Multi-Tenancy Granularity

[scottwilkerson]

Are you saying that by default nagios adds host contacts/contactgroups to services even if you have local settings? (which I do in this case)

For viewing, yes. If you are a contact for a host, you can see all of the services on that host

[jwelch]

Ok, so the expected behavior for contacts and contact groups:

Services:
default to positive inheritance from the host

otherwise use the selected options below:

Code: Select all

  Contactgroup Options
  -----------------------------------------------------
  +                  positive inheritance    (same as standard for host contact group settings)
  null               no inheritance            (verified that this does override the host contact group settings)
  standard           standard inheritance    (I have not yet verified that normal inheritance rules are followed for non-host sources)

[scottwilkerson]

Sorry for the confusion. Maybe I can make this a little clearer...

There is a difference between what a contact has the ability to SEE, and the inheritance via the config files which will also affect alerts.

It is the default behavior that a contact for a host can SEE all services on the host, but may not receive notification for the services..

In addition to that, there are some levels of implied inheritance which add contact groups assigned to host to all the services on the host, this will affect notification for the services, and it is these items that can be overridden with

Code: Select all

  Contactgroup Options
  -----------------------------------------------------
  +                  positive inheritance    (same as standard for host contact group settings)
  null               no inheritance            (verified that this does override the host contact group settings)
  standard           standard inheritance    (I have not yet verified that normal inheritance rules are followed for non-host sources)

In any event, (as far as I am aware) there is no setting to disable the ability for contacts of a host from viewing services that are connected to the host, you can however change the notification options.

[jwelch]

Hmmm....so far I've only observed that if a contact can SEE a host/service, they receive notifications for that host/service,
though there may be other cases I haven't observed. At any rate, what we are trying to accomplish is to keep customers
from SEEING *and* receiving notifications for services that they are not responsible for so that they don't lose sight of
problems that they do need to address.

As for disabling the ability to see a service that you are a contact for the host, I thought that was what the 'Null' setting was
for. It disables the positive inheritance from the host to the service. But it would be a bit of a PITA to manually set it for
a large number of services after the fact. Fortunately, I don't have to implement that in this case. I just needed to understand
how it works and couldn't find any clear documentation (clear to me, at any rate) on the subject.

I'll consider this topic closed unless I run into a case that contradicts the findings here in which case I'll open another topic.
Thanks for your time.