How to delay alerts using the check_ping command?

[JJMerrill]

I'm a Nagios newbie looking for some help. I've inherited the management of a relatively old install of Nagios Core 3.4.4, and a collection of nodes that use the check_ping command for alert notifications. Ultimately, it would be great if these alerts would only fire if the condition has been true for 3 minutes. I'm having a hard time figuring out how use parameters such as the first_notification_delay to accomplish this, or if that's the best approach.

Each node's .cfg file has a "define host" and "define service" stanza set up like this:

Code: Select all

define host{
        use             generic-switch-comm             
        host_name       Test   
        alias           Test   
        address         192.168.40.155        
        hostgroups      Test_Group     
        contact_groups  Test_Contact          
        }

define service{
        use                     generic-service
        host_name               Test
        service_description     PING
        check_command           check_ping!200.0,20%!600.0,60%
        max_check_attempts      1
        normal_check_interval   1
        retry_check_interval    1
        contact_groups          Test_Contact
}

I'm unsure if the values for the host and service are first inherited from /etc/nagios/objects/templates.cfg, and then are then overridden with the values given in each host's .cfg file. Either way, I've tinkered around with changing the values on max_check_attempts, retry_check_interval, etc, but I'm failing to understand the best way to make the ping alerts only fire if the condition has been true for 3 minutes.

I'd also like to preserve the email format that the alerts currently come through in, which has a nice "State Duration" field and other information.



If I change the values on the service notifications, such as setting "max_check_attempts" 3, the format instead changes to this:



I'm less concerned with this part, and would still be glad to get the notifications to delay to 3 minutes even if the email format changed. Thanks in advance for any guidance, especially on such an older version.

[benjaminsmith]

Hi @JJMerrill

Welcome to Nagios and the support forum! There's a lot to take in at first, but once you learn your way around the configuration settings, it's very flexible and powerful.

Here's a link to the Nagios 3 documentation:
https://library.nagios.com/library/prod ... e/manuals/

Specifically for information on those settings, see the Nagios Core Object Definitions doc:
https://assets.nagios.com/downloads/nag ... tions.html

The normal check interval is the time between checks. Typically, you'll set this to every 5 minutes for a ping test as that is usually sufficient. Once the check has returned a non-ok state, the retry interval and the max check attempts determine how many times to check and how often before putting the host or service into a hard non-ok state ( and generating a notification or alert). I would set those values as follows:

Code: Select all

 max_check_attempts      3
 normal_check_interval   5
 retry_check_interval    1

The first notification delay allows you to set a time delay before sending out the initial notification. Also before sure to verify /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg configuration and then restart Nagios service nagios restart after making any changes to your configurations.

[JJMerrill]

@benjaminsmith

Thanks for taking the time to respond, especially working with such an older Nagios version. Your check interval settings worked, and I've been experimenting with them a bit. I've found that it takes about 12 minutes for an alert to fire using these conditions:

Code: Select all

max_check_attempts      3
normal_check_interval   2
retry_check_interval    1

I think I'm misunderstanding the logic, or there's some kind of configuration problem on my end. My interpretation of the above settings: check the host every 2 minutes. If a problem is found, try again in 1 minute. If the problem is still found, try again in 1 more minute, and then send an alert. 2 minutes + 1 minute + 1 minute, for a total of 3 check attempts.

Next, I'm going to try using the settings below so that if a problem is discovered with the host, try again in 1 minute, and then send an alert if the problem still persists.

Code: Select all

max_check_attempts      2
normal_check_interval   1
retry_check_interval    1

Edit: Figured out why I had that 12 minute result earlier. The "generic-switch-comm" host template in my first post has a max_check_attempts 10 defined in its template. This was resulting in the host check trying 10 times before returning the final status.

[benjaminsmith]

Hi @JJMerrill,

Figured out why I had that 12 minute result earlier. The "generic-switch-comm" host template in my first post has a max_check_attempts 10 defined in its template. This was resulting in the host check trying 10 times before returning the final status.

Sounds like you figured it out. Did you have any other questions or is ok to close this thread.

[JJMerrill]

I'm all set, thanks for the guidance.

[benjaminsmith]

Hi @JJMerrill,

Your welcome. Thank you for using the Nagios Support Forum.