event_handler.log getting full

[bosecorp]

the event_handler.log getting full very quick, it goes to Gigabytes in few minutes.

/usr/local/nagiosxi/var/event_handler.log

# ls -lh | grep event_handler.log
-rw-r--r-- 1 nagios nagios 4.5G Feb 28 15:29 event_handler.log
-rw-r--r-- 1 nagios nagios 285M Feb 28 12:53 event_handler.log.1.gz
-rw-r--r-- 1 nagios nagios 0 Feb 27 09:06 event_handler.log-20180227.gz

then (on the GUI) Event manager and other system components go red.

[scottwilkerson]

before we remove it, can you get some information out of the file so we can see why so many events are firing

Code: Select all

tail -2000 /usr/local/nagiosxi/var/event_handler.log > /tmp/eventhandler.log

and then attach /tmp/eventhandler.log

[bosecorp]

Please find the attached file. Also let us know what other information you need.
Let us know if a remote session is possible so that we could save time and work on the resolution asap.

[scottwilkerson]

All the event here are notifications, did you have a big failure?
lets edit the following line in /etc/cron.d/nagiosxi

Code: Select all

*   * * * * nagios /usr/bin/php -q /usr/local/nagiosxi/cron/event_handler.php >> /usr/local/nagiosxi/var/event_handler.log 2>&1

change to

Code: Select all

*   * * * * nagios /usr/bin/php -q /usr/local/nagiosxi/cron/event_handler.php > /usr/local/nagiosxi/var/event_handler.log 2>&1

removing one of the >

[bosecorp]

Thanks for the suggestion, but this will be a work around.
Is there a way to reduce the level of logging?

[scottwilkerson]

It logs all events, to reduce this, you would need less events.

Events are things like notifications, I saw nagiosadmin was receiving many of these even though the email wasn't even filled in.

[bosecorp]

this is realated to the other issue with cron jobs. You can close this one. we will continue to work of off the other thread


the issue seems like we have duplicate crond job runnings, all jobs are writing to the log files. that is causing the log to fill out so quickly