Page 2 of 2

Re: Notification Mess!

Posted: Thu Sep 27, 2018 5:11 pm
by rkane
No worries, really appreciate the help!
It seems to have gone through - how can i check the queue to make sure there's no more messages waiting to go out?
scottwilkerson wrote:Sorry about that they missed 2 characters

Code: Select all

echo "truncate table xi_events; truncate table xi_meta; truncate table xi_eventqueue;" | mysql -uroot -pnagiosxi nagiosxi

Re: Notification Mess!

Posted: Fri Sep 28, 2018 7:49 am
by scottwilkerson
There isn't a place to see them waiting other than looking at the database tables that command just deleted.

You can see any new ones being processed though by tailing the eventman.log

Code: Select all

tail -f /usr/local/nagiosxi/var/eventman.log

Re: Notification Mess!

Posted: Fri Sep 28, 2018 9:47 am
by rkane
So the messages are still coming through. Best I can tell our IronPort is refusing and Nagios is retrying...thoughts?

Re: Notification Mess!

Posted: Fri Sep 28, 2018 12:13 pm
by rkane
For anyone finding this thread at a later date, here's a quick wrap up.

- Major outage caused NagiosXI to fire off thousands of email notifications
- Our IronPort started refusing and letting NagiosXI that it was doing so
- NagiosXI continued to try to deliver those notifications for days
- The IronPort would let a few through and then block, let a few through and then block

End result was what appeared to be a "random" notification issue

Solution: temporarily whitelist NagiosXI on the IronPort and wait a few days for NagiosXI to clear out the notification queue.

This thread can be closed unless someone on the Nagios end has any thoughts on how to clear that notification queue so that NagiosXI will stop retrying.

Re: Notification Mess!

Posted: Fri Sep 28, 2018 12:49 pm
by tgriep
Login to the XI GUI and go to the Admin > Manage Email Settings menu to see what the Mail Method is set to.
If it is set to Sendmail, then the emails are coming from the local mailer daemons mail queue.
To clear out that queue, run the following as root.

Code: Select all

postsuper -d ALL

Re: Notification Mess!

Posted: Fri Sep 28, 2018 12:53 pm
by rkane
Done and done, is there a way to check that it has been properly cleared?
tgriep wrote:Login to the XI GUI and go to the Admin > Manage Email Settings menu to see what the Mail Method is set to.
If it is set to Sendmail, then the emails are coming from the local mailer daemons mail queue.
To clear out that queue, run the following as root.

Code: Select all

postsuper -d ALL

Re: Notification Mess!

Posted: Fri Sep 28, 2018 1:04 pm
by tgriep
Run this command and it will show you how many messages are in the mail queue.

Code: Select all

mailq

Re: Notification Mess!

Posted: Fri Sep 28, 2018 1:06 pm
by rkane
Excellent, thank you.
Thread closed!
tgriep wrote:Run this command and it will show you how many messages are in the mail queue.

Code: Select all

mailq