host & services mismatched notification

[QS1]

Centos 5.7 - 32 Bit - version 2011R1.3 - running on VMWare - KDE GUI

I created 15-20 new service checks and applied configuration without error. All checks are set identical to notify via cell and email.

It appears that approx 12 service checks randomly alert me via cell text and have a totally different host descriptions than originally set.

The template service checks through nagiosxi are correct..looking at the Host and Service files within nagios all appear to be fine as well.

I've deleted the service and host through xi (verified in nagios the service is removed) and will still receive a cellular text of the removed check

I can recreate the scenario when I reboot the server. Is there something I can repair in nagiosql?

Forgot to put this info originally-
The notifications in question all have a date stamp of 11-28-2011..the times on them vary between 7PM and 10PM. These notifications are always sent as Critical.
The curent date and time is also listed

[mguthrie]

First, lets eliminate any chance of multiple instances of nagios running:

Code: Select all

killall -9 nagios
service nagios start

Just to verify, after deleting these hosts and services, are you able to find them anywhere in the XI interface?

Is this by chance a switch or a router that is doing this?

[QS1]

No other instance of nagios are running..verified host and client deletion from xi.
The checks are not for routers. They are generic Check_Host commands indicating specific processing ports.

[agriffin]

Were the new services added to existing hosts or created along with new hosts? Can you just briefly describe the steps you took to add them (normal wizards, added manually in the Core Config, etc)?

[QS1]

All Services were added to preexisting Hosts. Creation of all Services was done by copying an existing service and editing the arguments and description names. I would applied changes after doing 8 or so services...do 8 or so more then apply changes again.

I've looked through var/spool/mail/nagios and see all bogus messages I am getting in here. Can I just delete them from the spool? Or is it getting generated from another area?

[mguthrie]

Can you post a sample host or service definition, along with the contact definitions? You can access the contact definitions by accessing the Core Config Manager->Contacts, and then clicking the Download button. (I would suggest clearing out the real email addresses).

[QS1]

I will post examples of "like"service and host along with contact information.

Currently, I removed cell phone numbers from the contacts.cfg who are receiving the bogus alert text messages (applied config) and rebooted. The text messages still came through to all individuals who were removed.

[QS1]

The below information was taken from the mail spool on DEC 1st. All bogus messages stopped appearing on cell texts on Saturday DEC 3th (5 days). If this sceanrio happens again in the future where would I be able to change this to reduce the number of days for re-try?


>>> RCPT To:<[email protected]>
<<< 452 Too many recipients received this hour. The MTA, Unknown, with IP address, 72.34.xxx.xx, has no DNS PTR record. For more information see IETF RFC 1912 requirements.
<864#######@vtext.com>... Deferred: 452 Too many recipients received this hour. The MTA, Unknown, with IP address, 72.34.xxx.xx, has no DNS PTR record. For more information see IETF RFC 1912 requirements.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--pAT5Qib3019287.1322544469/nagiosxi.qs1support.com
Content-Type: message/delivery-status

Reporting-MTA: dns; nagiosxi.qs1support.com
Arrival-Date: Mon, 28 Nov 2011 19:28:42 -0500

[mguthrie]

Looks like this is somewhat of a manual process if you want to selectively delete. Here's what I found on this:
http://www.cyberciti.biz/faq/linux-unix ... ail-queue/

[QS1]

Thank you..the issue looks to be resolved by the default re-attempt date expiration. I will keep the sendmail info handy.