User receiving unwanted email alerts

[markmerchant]

Description
Some users are getting unwanted email from the PHPMailer. All of our hosts,
services, commands, and contacts were imported from an older version of Nagios
which would not contain any references to xi_service_notification_handler.

The emails started after importing AD users.

How is email getting to these users? How can I prevent it? Do I have something
configured incorrectly?

Version
Nagios XI 5.4.10

Date
Installed from tarball on 10/13/2017

Hardware
ESXi virtual host

uname -a
Linux cvglpnagios01.xxx.xxx 3.10.0-693.1.1.el7.x86_64 #1 SMP Thu Aug 3 08:15:31 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux

cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.4 (Maipo)

Example
To: <[email protected]>
Subject: RECOVERY Service Alert - xxxx13/ICMP is OK
X-PHP-Originating-Script: 501:class.phpmailer.php
Date: Tue, 28 Nov 2017 21:32:22 +0000
From: <[email protected]>
Reply-To: <[email protected]>
Message-ID: <[email protected]>
X-Mailer: PHPMailer 5.2.22 (https://github.com/PHPMailer/PHPMailer)
...


grep -i xxxx ./nagios-11-29-2017-00.log
./nagios-11-29-2017-00.log:[1511904444] SERVICE NOTIFICATION: xxxxxx;xxxxx13;ICMP;OK;xi_service_notification_handler;PING OK - Packet loss = 50%, RTA = 2700.67 ms

[kyang]

I am guessing they are being notified by the notify-service-by-email?

Which contact template are they using?

What are the users notification preferences? Do they have it checked for receiving notifications on service recovery?

Is it only the recovery emails that you don't want a user to receive?

[markmerchant]

> Which contact template are they using?

I think you're on to something there. What is the function of the generic contact
group & All contacts group? Does it imply that anyone with host or service notifications
turned on get all alerts?

Is the fix to turn this off for everyone? Or, to create new contact templates for
each group of users? Ie. networking, servers, etc? If I change them to our old
contact groups will that break something in XI?

Also, how does the host get mapped to this alert? The emails appear to be random
( unless its for all hosts, but I am not receiving the alerts ). It seems to be
by-passing the contact group associated with the host template.

Thx.

/app/nagios/etc/contacts.cfg
define contact {
contact_name xxxxx
alias xxxx, x
host_notifications_enabled 1
service_notifications_enabled 1
host_notification_period xxxxx_notification_times
service_notification_period xxxxx_notification_times
host_notification_options d,u,r,f,s
service_notification_options w,u,c,r,f,s
email [email protected]
use xi_contact_generic
}

/app/nagios/etc/contacttemplates.cfg
define contact {
name xi_contact_generic
contactgroups xi_contactgroup_all
host_notification_period xi_timeperiod_24x7
service_notification_period xi_timeperiod_24x7
host_notification_options d,u,r,f,s
service_notification_options w,u,c,r,f,s
host_notification_commands xi_host_notification_handler
service_notification_commands xi_service_notification_handler
register 0
}

/app/nagios/etc/commands.cfg
define command {
command_name xi_service_notification_handler
command_line /usr/bin/php /usr/local/nagiosxi/scripts/handle_nagioscore_notification.php <yada..yada...yada> }

/app/nagios/etc/contactgroups.cfg
define contactgroup {
contactgroup_name xi_contactgroup_all
alias All Contacts }

[kyang]

If you haven't created any custom contact templates that is okay.

That is what I was looking for, the generic-contact and xi-contact-generic templates are just fine. You don't have to create a new template unless you wanted something different for specific users.

The main difference is the notification handler in both contact templates.

generic-contact uses notify-host-by-email and notify-service-by-email

xi-contact-generic uses xi_host_notification_handlerand xi_service_notification_handler

Could you show me the notification preference of the user?

Capture.PNG

[markmerchant]

I believe they are checked, but I don't have access to the users computer. Is there
a way to see that as nagiosadmin?

Would having those boxes checked cause the user to get all notifications for all
hosts? Or, some kind of default choice if no one else is defined? If so, how do I
uncheck them all? None of the users has logged in yet, so they're all default.

Right now the alerts seem to be from random servers to random users. Before,
alerts would only go a user if they were in a contact_group mentioned in a
host (template) definition.

What I'm trying to figure out is: why this specific alert for this specific user
arriving through this particular channel. There doesn't appear to be any relation-
ship between the host/service and the contact.

[kyang]

Could you send in your Nagios XI Profile? On the XI Home Page click "Admin" > "System Profile" --> "Download Profile" button
Save the profile.zip file and upload it here or PM me.

I would like to see who is assigned to what. Thanks!

[markmerchant]

I got an unexpected result:

PROFILE BUILD FAILED
Array
(
)
CODE: 1

[kyang]

Please follow this article,

https://support.nagios.com/kb/article.p ... ategory=44

After you PM the profile, please update this thread. Or let us know if it fails again.

[markmerchant]

I'm getting some push back from the SAs.

Are there systemD versions of the commands mentioned?

What's the under lying issue? How do we tell which command is not working?

Thx.

[dwhitfield]

If not all contacts want everything, you need to adjust your contact template, which is setting emails for everything. You can have different contact templates if that would be easiest. Also, each user should log in to XI and make sure their user settings are set up correctly (or you can masquerade as them)

Code: Select all

host_notification_options d,u,r,f,s
service_notification_options w,u,c,r,f,s

As for the profile, you can also generate a profile manually using the script at /usr/local/nagiosxi/html/includes/components/profile/getprofile.sh

That should generate a profile in /usr/local/nagiosxi/var/components/ which you can get off the server with an application such as FileZilla.

After you PM the profile, please update this thread. Updating this thread is the only way for it to show back up on our dashboard (you can also just attach it to the post if you like).

UPDATE: profile shared with techs