parent/child/dependencies and best practices

[erichymowitz]

Greetings.

I have a nagios server named Alpha. It can get to hosts Delta, Echo, and Foxtrot. Delta is a "bastion" host. It can get to hosts Tango, Uniform, and Victor; but Alpha cannot get to those hosts directly.

Since Alpha cannot get to Tango/Uniform/Victor, I have checks set up like this:

Code: Select all

define host{
    use     linux-server    ; Inherit default values from a template
    host_name   tango      ; The name we're giving to this host
    check_command           check_nrpe_remote!delta!check_by_nrpe_ping_$HOSTNAME$ -t 20
    address     192.168.10.166 ; IP address of the host
    parents     delta      ;
    }

And Delta has nrpe configured like this:

Code: Select all

command[check_by_nrpe_ping_tango]=/usr/lib64/nagios/plugins/check_ping  -H tango -w 100,20% -c 500,60%
command[check_by_nrpe_ping_uniform]=/usr/lib64/nagios/plugins/check_ping  -H uniform -w 100,20% -c 500,60%
command[check_by_nrpe_ping_victor]=/usr/lib64/nagios/plugins/check_ping  -H victor -w 100,20% -c 500,60%

And this works, for the most part.

The problem is, we had a situation where Delta was UP, but Delta's nrpe wasn't running, so nagios could not check Tango or any Tango services. This generated a bunch of incorrect alerts that Tango was DOWN, when it was in fact UNREACHABLE.

As I understand it, the parent/child relationship typically expects the "parent" to be a switch that allows/prevents access, and if the switch is down, we assume the hosts behind it are unreachable. That's not the case here.

I could use dependencies. However, as I understand it, a host (Tango) cannot be dependent on a service (Delta's nrpe port answering queries). A host can be dependent on a host, or a service can be dependent on a service.

So it sounds like my course of action is to stop doing "host checks" for Tango, only do service checks, and make every Tango service dependent on Delta's nrpe service. But that seems inefficient and unwieldy.

Is there a better option for my configuration? I'm not opposed to redesigning the nagios structure if I need to (though I'd rather not). I'd like to find a way to make the host Tango dependent on the service Delta-nrpe.

Thanks.

[benjaminsmith]

Hi @erichymowitz

In this situation, you'll want to use host and service dependencies. It is correct that a host cannot be dependent upon a service when creating dependencies. However, there is some flexibility, for example, you can define a host that has a check command defined for your NRPE service on Delta and create a host dependencies between Delta and Tango/Uniform/Victor or you can create a similar service dependency relationship between those servers.

As far as efficiency is concerned, there is no difference between types of dependencies but rather which is the best approach for you to simply administration.

RESOURCES:
Nagios Core Documentation on Host and Service Dependencies
https://support.nagios.com/kb/article/n ... s-505.html
Nagios XI Service Dependencies
https://support.nagios.com/kb/article/n ... s-505.html

[erichymowitz]

Thanks for the info.

Regarding efficiency, I had read this comment:

https://nagios-users.narkive.com/Be06Ef ... dependency

What I've found is that the host dependency has the following behavior:

Nagios goes to check host A
Nagios sees host A has a dependency on host B
Nagios checks host B
If all is good, Nagios checks host A
[...]
So, for something like a network switch, you want a parent relationship -- you
don't want it to check the switch each time it checks the machine, only if the
machine fails, then check to see if it's the machine or if it's the switch.

Grented, this comment is fifteen years old. However, it sounds like each dependent-service check generates its own individual depended-on-service check. That was one of my concerns. Is this incorrect?

[scottwilkerson]

Nagios uses these 2 nagios.cfg directives to see if the state for the host/service is still considered valid

Code: Select all

cached_host_check_horizon=15
cached_service_check_horizon=15

these are seconds.

So using the above numbers if the host/service that is being depended upon has not been checked within the last 15 seconds it will be re-checked, if and only if the dependent host/service is in a non-OK state.

Resource: https://assets.nagios.com/downloads/nag ... gmain.html