Nagios Global Event Handler and Netcool

[cmlytle]

Hello,

My team is currently getting Nagios XI setup in our environment. We have a script that was provided to us from Netcool that sends them alerts that are then translated and a ticket is created with ServiceNow. This script is setup in the Global Event Handlers. The issue I am running into is that even with me setting up Service Dependencies, and even sometimes with Scheduled Downtime we still get alerts.

I have tried a couple different things of making the primary service happen more often than the dependent services but that still doesn't seem to do it. With the Scheduled Downtime it seems to be occasional that it works. I am not sure whether this is the script that we received from Netcool that is still triggering even with the settings I had setup, or if I have mis-configured something.

Does anyone have any ideas on what I can look at, or what info I can provide to this thread to have someone help?

[npolovenko]

Hello, @cmlytle. Global event handlers by default run during scheduled downtime. You can prevent them from running during downtime by checking the "Don't Run in Downtime" box.
In XI web interface go to the Admin menu, then click on "Manage components" in the left column. Click on edit settings.

Global event handlers are executed on each state change for every host and service. For example, if a host goes from Warning to Critical, or from OK to Warning. I'm not sure how setting up service dependencies would prevent global event handlers from running.

Let me know if checking the downtime option helps with your issue.

[cmlytle]

Hello @npolovenko,

I have tried checking that box and it still runs some of the things during downtime, but some of them are working as expected now.

With the service dependencies that is unfortunate. I guess I will need to go back and look for another way we can get this setup.

[npolovenko]

@cmlytle, Many users add similar ticket generating scripts as notification commands. You can create a new contact in XI and call it "Netcool", assign the event handler under notification commands for this contact, select notification types(=states) when you want this script to be triggered. Then assign the new contact to each service and host via bulk modifications tool, or assign it to templates used by hosts and services and they will inherit this contact as well.

[cmlytle]

That might be an option. When I check on the user I am not finding an option to setup and event handler for the notifications for users. I have looked in both XI and the CCM. Can you give me the location of that menu options?

[npolovenko]

@cmlytle, I was referring to creating a contact in the CCM, not a user.

Untitled.png

And in host notification commands add your event handler script. And do the same for the service notification commands.
This way when a service or host is going to hit a notification state, Nagios will call the event handler script.
This allows you to have a better control over when the event handler script will be called, how often, on what service/host state and so on.

[cmlytle]

Ok, I got that setup but something I need to look at now is the script pulls %host% and other variables. I have put this in the Command just like I did in the Global Event Handler but doesn't seem to return the information correctly. Any ideas?

Below is screenshot of Command Management

Screenshot1.png

Below is the log output from the handler, it should list the host and the service, etc

Screenshot2.png

[cmlytle]

I actually just resolved it. I have to replace the "%host%", etc with the Standard Macros found at: https://assets.nagios.com/downloads/nag ... olist.html

[npolovenko]

@cmlytle, Glad you figured it out. Does the event handler work as expected now? Are we good to lock this thread?

[cmlytle]

Yes, I think I have gotten all resolved. It is logging the output I am wanting I am testing some things with the service dependencies but waiting overnight for that. I would say go ahead and lock the thread. If I have any further issues I will open another thread.