Nagios Support Forum

Today i noticed that when the server went down. It went into the hard state and in the Notifications also i can see the entry.
But still didn't got the email.
Where i can check.

Can you see the notification in the nagios.log?

Do you receive any notifications?

Does the server that went down have the same contacts specified?

What is the configuration for the server that went down?

I can see the following logs in the nagios.log

[1556121352] Warning: Check of host 'MBNPS01' timed out after 30.01 seconds
[1556121352] HOST NOTIFICATION: tcs-events-monitor;MBNPS01;DOWN;notify-host-by-email;(Host check timed out after 30.01 seconds)
[1556121352] HOST ALERT: MBNPS01;DOWN;HARD;2;(Host check timed out after 30.01 seconds)

Do you receive any notifications?--- Yes Service Notifications are working fine, only Host Notifications not working.

Does the server that went down have the same contacts specified?--- Yes Same contact

What is the configuration for the server that went down?--- You are referring to the configuration in the Nagios? If yes what configuration in nagios.

Can you post the configuration for bothe the notify-host-by-email and notify-service-by-email commands?

define command {

command_name notify-host-by-email
command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\nHost: $HOSTNAME$\nHOSTGROUP: $HOSTGROUPNAMES\nState: $HOSTSTATE$\nAddress: $HOSTADDRESS$\nInfo: $HOSTOUTPUT$\n\nDate/Time: $LONGDATETIME$\n" | /usr/bin/mailx -s "** $NOTIFICATIONTYPE$ Host Alert: $HOSTNAME$ is $HOSTSTATE$ **" $CONTACTEMAIL$
}



define command {

command_name notify-service-by-email
command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $HOSTALIAS$\nHOSTGROUP: $HOSTGROUPNAMES$\nAddress: $HOSTADDRESS$\nState: $SERVICESTATE$\n\nDate/Time: $LONGDATETIME$\n\nAdditional Info:\n\n$SERVICEOUTPUT$\n" | /usr/bin/mailx -s "** $NOTIFICATIONTYPE$ Service Alert: $HOSTALIAS$/$SERVICEDESC$ is $SERVICESTATE$ **" $CONTACTEMAIL$
}

These look correct and you showed that the Nagios log showed the notification was kicked out to tcs-events-monitor at 1556121352

Can you look in the maillog on the Nagios server to see if the notification email was logged?

what should i search in the maillog?

i cannot find the servername in the maillog?

Do i need to search for time when the alert occured?

amitgupta19 wrote:Do i need to search for time when the alert occured?

Yes

Following are the logs around the time when there is entry in Notifications
=========================
Apr 24 08:55:52 cblnagios01 postfix/cleanup[22623]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/cleanup[22623]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/pickup[25175]: 8003B4214E99: uid=1005 from=<nagios>
Apr 24 08:55:52 cblnagios01 postfix/trivial-rewrite[22624]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/trivial-rewrite[22624]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/cleanup[22623]: 8003B4214E99: message-id=<[email protected]>
Apr 24 08:55:52 cblnagios01 postfix/qmgr[6140]: 8003B4214E99: from=<[email protected]>, size=605, nrcpt=1 (queue active)
Apr 24 08:55:52 cblnagios01 postfix/local[22627]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/local[22627]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/bounce[22628]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:55:52 cblnagios01 postfix/local[22627]: 8003B4214E99: to=<[email protected]>, orig_to=<$>, relay=local, delay=0.05, delays=0.03/0.01/0/0.01, dsn=5.1.1, status=bounced (unknown user: "$")
Apr 24 08:55:52 cblnagios01 postfix/cleanup[22623]: 8911C4214E9A: message-id=<[email protected]>
Apr 24 08:55:52 cblnagios01 postfix/bounce[22628]: 8003B4214E99: sender non-delivery notification: 8911C4214E9A
Apr 24 08:55:52 cblnagios01 postfix/qmgr[6140]: 8911C4214E9A: from=<>, size=2486, nrcpt=1 (queue active)
Apr 24 08:55:52 cblnagios01 postfix/qmgr[6140]: 8003B4214E99: removed
Apr 24 08:55:52 cblnagios01 postfix/local[22627]: 8911C4214E9A: to=<[email protected]>, relay=local, delay=0.01, delays=0/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Apr 24 08:55:52 cblnagios01 postfix/qmgr[6140]: 8911C4214E9A: removed
Apr 24 08:56:05 cblnagios01 postfix/pickup[25175]: 159A44214E99: uid=1005 from=<nagios>
Apr 24 08:56:05 cblnagios01 postfix/cleanup[22623]: 159A44214E99: message-id=<[email protected]>
Apr 24 08:56:05 cblnagios01 postfix/qmgr[6140]: 159A44214E99: from=<[email protected]>, size=815, nrcpt=1 (queue active)
Apr 24 08:56:05 cblnagios01 postfix/smtp[23027]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:56:05 cblnagios01 postfix/smtp[23027]: warning: match_list_parse: comment at end of line is not supported: ###localhost.xxx.global localhost
Apr 24 08:56:05 cblnagios01 postfix/smtp[23027]: 159A44214E99: to=<[email protected]>, relay=172.16.5.13[172.16.5.13]:25, delay=0.13, delays=0.02/0.02/0.01/0.08, dsn=2.0.0, status=sent (250 2.0.0 2s031m2m28-1 Message accepted for delivery)
Apr 24 08:56:05 cblnagios01 postfix/qmgr[6140]: 159A44214E99: removed

Do any of these seem to match the email address of the tcs-events-monitor user?