Implement deduplication in Nagios Core

[sandeepatil]

Hi Team Need you help,

Looking for configuration of deduplication.

We are using passive check.

scenario :

After alarm triggered for DOWN, don't want trigger alarm until status change.

If service down for 2 hours and service status check is every 5 min, only require 1 service DOWN alarm and 1 service UP when status change and require tally in alarm mail how many times status checked.

Service Defination Templete :

Code: Select all

define service {
       name                                     core_generic_service
       use                                      service-pnp
       is_volatile                              0
       max_check_attempts                       3
       check_interval                           10
       retry_interval                           2
       active_checks_enabled                    0
       passive_checks_enabled                   1
       check_period                             24x7
       parallelize_check                        1
       obsess_over_service                      1
       check_freshness                          0
       event_handler_enabled                    1
       flap_detection_enabled                   0
       process_perf_data                        1
       retain_status_information                1
       retain_nonstatus_information             1
       notification_interval                    60
       notification_period                      24x7
       notification_options                     w,u,c,r
       notifications_enabled                    1
       contact_groups                           admins
       register                                 0
       }

define service {
       name                                 core_passive_service
       service_description                  Passive Service
       use                                  core_generic_service
       check_command                        core_check_dummy!0!"No data received yet."!!!!!!
       is_volatile                          1
       initial_state                        o
       max_check_attempts                   1
       active_checks_enabled                0
       passive_checks_enabled               1
       flap_detection_enabled               0
       stalking_options                     o,w,c,u
       register                             0
}

[gormank]

I think if you get rid of notification_interval it'll only notify once. Then for recovery make sure notification_options is set the way you want.

[sandeepatil]

If I am understand correct, you mean need below line to change ?

notification_interval 0
notification_options r

[gormank]

I think you can leave the interval undefined and the other already has r defined. An interval of 60 means notify every 60 minutes until the alert is cleared or acked, which you said you don't want.

[pomtomm]

There are several ways to achieve this.

"notification_interval 0" will work fine if this is your only notification configuration. Just make sure there are no other host / service notifications which might interfere. "is_volatile" needs to be set to 0, IIRC.

Here's one example using escalations: we have both mail and SMS alerts. Notification Mails should be sent only once to prevent spam (and SMS notifications should be sent every 5 minutes).

All active service templates are using "normal_check_interval 5" (interval length 60 => every 5 minutes).

Mail escalations have both "first_notification" and "last_notification" set to 1", with a notification_interval greater than the normal_check_interval:

Code: Select all

#-----------------------------------------------------------------------------------------------------
# Service escalation definiton for 'baz' on 'foo.bar' (Mail)
define serviceescalation{
        host_name                foo.bar
        service_description      baz
        first_notification       1
        last_notification        1
        notification_interval    6
        contact_groups           cg-duty-mail
}