DOWNTIMEEND Service Alert

[atso]

I've had created a recurring downtime schedule on a specific device a couple of days ago. I had deleted that schedule yesterday and applied configuration change however I've received a DOWNTIMEEND service alert this morning. I've checked the downtime schedule and there is no entry for that device.

Am I missing something?

Thanks

[tgriep]

When you deleted the Recurring Downtime schedule, you you verify that it was removed?
Was there a second entry that was missed?
Also, if someone scheduled a one time downtime and that ended, it will be removed from the system and that is why you could not find it.
Do you think that happened?

[atso]

I've deleted the recurring downtime schedule and verified it was removed after Apply Configurations. There's no other schedules related to that device. I'm the only one that is allowed to make changes.

[tgriep]

Can you post today's nagios.log file that can be found in the /usr/local/nagios/var folder?
Also, run this command as root and post the output.

Code: Select all

ps -ef --cols=300

What is the name of the host that the notification was sent for?

[atso]

I've attached the 2 logs.
The hostname on the notification is CWNAVJETDB

[tgriep]

I looked in the logs and I couldn't find anything wrong.
I saw that the host sent a downtime notification and then an hour later sent that it ended, but no errors.
There has been some bug fixes in XI for recurring downtime issues so I suggest you upgrade to the latest version of Nagios XI as that may fix the issue from happening in the future.

[atso]

Yes, the host sent a downtime notification and then an hour later sent it end. But that scheduled downtime notifcation was deleted the day before so I should not be getting that downtime notification.
I am currently on the latest version 5.4.4

[tgriep]

The only thing I can think of that there was a duplicated Nagios process running and that one sent the notification but the one updating the web interface had the schedule deleted.
See if you can recreate it and post back the results.