Sending Host Down Notifications from Nagios xi

[mohan23]

Hi Team,

nagiosxi is sending host down notifications immediately when nagios found that particular host is down . If Host is down for more that 24 hours continuously, I want nagiosxi to send one more event every 24 hours once.

In our current environment we are sending events from nagios to Event management tool in the form of SNMP traps.

Can someone help me to understand on what needs to be done on nagios end , in order to send one more event for every 24 hours if host is down for more than 24 hours or host check status is in same critical state continuosly for more than 24 hours and when service check status is in same state continuously for more than 24 hours.

Regards,
Mohan Gandhi

[rexconsulting]

Hi Mohan,

The default check_interval is 60 minutes. So you should be getting a notification every hour after the first notification for any hosts that remain down. I would think you could just change this to 1440 to make it one notification every 24 hours.

But for any customized logic for notifications or actions to be taken that doesn't fit the normal XI behavior of notification after "max_check_attempts", you should look at event handlers.

[ssax]

Thanks rexconsulting!

Additionally, you could also use a host/service escalation to do it, please see here for more info:

https://assets.nagios.com/downloads/nag ... ations.pdf

Let us know if you have any questions.

Thank you

[mohan23]

Hello Everyone,

Sorry for the confusion, my intend is not sending email notifications from nagiosxi for host down . In our environment nagios xi is sending all events to BPPM(Event Management Tool) for ticketing purpose, now we are seeing that nagios xi is sending events to BPPM only when host is down initially and not after that, my requirement is If a particular host is down for more than 24 hours, I want to send one more event for every 24 hours once from nagios xi to BPPM .

[ssax]

You would still use the same functionality that rexconsulting and I listed, the contact would just have a different host/service notification command.

Are you sending to BPPM through an event handler or through the standard host/service notification commands by using a specific contact?

[mohan23]

We are sending events in the from SNMP traps to BPPM.

[ssax]

Ok, after talking with another tech about this you have two options:

1. Setup a host/service escalation that has a contact that has a host/service notification command that will send the trap to your event management tool.

2. Setup an event handler that would check the last state change, the last notification time, etc and then if it meets the criteria send the trap to your event management tool.

The problem with option #2 is that the event handler would run every single time the check occurs (for all hosts/service) which would cause a lot more overhead than using option #1.

We recommend you use option #1, you can use this guide for a similar setup, you would just use a host/service escalation set for 24 hours so that it would do what you want instead of defining it directly on the host/service:

http://askaralikhan.blogspot.com/2010/0 ... agios.html

See here for more information on escalations:

https://assets.nagios.com/downloads/nag ... ations.pdf

Let us know if you have any questions.

Thank you

[mohan23]

oops.. Just got to know we are sending events to BPPM through event handler commands defined in commands.cfg and below are the commands defined.

define command {
command_name xi_service_event_handler
command_line /usr/bin/php /usr/local/nagiosxi/scripts/handle_nagioscore_event.php --handler-type=service --host="$HOSTNAME$" --service="$SERVICEDESC$" --hostaddress="$HOSTADDRESS$" --hoststate=$HOSTSTATE$ --hoststateid=$HOSTSTATEID$ --hosteventid=$HOSTEVENTID$ --hostproblemid=$HOSTPROBLEMID$ --servicestate=$SERVICESTATE$ --servicestateid=$SERVICESTATEID$ --lastservicestate=$LASTSERVICESTATE$ --lastservicestateid=$LASTSERVICESTATEID$ --servicestatetype=$SERVICESTATETYPE$ --currentattempt=$SERVICEATTEMPT$ --maxattempts=$MAXSERVICEATTEMPTS$ --serviceeventid=$SERVICEEVENTID$ --serviceproblemid=$SERVICEPROBLEMID$ --serviceoutput="$SERVICEOUTPUT$" --longserviceoutput="$LONGSERVICEOUTPUT$" --servicedowntime=$SERVICEDOWNTIME$
}

define command {
command_name xi_service_notification_handler
command_line /usr/bin/php /usr/local/nagiosxi/scripts/handle_nagioscore_notification.php --notification-type=service --contact="$CONTACTNAME$" --contactemail="$CONTACTEMAIL$" --type=$NOTIFICATIONTYPE$ --escalated="$NOTIFICATIONISESCALATED$" --author="$NOTIFICATIONAUTHOR$" --comments="$NOTIFICATIONCOMMENT$" --host="$HOSTNAME$" --hostaddress="$HOSTADDRESS$" --hostalias="$HOSTALIAS$" --hostdisplayname="$HOSTDISPLAYNAME$" --service="$SERVICEDESC$" --hoststate=$HOSTSTATE$ --hoststateid=$HOSTSTATEID$ --servicestate=$SERVICESTATE$ --servicestateid=$SERVICESTATEID$ --lastservicestate=$LASTSERVICESTATE$ --lastservicestateid=$LASTSERVICESTATEID$ --servicestatetype=$SERVICESTATETYPE$ --currentattempt=$SERVICEATTEMPT$ --maxattempts=$MAXSERVICEATTEMPTS$ --serviceeventid=$SERVICEEVENTID$ --serviceproblemid=$SERVICEPROBLEMID$ --serviceoutput="$SERVICEOUTPUT$" --longserviceoutput="$LONGSERVICEOUTPUT$" --datetime="$LONGDATETIME$"
}

Can you help me on below:

Setup an event handler that would check the last state change, the last notification time, etc and then if it meets the criteria send the trap to your event management tool.

[lmiltchev]

Can you help me on below:

Setup an event handler that would check the last state change, the last notification time, etc and then if it meets the criteria send the trap to your event management tool.

This would be qualified as a "custom development" and it is out of scope for Nagios support.

You could review our official documentation on event handlers here:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
and setup a custom event handler that would work in your environment or you could contact our sales team at [email protected], and request a quote for a "custom development".