I get 10 emails notifications for some alerts

[typer100]

OpsGenie opens tickets... It doesn't send emails. Emails are sent by Nagios.
I've disabled the Opsgenie part and my inbox is still getting many emails for the same alert.

[lmiltchev]

We didn't find multiple emails sent to the same contact in your screenshot, so in order to troubleshoot the issue, we would need to start somewhere. Who is the contact that received multiple notifications? Is this still happening or it was a temporary glitch? If it is happening now, can you show us a recent screenshot of the Notifications report, that includes the contact in question?

[typer100]

A couple screen shots.
Host notification report and inbox screenshot for [email protected]

[lmiltchev]

The contact that is listed on the notifications report (support.aix) is NOT present in the profile. Did you delete it or rename it after taking the screenshot?

The "[email protected]" email is set on two of the contacts that are added to the "check_disk" service on the "sxpvio0118" host via contactgroups. According to the configs, nagios should be sending only two emails to "[email protected]"... Are you using distribution lists?

[typer100]

Tried a different email to see if there's anything wrong with that contact or the mailbox.
I don't receive the email to that new contact [email protected]
I see the notification in the report. I see that it's a HARD alert.
But no email. Where can I trace the mailing in the logs?

[lmiltchev]

This is a new contact. It doesn't exist in your old profile. We don't know how it is configured, so it is impossible to know why this contact hasn't received these emails.

Having said that, here's a general guide on troubleshooting notifications in Nagios XI:

https://support.nagios.com/kb/article/n ... ms-36.html
Go through all of the steps to verify that you haven't overlooked something.

I see the notification in the report. I see that it's a HARD alert.
But no email. Where can I trace the mailing in the logs?

If you are using sendmail, you can look into the /var/log/maillog for clues. If you are using SMTP, the you may need to troubleshoot the phpmailer. For more info on the topic, check the KB article below:

https://support.nagios.com/kb/article/p ... g-820.html

You can also start a running tail on the eventman.log, and redirect the output to a file, which you can review later.

Code: Select all

tail -f /usr/local/nagiosxi/var/eventman.log >> /tmp/notifications.txt

Let the tail command run for some time, until a notification is sent to the contact, then stop the tail (ctrl + c), and open the /tmp/notifications.txt file in a text editor. Check for issues with notifications.

[typer100]

It's not a new contact, I've just changed the email address to see if it was a an alias issue.
It was [email protected] before

The phpmailer debug seems to give more info only in the test email page in XI. I don't see more in in /usr/local/nagiosxi/tmp/phpmailer.log

I see the notification in /usr/local/nagiosxi/var/eventman.log.
SOFT and HARD after 5 attemps, But there's nothing in the /usr/local/nagiosxi/tmp/phpmailer.log

The test email works fine. But not the alert for that specifici contact.

PROCESS EVENT: ID=41155419, SOURCE=2, TYPE=1, TIME=2020-03-23 13:43:51
*** GLOBAL HANDLER...
Array
(
[event_id] => 41155419
[event_source] => 2
[event_type] => 1
[event_time] => 2020-03-23 13:43:51
[event_meta] => Array
(
[handler-type] => service
[host] => sxpnim0015
[service] => Disk Usage on /tmp
[hostaddress] => 172.26.14.21
[hoststate] => UP
[hoststateid] => 0
[hosteventid] => 6405014
[hostproblemid] => 0
[servicestate] => CRITICAL
[servicestateid] => 2
[lastservicestate] => CRITICAL
[lastservicestateid] => 2
[servicestatetype] => HARD
[currentattempt] => 5
[maxattempts] => 5
[serviceeventid] => 6466721
[serviceproblemid] => 2935129
[serviceoutput] => CRITICAL: Used disk space was 95.90 % (Used: 772.01 MB, Free: 33.30 MB, Total: 805.31 MB)
[longserviceoutput] =>
[servicedowntime] => 0
)

[lmiltchev]

According to the contacts.cfg file, the only contact that is using the "[email protected]" email is "gaujf010". The way this contact is configured, it would be receiving ONLY notifications for services in UNKNOWN state.

host_notification_options n
service_notification_options u

The "n" in host_notification_options means, none of the options is selected (no notifications will be sent for hosts)
The "u" in service_notification_option means, the contact will be notified on UNKNOWN service states

Contact - service notification options

This directive is used to define the service states for which notifications can be sent out to this contact. Valid options are a combination of one or more of the following:
w = notify on WARNING service states,
u = notify on UNKNOWN service states,
c = notify on CRITICAL service states,
r = notify on service recoveries (OK states), and
f = notify when the host starts and stops flapping, and
s = send notifications when host or service scheduled downtime starts and ends.
If you specify n (none) as an option, the contact will not receive any type of host notifications.

Parameter name: service_notification_options
Required: yes

You can go to the CCM > Contacts > gaujf010 > Edit > Alert Settings, and check to see what kind of host/service notification option you have set at the moment. Change them if needed.

Also, log in as the "gaujf010" user, click on the username in the upper right corner, and double check the Notification Options to make sure you don't have notifications disabled (for this contact and/or specific types of alerts).