Nagios sending multiple notifications insted of one

[supportagilita]

Hi all,

I'm very new to nagios and currently having troubble with notifications.

Several checks are sending notifications between 60 up to 150 minutes interval. It seems that there is a randomness behind but I can not verify where the missconfiguration might be.

All services are having the same setup same configuration and notification_interval is set to "0".

What kind of logs or informations are needed ?

Regards,
Jonathan

define contact {
contact_name nagiosadmin
alias Nagios Administrator
host_notifications_enabled 1
service_notifications_enabled 1
host_notification_period xi_timeperiod_24x7
service_notification_period xi_timeperiod_24x7
host_notification_options d,u
service_notification_options w,c
host_notification_commands notify-host-by-email
service_notification_commands notify-service-by-email
retain_status_information 0
retain_nonstatus_information 0
email xx
use xi_contact_generic
}

define service {
host_name xx
service_description Check All Disks_1
check_command check_nrpe_checkdrivesize_windows!check_drivesize!!!!!!!
max_check_attempts 5
check_period xi_timeperiod_24x7
notification_interval 0
first_notification_delay 3
notification_period xi_timeperiod_24x7
notification_options c,
notifications_enabled 1
register 1
}

[ssax]

Please PM a copy of your profile, you can download it from Admin > System Profile > Download Profile.

If you're unable to generate the the profile through the web interface, please try generating it from the command line by running these commands as root:

Code: Select all

rm -rf /usr/local/nagiosxi/var/components/profile*​​
/usr/local/nagiosxi/html/includes/components/profile/getprofile.sh SUPPORT

Then send me the resulting /usr/local/nagiosxi/var/components/profile.zip​ file.​

If the profile script fails, please include the ENTIRE output.

Please go to Reports > State History:
- Adjust the Period to include the time this occurred
- Select the host from the Limit To dropdown
--- Don't limit on the Services, we want to see host and service states
- For Type, select Both
- For State Type, select Both
- For State, select Any
- Click Run

Please send me the report, you can either download it as a PDF or CSV.

Send the full notification report for this timeperiod as well.

[cdienger]

It's not configured to send recovery notifications so the service may be recovering in between the CRITICAL notifications with you being aware. Look for events for this service under Home > Monitoring Process > Event Log, to see if that is the case here.

[supportagilita]

It seems like that I'm not authorized to send PM's.

Compose message
We are sorry, but you are not authorised to use this feature. You may have just registered here and may need to participate more to be able to use this feature.


Might it be possible to send the infos via mail ?

Regards,
Jonathan

[cdienger]

Fixed something on our end. Please try sending it again.

[ssax]

First, go to Configure > Core Config Manager > Contacts:
- Edit the nagiosadmin contact
- Click the Alert Settings tab
- Set both of these to On:

retain_status_information
retain_nonstatus_information

- Save
- Apply Config
- Now validate if it's resolved

What could be happening is that because when you apply configuration it restarts the nagios process (but is currently set to not retain any contact info for the nagiosadmin contact) it could be losing a notification count or whether or not the nagiosadmin was sent a notification or not and could be causing the duplicates. You also have a 3 min delay on all your services that you'll need to take into account as well. That'd be my guess as to what's occurring.

Then if that doesn't resolve it, do this, as we need the data:

Please go to Reports > State History:
- Adjust the Period to include the time this occurred
- Select the host from the Limit To dropdown
--- Don't limit on the Services, we want to see host and service states
- For Type, select Both
- For State Type, select Both
- For State, select Any
- Click Run

Please send me the report, you can either download it as a PDF or CSV.

Please include the Home > Event Log report for this timeframe as well (a little before and a little during is fine).

We need that data above to try to correlate the info.

[ssax]

Did you do this? What were the results?

First, go to Configure > Core Config Manager > Contacts:
- Edit the nagiosadmin contact
- Click the Alert Settings tab
- Set both of these to On:

retain_status_information
retain_nonstatus_information

- Save
- Apply Config
- Now validate if it's resolved

Please attach a FRESH copy of your profile as well.

Are you still receiving multiple notifications or no?

[supportagilita]

Yes the changes were done and i think it helped a lot. but for my disk check there was no change. im still recieving multiple notifications.
i've sent you the files yesterday evening

[ssax]

The reason I asked is because the changes must've been done after you sent the profile, the profile still has this set for the nagiosadmin contact:

Code: Select all

    retain_status_information        0
    retain_nonstatus_information     0

Please PM me the hostname so that I can look at it's configs, all I see is this:

Code: Select all

Check All Disks_1;UNKNOWN;HARD;5;Filter processing failed: Failed to get size for \\?\Volume{92XXXXXXe6963}\: 57: The parameter is incorrect.
Check All Disks_1;STARTED; Service appears to have started flapping (20.1% change >= 20.0% threshold)
Check All Disks_1;UNKNOWN;SOFT;1;Filter processing failed: Failed to get size for \\?\Volume{18f32893-79d7-11e6-80c5-806e6f6e6963}\: 57: The parameter is incorrect

Are you receiving UNKNOWNS or CRITICALS for the multiple Check Disk ones that are being sent?

[tgriep]

If looks like the check is toggling back and forth from an unknown state to a critical and that could be the cause of the issue.

Try this, edit the check_nrpe_checkdrivesize_windows command and add a -t 59 to increase the timeout for the check, that could help out.

Also, can you get the nsclient.ini file from the Windows server so we can view it?