Nagios Support Forum

Hi All,

Just need some suggestions on how to address a certain challenge I have got. Here is the scenario:

I have a syslog deamon which is receiving and processing syslog from a bunch of network devices and based on some pattern match criterion it will trigger a Nagios alert. So far so good all works well.

The problem I have is everytime the event occurs the syslog deamon sends the same message to Nagios Core and an alert is generated. But in some scenario this is generating far too many notifications.
The service is defined as a passive service and gets reset after 5 minutes using check_dummy.

Can I somehow do this based on the actual output of the service, so that it sends the alerts only if the service output has changed.

I see two possible options stalking and volatile which will be more suitable

Any other suggestions apart from telling me to buy Nagios reactor is welcome

Many Thanks
Arnab

arnab.roy wrote:Any other suggestions apart from telling me to buy Nagios reactor is welcome

You can't buy Nagios Reactor, it's free.

arnab.roy wrote:The problem I have is everytime the event occurs the syslog deamon sends the same message to Nagios Core and an alert is generated. But in some scenario this is generating far too many notifications.
The service is defined as a passive service and gets reset after 5 minutes using check_dummy.

Are you already using notification_interval of 0? If so then I would argue either:

a) Your problem should just be fixed - we're genuinely notifying you of a problem and that's what we're good at. If you don't see it as a problem remove the service

or

b) Adjust your check_interval so that it waits a longer period of time before the check_dummy resets it to OK. With a notification_interval of 0 it won't send any more notifications until it gets reset to OK.

Any other suggestions apart from telling me to buy Nagios reactor is welcome

I meant Nagios Log server

Let me expand I cannot control exactly how often the check reset is run unless I start reconfiguring all of the services. We are using nrds so all our checks are based on the cron job that runs on the nrds .

We cannot remove that service as all syslog alerts are sent to the same service.

Any other options ?

Your check_dummy that resets it to OK is passive also? Why not just set that up as an active check?