Incorrect search functionality in the State History Report

[smersh]

Hello,
I have the following issue I believe is a bug. Please check.

My configuration has many services utilizing check_nrpe plugin.
In the State History Report I can see "UNKNOWN" states due to several reason:

1. When the host is unreachable or down, check_nrpe produces "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." output
2. When something is wrong with the service, but the host is still reachable, check_nrpe produces "NRPE: Unable to read output" output.
(These 1 and 2 are not Nagios problem, they are indicating problems with the services. Case 2 is when the nrpe daemon can not get data properly; again, this is not Nagios problem, in my case it's the hardware not responding)

Now the problem.
When searching for all "UNKNOWN" states, second case could never be found in the search results. It's there with the empty search field together with all other states, however.

Regards
Nick Jandieri.

[kyang]

Hello,

What version of Nagios XI and what OS are you on?

So you are saying that the state history report isn't showing the "NRPE: Unable to read output"?

Please provide us with your query in which you are using to search for "UNKNOWN" under state history report.

Capture.PNG

Can you show us screenshots showing this?

[smersh]

Hello,
Please check the following screenshots:
1.

NRPE.PNG

In this screenshot the search string contains "NRPE". There are 2 types of events filtered: "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." and "NRPE: Unable to read output". Both type of events result an UNKNOWN state.

2.

UNKNOWN.PNG

With "UNKNOWN" in the search string, only "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." events are shown. "NRPE: Unable to read output" events are not displayed.

My system is running Nagios XI 5.4.12 (trial license) under CentOS 7.

Regards!
Nick.

[smersh]

Hello,
I believe the answer is simple: the search is performed on the "Information" field and does not care about the "State" field. At least this explains everything.

Nick

[kyang]

Thanks for showing me some examples.

I think the search is going towards either the host name, service name or Information.

Take a look at some of my examples.

Capture.PNG

If I type in a hostname, it gives all of its examples.

Capture.PNG