Customize Nagios XI Notification and Escalation

[westernuniv]

Hi, I would like to implement the following notification/escalation procedure for all the host and services

1. Notification / escalation interval = 30 mins
2. Non- critical alerts (Unknown, Unreachable, Warning), send only one notification and stop re-notification
3. Critical alerts
a. 1st notification: Email to the contact / contact group defined for the host/services
b. 2nd Notification: Email & Page to the contact / contact group defined for the host/services
c. 3rd Notification: I would like to escalate to Managers
In this case , I need to Email & Page to the contact / contact group defined for the host/services + Page to the managers. And it will be repeated every 30 mins till the issue acknowledged or resolved.


1. Which nagios core object setting need to be changed to make the default notification interval to 30 mins? Do the entire host and service template definition notification interval will need to be changed too?

2. How I can implement the item 2, which is to stop notification after 1st one only for non-critical alerts?

3. For item 3.b , I believe I should use escalation method. I have several hosts, services and contact groups. Some host/service groups have multiple contact groups. In this case I still need to make use of 1st notification contact/contact group email and in addition to that I’ll need to page them too. Do I need to create many combinations of escalation methods for this? Is there any other way to do that?

4. For item 3.c again I need to make use of the contacts of Notification 2 + Send page to manager. How this can be achieved? Again another set of escalation methods?

I know this is really complex environment and I really appreciate if you could give me some suggestions to do that.

Thanks

[scottwilkerson]

1. Which nagios core object setting need to be changed to make the default notification interval to 30 mins? Do the entire host and service template definition notification interval will need to be changed too?

notification_interval and it only needs to be changed in the host/service definitions. If you have 2012 you can use the Bulk Modifications tool (CCM -> Tools -> Bulk Modifications) to to this enmasse.

2. How I can implement the item 2, which is to stop notification after 1st one only for non-critical alerts?

I would use the Escalation wizard and set the same contacts as in the host/services for lvl_1 and then you can choose only the w c

3. For item 3.b , I believe I should use escalation method. I have several hosts, services and contact groups. Some host/service groups have multiple contact groups. In this case I still need to make use of 1st notification contact/contact group email and in addition to that I’ll need to page them too. Do I need to create many combinations of escalation methods for this? Is there any other way to do that?

Yes, again I would use the Escalation wizard..

4. For item 3.c again I need to make use of the contacts of Notification 2 + Send page to manager. How this can be achieved? Again another set of escalation methods?

Again, Escalation wizard but the only caveat here is it is going to send to whatever notification method the manager has setup.

Configure -> CCM -> Tools -> Escalation wizard

[westernuniv]

Thanks so much.
1. I did use the bulk modification tool to change the value to 30. I believe the default value of the notification interval is 60, if not defined. Is there any want to change the default value, so that the new host and services will have the value 30 if not defined?

2. If the service prob was escalated, will it notify to the escalation parties when there is a recovery?
Thanks

[scottwilkerson]

1. There is no way to set this at this time, but it would be a good item for a feature request. Please feel free to request it on our tracker
http://tracker.nagios.com

2. Yes, if you check the r option when setting up the escalations they will be notified of recoveries also.

[westernuniv]

Thanks so much, I’ll add the new FR.

I can select the host_group for the host escalation; I assign the entire hosts into a group and used this group to stop “unreachable” notification after 1st one.
But I couldn’t do the same for service “warning” . I need to select the individual services and ended up with each service has its own escalation. I’m having more than 1000 services now and each service has 2 level of escalation, then I’ll have to maintain about 2000 escalations methods. Any other ways to implement the escalation for service group?

Also I would like to confirm the behavior, if a host is down; I do not see any service notifications for that specific host. Only I saw the host down notification, is it the expected behavior? In our environment sometimes host and services managed by different teams, I’m wondering whether I need to all the teams as host notification contact so that the service team will get notified when a host and services went down?

Thanks

[scottwilkerson]

But I couldn’t do the same for service “warning” .

There is no warning state for hosts, just up down and unreachable.

I’m having more than 1000 services now and each service has 2 level of escalation, then I’ll have to maintain about 2000 escalations methods. Any other ways to implement the escalation for service group?

If many of the service_descriptions are the same, you can do it the old fashioned way and set them up with CCM -> Service escalations.

You can select multiple hosts for the services, one caveat is that ALL of the hosts selected must have ALL of the services selected.

Also I would like to confirm the behavior, if a host is down; I do not see any service notifications for that specific host. Only I saw the host down notification, is it the expected behavior? In our environment sometimes host and services managed by different teams, I’m wondering whether I need to all the teams as host notification contact so that the service team will get notified when a host and services went down?

This is expected behavior.

[westernuniv]

Thanks for the detail info