Nagios XI - disable notifications question

[jacek]

I have a situation where Nagios users sometimes mute hosts.
I would like to somehow automatically reset these settings back to normal with some kind of a script or so.

Lets say if a host/service is muted for more than a week it will automatically get unmuted.
I would also like to somehow be able to whitelist some of the hosts or services (we have services where we only collect info, but don't care about the status)

Background -> a user muted a switch which stopped responding to pings (but was still working OK) and ignored that (or forgot about this), but then some time later a server behind the switch died and he didn't get notified (because of the server being the child of the switch).

Thanks for any ideas!

[jomann]

This would probably require quite a bit of development on your part, but you could certainly write a script that runs on a cron. It would need to hook into the API and grab all the users. Loop over that set of users. For each user, loop over the hosts/services and if the time has expired (has been muted for a week) then you can unmute it by sending commands to the Nagios Core command pipe.

API Docs: inside XI under Help > REST API Docs
External commands: https://assets.nagios.com/downloads/nag ... mands.html (there is a link there to the full list of commands and what they accept for arguments)

[jacek]

So via the api I can check when a host/service w as muted so I can calculate if I can unmute it?

[jomann]

You would have to run it on a daily cron or something and then save the count somewhere, because from what I can tell the only way you'd be able to know when the action was taken is by looking through the logs. You could do that, but again it'd be even more programming/parsing. The hoststatus and servicestatus API endpoints has the data that I think you might need.

[jacek]

I'm not afraid of programming, parsing the files etc.
So you say the time at which host/service got disabled can be found only in the logs, or in the API as well?
Can you please provide an example and the location of the log?

[lmiltchev]

You can check the nagios.log to see if the DISABLE_SVC_NOTIFICATIONS command was submitted. Alternatively, you could convert the epoc timestamps to a "human readable" format, and grep for a specific host/service.

Example:

Code: Select all

grep DISABLE_SVC_NOTIFICATIONS /usr/local/nagios/var/nagios.log | perl -pe 's/(\d+)/localtime($1)/e' | grep "Tech Switch"
[Mon Jul 16 14:47:11 2018] EXTERNAL COMMAND: DISABLE_SVC_NOTIFICATIONS;Tech Switch;Port 1000 Status

If you are writing the audit log to file (Admin > System Settings > Write Audit Log to file = checked), you could also search the audit.log.

Example:

Code: Select all

grep DISABLE_SVC_NOTIFICATIONS /usr/local/nagiosxi/var/components/auditlog.log | grep "Tech Switch"
2018-07-16 14:47:11 - Nagios XI [32] test123:localhost - cmdsubsys: User submitted a command to Nagios Core: DISABLE_SVC_NOTIFICATIONS;Tech Switch;Port 1000 Status

This way, you can also see the user, who submitted the DISABLE_SVC_NOTIFICATIONS command.

[jacek]

Thanks for the clarification!

I have an related question, in the mysql we have the nagiosql and nagios DB.
Both of them contain information about the hosts and services.

I have one host which has notifications disabled in XI and I can see that in "nagios" DB (nagios_hosts - notifications_enabled), but in "nagiosql" (tbl_host - notifications_enabled) it seems perfectly fine - should send notifications.

What is the difference?
If I want to change something which DB should I modify?
Will the changes get synced somehow or do I need to initiate the sync?

[lmiltchev]

I have an related question, in the mysql we have the nagiosql and nagios DB.
Both of them contain information about the hosts and services.
...
What is the difference?

The nagios db is for the current status/historical data. This is what you need to query as nagiosql db is config related. You may have notifications enabled in the CCM, but a user could disable them from the GUI (under the Quick Actions). The change would not show up in nagiosql but it would show up in the nagios db.

If I want to change something which DB should I modify?
Will the changes get synced somehow or do I need to initiate the sync?

We do not recommend modifying objects directly in the DB. You could however submit core commands to enable/disable notifications via the REST API.

[jacek]

I was hoping that I could go with a simple sql update on the host table to change the notification interval on hosts that have this set to "0".
I need to play around with the REST to get that working.

EDIT:
So if my user disables the notification from the quick action, where does Nagios store that info?

[lmiltchev]

It's going to be in the nagios db.

Example query:

Code: Select all

echo "select notifications_enabled from nagios.nagios_hosts where alias='EM08T';" | mysql -t -uroot -pnagiosxi
+-----------------------+
| notifications_enabled |
+-----------------------+
|                     0 |
+-----------------------+

Note: A nagios xi user disabled notifications from the GUI under the Quick Actions (as it's shown above). However, in the conifg (CCM), notifications for this host are still enabled. See below:

Code: Select all

echo "select notifications_enabled from nagiosql.tbl_host where alias='EM08T';" | mysql -t -uroot -pnagiosxi
+-----------------------+
| notifications_enabled |
+-----------------------+
|                     1 |
+-----------------------+