Page 1 of 1

Passive Check Email Notification

Posted: Mon Mar 04, 2019 8:48 pm
by Pikmin
Hey everyone,

I've been learning about passive check and I have set one up and seems to be working properly apart from the email notification.

This is what the service looks like, I've set the notification interval for 2 hours. Even when I manually check the service to ping, to clear the error I never get a notification email

Code: Select all

define service {
name                            SNMP_TRAP
service_description             SNMP_TRAP
active_checks_enabled           1	; Active service checks are enabled
passive_checks_enabled          1	; Passive service checks are enabled/accepted
parallelize_check               1	; Active service checks should be parallelized
process_perf_data               0
obsess_over_service             0	; We should obsess over this service (if necessary)
check_freshness                 0	; Default is to NOT check service 'freshness'
notifications_enabled           1	; Service notifications are enabled
event_handler_enabled           1	; Service event handler is enabled
flap_detection_enabled          1	; Flap detection is enabled
process_perf_data               1	; Process performance data
retain_status_information	1	; Retain status information across program restarts
retain_nonstatus_information    1	; Retain non-status information across program restarts
check_command                   check-host-alive      ; This will be used to reset the service to "OK"
is_volatile                     1
check_period                    24x7
max_check_attempts              1
normal_check_interval           1
retry_check_interval            1
notification_interval           120
notification_period             24x7
notification_options            w,u,c,r
contact_groups                  test	   ; Modify this to match your Nagios contact group definitions
register                        0
}
However soon as I disable flapping, I get emails without any problems
Thank you

Code: Select all

[1551749484] PASSIVE SERVICE CHECK: NDC-SW-LSD;TRAP;0;PING OK - Packet loss = 0%, RTA = 0.88 ms
[1551749484] SERVICE ALERT: NDC-SW-LSD;TRAP;CRITICAL;HARD;1;Notification of a configuration management event as commandLine running networkTftp
[1551749484] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;192.168.130.158;TRAP;2;Notification of a configuration management event as commandLine startup networkTftp
[1551749484] PASSIVE SERVICE CHECK: NDC-SW-LSD;TRAP;2;Notification of a configuration management event as commandLine running networkTftp
[1551749484] SERVICE ALERT: NDC-SW-LSD;TRAP;CRITICAL;HARD;1;Notification of a configuration management event as commandLine startup networkTftp
[1551750036] EXTERNAL COMMAND: DISABLE_SVC_FLAP_DETECTION;NDC-SW-LSD;TRAP
[1551750036] SERVICE FLAPPING ALERT: NDC-SW-LSD;TRAP;DISABLED; Flap detection has been disabled
[1551750074] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;192.168.130.158;TRAP;2;Notification of a configuration management event as commandLine running startup
[1551750074] PASSIVE SERVICE CHECK: NDC-SW-LSD;TRAP;2;Notification of a configuration management event as commandLine startup networkTftp
[1551750074] SERVICE NOTIFICATION: nagiosadmin;NDC-SW-LSD;TRAP;CRITICAL;notify-service-by-email;Notification of a configuration management event as commandLine running startup
[1551750074] SERVICE ALERT: NDC-SW-LSD;TRAP;CRITICAL;HARD;1;Notification of a configuration management event as commandLine running startup
[1551750094] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;192.168.130.158;TRAP;2;Notification of a configuration management event as commandLine running startup
[1551750094] PASSIVE SERVICE CHECK: NDC-SW-LSD;TRAP;2;Notification of a configuration management event as commandLine running startup
[1551750094] SERVICE NOTIFICATION: nagiosadmin;NDC-SW-LSD;TRAP;CRITICAL;notify-service-by-email;Notification of a configuration management event as commandLine running startup
[1551750094] SERVICE ALERT: NDC-SW-LSD;TRAP;CRITICAL;HARD;1;Notification of a configuration management event as commandLine running startup
[1551750117] EXTERNAL COMMAND: SCHEDULE_FORCED_SVC_CHECK;NDC-SW-LSD;TRAP;1551750116
[1551750121] SERVICE NOTIFICATION: nagiosadmin;NDC-SW-LSD;TRAP;OK;notify-service-by-email;PING OK - Packet loss = 0%, RTA = 7.42 ms
[1551750121] SERVICE ALERT: NDC-SW-LSD;TRAP;OK;HARD;1;PING OK - Packet loss = 0%, RTA = 7.42 ms

Re: Passive Check Email Notification

Posted: Tue Mar 05, 2019 8:36 am
by scottwilkerson
With these you likely want to disable flapping, flapping enabled will suppress notification if the host/service is rapidly changing states

More on flapping
https://assets.nagios.com/downloads/nag ... pping.html

Re: Passive Check Email Notification

Posted: Tue Mar 05, 2019 3:39 pm
by Pikmin
Thanks Scott, will do

Re: Passive Check Email Notification

Posted: Tue Mar 05, 2019 3:44 pm
by scottwilkerson
Pikmin wrote:Thanks Scott, will do
Let us know if we can be of further assistance

Re: Passive Check Email Notification

Posted: Tue Mar 05, 2019 11:15 pm
by Pikmin
I do have one more query, but not sure if it's snmptt or submit_check_result, looks like it might be the former

the smptt conf file

Code: Select all

EVENT cErrDisableInterfaceEvent .1.3.6.1.4.1.9.9.548.0.1.1 "Status Events" Normal
FORMAT The cErrDisableInterfaceEvent is generated when an interface $*
EXEC /usr/local/nagios/libexec/eventhandlers/submit_check_result $r ERR_DISABLE 2 "The cErrDisableInterfaceEvent is generated when an interface $*"
SDESC
The cErrDisableInterfaceEvent is generated when an interface
or {interface, vlan} is error-disabled by the feature
specified in cErrDisableIfStatusCause.
cErrDisableInterfaceEvent is deprecated and replaced by
cErrDisableInterfaceEventRev1.
Variables:
  1: cErrDisableIfStatusCause
EDESC
snmptt status

Code: Select all

Mar 06 14:13:55 ndnagios snmptt[18010]: .1.3.6.1.4.1.9.9.548.0.1.1 Normal "Status Events" 192.168.130.159 - The cErrDisableInterfaceEvent is generated when an interface bpduGuard
nagios.log

Code: Select all

[1551844055] SERVICE ALERT: NDC-SW-LSD-Access1;ERR_DISABLE;CRITICAL;HARD;1;The cErrDisableInterfaceEvent is generated when an interface bpduGuard
What is the character limit for submit_nagios_check ? Is there a way to have the full description from the conf?

Appreciate your help

Re: Passive Check Email Notification

Posted: Wed Mar 06, 2019 7:28 am
by scottwilkerson
Only the first line is added to the nagios output, currently it looks like this is broken up into multiple lines.

Re: Passive Check Email Notification

Posted: Sun Mar 10, 2019 7:01 am
by Pikmin
Thanks for that, I was hoping there would be more info, like which specific port is in err disable but I guess I need to check the snmptt documentation and whether that's at all possible, I could be confusing the trap info with syslog info

Re: Passive Check Email Notification

Posted: Mon Mar 11, 2019 6:53 am
by scottwilkerson
Pikmin wrote:Thanks for that, I was hoping there would be more info, like which specific port is in err disable but I guess I need to check the snmptt documentation and whether that's at all possible, I could be confusing the trap info with syslog info
Yes, this also depends on what the Trap sends

Re: Passive Check Email Notification

Posted: Wed Mar 20, 2019 10:27 pm
by Pikmin
Thanks for your help

Re: Passive Check Email Notification

Posted: Fri Mar 22, 2019 10:31 am
by benjaminsmith
Hi @Pikum,
Thanks for your help
May we close this topic?