After Acknowlegement and Disable of alert -- Alert Appears

[scottwilkerson]

Please find the Screen shots of Operation Center and acknowledgement of the alarm in SS but still it keep on fluctuating with duration : 151days or 149days.

the host/service at 151 days is different than the host/service at 149 days.

Also, the host/service at 151 days in the last message is no longer acknowledged, something keeps removing the acknowledgement, it looks like at least 4 time just on 6/26 from the screen shot.

Every time the acknowledgement is removed it is going to reappear on the operation center page

also for the screenshot of eth1 Status, I can see you just acknowledged the problem before taking the screenshot.

[ericssonvietnam]

FE.PNG

3_BE.PNG

2_BE.PNG

please find the operation center SS and service SS i acknowledge. Still it reappears.

Can we make it re-appears with new duration, i mean fresh time 00 mins.

[scottwilkerson]

In these bottom 2 images, the services are not CURRENTLY acknowledged. They have comments when they were acknowledged, but they currently are not

[ericssonvietnam]

if they are acknowledged even before then it shouldn't be reflect back in operation window.

[scottwilkerson]

if they are acknowledged even before then it shouldn't be reflect back in operation window.

Not if something is removing the acknowledgement.

Someone or something (script) is removing the acknowledgements from these.

Which is why under the Quick Actions you see
"Acknowledge this problem"

And under the Next Check: you do not see "Service Notes: Service problem has been acknowledged"

ack.PNG

[ericssonvietnam]

so how we can acknowledged it permanently. Can you suggest how to track with script is doing so.

for few alerts it getting re-appear for rest it fine.

[scottwilkerson]

First I would look here
Admin -> Audit Log

Search upper right for REMOVE_SVC_ACKNOWLEDGEMENT

If it is a user it will display here, something like

remove ack.PNG

If it is a script someone wrote, that would be hard to find but you may find it in the Reports Event Log
but this will not show who or what did it

[ericssonvietnam]

please find the audit file.

ack_audit.PNG

ack_audit_further.PNG

[scottwilkerson]

You may need to change the time period in the audit log to look back several days.

Also

If it is a script someone wrote, that would be hard to find but you may find it in the Reports Event Log
but this will not show who or what did it

[scottwilkerson]

One other possibility to this weird behavior that my colleague and I were just discussing was if your Nagios server had multiple parent processes.

Can you post the results of the following to rule that out

Code: Select all

ps -ef|grep nagios.cfg