Page 1 of 1
event_handler.log getting full
Posted: Wed Feb 28, 2018 3:32 pm
by bosecorp
the event_handler.log getting full very quick, it goes to Gigabytes in few minutes.
/usr/local/nagiosxi/var/event_handler.log
# ls -lh | grep event_handler.log
-rw-r--r-- 1 nagios nagios 4.5G Feb 28 15:29 event_handler.log
-rw-r--r-- 1 nagios nagios 285M Feb 28 12:53 event_handler.log.1.gz
-rw-r--r-- 1 nagios nagios 0 Feb 27 09:06 event_handler.log-20180227.gz
then (on the GUI) Event manager and other system components go red.
Re: event_handler.log getting full
Posted: Wed Feb 28, 2018 5:07 pm
by scottwilkerson
before we remove it, can you get some information out of the file so we can see why so many events are firing
Code: Select all
tail -2000 /usr/local/nagiosxi/var/event_handler.log > /tmp/eventhandler.log
and then attach /tmp/eventhandler.log
Re: event_handler.log getting full
Posted: Thu Mar 01, 2018 8:25 am
by bosecorp
Please find the attached file. Also let us know what other information you need.
Let us know if a remote session is possible so that we could save time and work on the resolution asap.
Re: event_handler.log getting full
Posted: Thu Mar 01, 2018 10:23 am
by scottwilkerson
All the event here are notifications, did you have a big failure?
lets edit the following line in /etc/cron.d/nagiosxi
Code: Select all
* * * * * nagios /usr/bin/php -q /usr/local/nagiosxi/cron/event_handler.php >> /usr/local/nagiosxi/var/event_handler.log 2>&1
change to
Code: Select all
* * * * * nagios /usr/bin/php -q /usr/local/nagiosxi/cron/event_handler.php > /usr/local/nagiosxi/var/event_handler.log 2>&1
removing one of the >
Re: event_handler.log getting full
Posted: Thu Mar 01, 2018 3:43 pm
by bosecorp
Thanks for the suggestion, but this will be a work around.
Is there a way to reduce the level of logging?
Re: event_handler.log getting full
Posted: Fri Mar 02, 2018 9:55 am
by scottwilkerson
It logs all events, to reduce this, you would need less events.
Events are things like notifications, I saw nagiosadmin was receiving many of these even though the email wasn't even filled in.
Re: event_handler.log getting full
Posted: Fri Mar 02, 2018 5:55 pm
by bosecorp
this is realated to the other issue with cron jobs. You can close this one. we will continue to work of off the other thread
the issue seems like we have duplicate crond job runnings, all jobs are writing to the log files. that is causing the log to fill out so quickly