact name, as defined in Nagios.
# Values: 0 = allow editing author names
#         1 = lock author names (disallow editing)

lock_author_names=1




# SPLUNK INTEGRATION OPTIONS
# These options allow you to enable integration with Splunk
# in the web interface.  If enabled, you'll be presented with
# "Splunk It" links in various places in the CGIs (log file,
# alert history, host/service detail, etc).  Useful if you're
# trying to research why a particular problem occurred.
# For more information on Splunk, visit http://www.splunk.com/

# This option determines whether the Splunk integration is enabled
# Values: 0 = disable Splunk integration
#         1 = enable Splunk integration

#enable_splunk_integration=1


# This option should be the URL used to access your instance of Splunk

#splunk_url=http://127.0.0.1:8000/




# NAVIGATION BAR SEARCH OPTIONS
# The following options allow to configure the navbar search. Default
# is to search for hostnames. With enabled navbar_search_for_addresses,
# the navbar search queries IP addresses as well. It's also possible
# to enable search for aliases by setting navbar_search_for_aliases=1.

navbar_search_for_addresses=1
navbar_search_for_aliases=1





# DEFAULTS FOR CHECKBOXES FOR ACKNOWLEDGEMENTS
# Enabling ack_no_sticky will default the "Sticky Acknowledgement" to 
# be unchecked.
# Enabling ack_no_send will default the "Send Notification" to 
# be unchecked.

#ack_no_sticky=0
#ack_no_send=0

thanks!
Last edited by dwhitfield on Tue May 02, 2017 2:25 pm, edited 1 time in total.
Reason: code blocks FTW
dwhitfield
Former Nagios Staff
Posts: 4583
Joined: Wed Sep 21, 2016 10:29 am
Location: NoLo, Minneapolis, MN
Contact:

Re: Nagios alerts for removed services

Post by dwhitfield »

I don't really know much about splunk but are you sure it's not splunk sending out the messages? Can you attach one of the emails with the headers for us to review. Also, can you attach any splunk logs?

UPDATE: tar received and shared with techs
Last edited by dwhitfield on Tue May 02, 2017 12:18 pm, edited 1 time in total.
Reason: pm received
Locked