Notifications not sending, test email works

[DavidRanken]

The notifications for alerts stopped sending via email as of 11/27/2018 we have not been receiving notifications. The test email from Nagios XI works though. Also, we added back text and tried that, it works for test but not sending actual notifications too. There were no updates to the system at this time or the mail server. I've followed this document https://support.nagios.com/kb/article/n ... ms-36.html with no success. In Nagios XI browser going to reports > notifications shows everything correctly and the entries are in there even though they are not being received. The mail server doesnt show the failed attempts at all. On the test emails it shows delivered and received. I've updated Nagios XI to the latest release 1/3/2019, 5.5.8 its a vmware ova that's been upgraded.

[tgriep]

Can you login to the XI GUI and go to the Admin > Manage Email Settings menu, screen capture that and post it here so we can view the settings?

Depending on the how the Mail Method is set, there are 2 log files that you can look at.

Code: Select all

/usr/local/nagiosxi/tmp/phpmailer.log
/var/log/maillog

Can you look at them while the server is trying to send a notification to see if there are any errors and post them here?

[DavidRanken]

The settings are attached along with the results from ssh. I was unable to run the commands you provided.

[tgriep]

Those files are not applications so they cannot be ran.

To view then, you can use an editor, or applications called grep, cat, more, less, etc....
This link has some basic commands you can use for examples.
https://www.faqforge.com/linux/distribu ... the-shell/

You have setup the server to use a SMTP server so this is the log file we need to look at.

Code: Select all

/usr/local/nagiosxi/tmp/phpmailer.log

First lets enable debugging by logging in to the XI GUI and go to the Admin > Manage Email Settings menu.
Check the Debug Log: box and update the settings.

Login to the server in a root shell and run this command to view the bottom of the log file which will print new entries to the screen.

Code: Select all

tail -f /usr/local/nagiosxi/tmp/phpmailer.log

Go back to the XI GUI and send a test message and any errors in the screen showing the tail data, post them here.

But the first thing to do is to talk to your email administrator to see if the security settings have changed for the mail server and if so, update them in the XI GUI.

[DavidRanken]

Thanks. I've tried the command and received the attached. It's showing our mail server wrong on ssh though its says .local that should be .edu can I forcefully change that? I'm the administrator on mail and nothing changed and no windows server updates were done around the time of this starting to fail. The test emails sent from Nagios do go through it stopped only notifications.

When the ssh was cancelled this message was received: You have mail in /var/spool/mail/root

[tgriep]

It could be that the name of the email server in the XI GUI is cached and is not matching to the name of the server that the emails are getting sent to.
Do this, login to the XI GUI and go to the Manage Email Settings menu.
Delete the server name from the field and update the settings.
Then put back the valid server name in that field and update the settings.

See if the emails work this time and validate the system is sending to the correct server using the tail command from before.

[DavidRanken]

That did not change the log server. I also noticed that deleted users were trying to be sent out emails from Reporting>Notifications GUI log screen. It seems like the GUI is just not pushing over the commands.

[tgriep]

It sounds like it could be a corrupted SQL database entry that is keeping the changes from getting updated.

To stop the processes and repair the database, run the following as root.

Code: Select all

service nagios stop
service ndo2db stop
killall -9
mysqlcheck -f -r -u root -pnagiosxi --all-databases --use_frm
service mysqld restart
service ndo2db start
service nagios start

Let the system run for 5 to 10 minutes and save the email server name again and see if the notifications stop sending to the deleted users.

If not, can you get your Nagios XI System Profile and either PM it to me or post it here so we can check it for any errors?
To get your system profile. Login to the Nagios XI GUI using a web browser.
Click the "Admin" > "System Profile" Menu
Click the "Download Profile" button
Save the profile.zip file and upload it to the ticket by clicking the "choose item" link at the bottom of the menu.

[tgriep]

Thanks for the profile.
It looks like the email server name does end in .edu so it should be sending the emails there.

Did you run this command and verify that it is sending to the correct server ?

Code: Select all

tail -f /usr/local/nagiosxi/tmp/phpmailer.log

I only see two other user account setup on the server besides the nagiosadmin account, and that there are a few contacts setup on the server as well.
Without knowing the names of the accounts, I am guessing that the emails are coming from the contacts that are left on the server and to remove then, go to the Core Config Manager > Contacts menu and you will see the contacts that are on the server.

In the menu, you can click on the Relationships icon (The right side on the menu) and that will show you which objects that the Contacts are setup in.
From there, you can remove the Contact from those Hosts or Services and then you can remove the contact as well and that should stop the email notifications.

[DavidRanken]

It's working!

This command is still showing it as .local on ssh and errors as before: tail -f /usr/local/nagiosxi/tmp/phpmailer.log

The deleted users were in the contacts and had a handful of relationships that needed to be manually removed. After that I did a test. They were successfully deleted. This also fixed the issue we were having. Deleting the users only from manager users the first time around and not also contacts was the problem. Notifications are now being sent via email again.

Thank you for working through this with me.