XI 2014 service check detail output truncated

[jwelch]

Under 2012 the service check details were limited to 4k so I learned to live with that. Now that I've upgraded to 2014 it looks like the detail data is being truncated at <1k. Is there a config setting to control this? I can't remember if I had to change a setting in the older versions.
Note: This is the Service Detail page in the GUI, not notification email, and I see this shorter truncated output in both active and passive checks.

[jwelch]

hmmm...maybe the way nagios handles the output has changed somewhat. It's hard to find good documentation on exactly how to format the check output, perfromance data, and extra output. Ideally, I'd like to format it as:
line1: status ouput
line2: | performance data
line3+: long status output (multiline).

I'll have to check some scripts, but I *think* what I've been doing is:
line1: statusoutput | performance data
line2+: long status output

or if no performance data:
line1: statusoutput
line2+:long status output

but I'll have to check to make sure...

[abrist]

Well, NRPE has always been truncated at 1k - but that is an nrpe restriction.

In XI, the database field types dictate the maximum characters. You can run the following sql to increase those field types:

Code: Select all

echo "use nagios;alter table nagios_servicestatus modify output varchar(65535) not null;alter table nagios_servicestatus modify long_output varchar(65535) not null;alter table nagios_servicestatus modify perfdata varchar(65535) not null;" | mysql -pnagiosxi

And then check the changed types with:

Code: Select all

echo "use nagios;desc nagios_servicestatus" | mysql -pnagiosxi | grep "output\|perfdata"

[jwelch]

Looking at the current settings, the long output is greater than I'm used to (4096) in the 2012 version.

output varchar(255) NO
long_output varchar(8192) NO
perfdata varchar(255) NO

For passive checks, it's much more efficient for me to write the data for many hosts to a single file
in the checkresults directory. The check output is on a line that looks like:
output=$sum."\\n"."$line1<br />"."$line2<br />"....etc
That worked in the older versions, but now everything is being lumped into the regular output and nothing to long output.
I can't find a reference for the format of the checkresults files. I spent a lot of time deciphering the checkresults file format
a couple of years ago, but now I don't see it being used except by my scripts

For active checks, maybe it's just the way I'm presenting the output. Has something changed in core 4.x?
I'm assuming the output should look like:
statusoutput | perfdata
longoutput

or

statusoutput
longoutput

dpending on whether or not there is performance data.

[abrist]

Looking at the current settings, the long output is greater than I'm used to (4096) in the 2012 version.

I checked the other day, and the XI frontend only uses the "output" field. So I would suggest updating that column in the very least.

[jwelch]

Doing some more checks, it looks like it's just the passive checks where I create and submit checkresult files directly into the checkresults directory. The only field I know of in the checkresults file for output is the 'output=....' one. My script puts "\\n" between the summary and detail output (no performance results for F5 BigIP results). This used to allow nagios to break the output into statusoutput and longstatusoutput, but doesn't seem to work in 2014 (core 4.05?). I get everything in the statusoutput, which if I expanded would take way too much realestate on the main screen.
Is there any documentation on the checkresults file format?

[abrist]

The behavior should not have changed, but the increase of the db output filed size will effect the main tables. Long output should still be displayed on the object details view.

[jwelch]

Seems it's just passive services. So the specific behavior is that if I create a file that contains:

Code: Select all

### Nagios Service Check Result ###
host_name=testhost
service_description=BigIP
check_type=1
scheduled_check=0
rescheule_check=0
latency=1.0
start_time=1400701380.0
finish_time=1400701390.0
return_code=0
output=No PrObLeMs FoUnD\nThis is line two. This is line three.

and then save this file in /usr/local/nagios/var/spol/checkresults/ctest12
then touch /usr/local/nagios/var/spool/checkresults/ctest12.ok
when the file is processed, it *used* to display the status as "No PrObLeMs FoUnD" and the
long status output as:
This is line two.
This is line three.

since the upgrade to nagios 4 and XI 2014, the status information page shows the service
status as: "No PrObLeMs FoUnD\nThis is line two. This is line three." with no multiline data.
so it's no longer using the \n to delimit the short and long status output. Any idea where the code is
that processes the checkresults files? I could look and see if I can figure out what it's doing.

[sreinhardt]

That would almost definitely be related to core 4, and potentially a bug that we have noticed with the upgrade. It seems that many non-actively processed checks are doing very similar things to what you have here. Offhand I am not certain which core source file would contain the check reaping functionality though, sorry.

[jwelch]

As a workaround for the truncation of detail data, I had already put code in to write the details to a file and add a link to them. Since this core issue, I've noticed that the 'Operations Center' view does not render the status line as html. If I got to 'Open Service Problems' I see the link, but going to the 'Operations Center' page I see the html.

OpenServiceProblems.png

OperationsCenter.png