Nagios Support Forum

Windows WMI Monitoring Wizard created the following item under services. How do I apply an event handler for multiple services (on the same host)?

Service Description
-----------------------------
Application Log Warnings
CPU Usage
Drive C: Disk Usage
Explorer
Memory Usage
Page File Usage
Ping
System Log Critical Errors
-----------------------------

Thanks,

-klee

What are you trying to accomplish? Usually an event handler is specific to a single service.

Our goal is forward Nagios alerts to an existing Network Management System (EMC SMARTS) via snmptraps.

We don't want to use the SNMP Trap Sender component because we don't want to send every alert to be sent.

This is the method recommended by Scott &Trevor during the initial demo/phone conference.

Please let me now if this is accurate.

-klee

In that case, you would need to either apply at the template level or on each host\service that you wish to send alerts for. You could create a global event handler that filters via host or another parameter as well if you wanted, but that would likely be far more work.

Thank you for the response, Sreinhardt.

For clarification, I would like to ask this very important question one more time (in order to avoid creating exponentially more work for myself going forward):

If multiple SNMP traps are being sent to Nagios by client machines... Can the logic built into Nagios events (be it templates, plugins, manually configured items) filter SNMP messages before forwarding alerts to 3rd party Network Management System (SMARTS) via SNMP Trap Sender? Or does the SNMP Trap Sender component just relay all SNMP messages to another NMS without filtering.

Very Important... Please advise.

Thanks,

-klee

They should be in essence "filtered" first, the trap results will go to your hosts/services, then nagios will change their displayed state, and the trap sender component will pick this up and forward it on. The trap sender component will forward any changed state alert for a host/service.

Thanks Slansing,

Can you please elaborate on what you mean when you say 'they should be "filtered" first'? They 'should' be... meaning there's something additional we have to do? Or they actually are filtered?

Because according to you explanation below, it seems that the Nagios rules does the filtering before sending traps via SNMP Trap Sender.

So under what conditions would someone set up event handlers to send the SNMP traps insead of using SNMP Trap Sender?

Thanks Again,

-klee

Well the trap sender itself uses an event handler of sorts in the background, this is what is responsible for sending traps based on your host/service states to other systems. Unless we are talking about a different trap sender? The reason I quoted filtered is because that is a term that can be used for what I was explaining.

Excellent... now part 2 of that question:

Under what conditions would someone set up event handlers to send the SNMP traps insead of using SNMP Trap Sender?

Please & Thank You,

-klee

The only real instance I could think of not using the global event handler would be if you want only certain services sending traps. In which case you could still use the trap sending component and scripts but not on a global scale. Otherwise you could always use a different snmptrap sending solution if you wished. As slansing mentioned, the snmp trap sending component doesn't do any filtering other than if you have the latest version it will filter for downtime if you choose to set that up. It will not however allow you to filter specific services from sending or not, unless you do not use it as a global handler. Hope that helps!