Nagios Support Forum

Just saw a warning alert from nagios that the cpu was somewhat high on the nagiosxi server (NagiosXI 5.6.3). Upon investigation I found wkhtmltopdf has been running for about 21 hour now. Is this normal? see screenshot.

It is possible that you, one someone else on your team tried running a very large report, e.g. Availability or Capacity Planning. If the report was run on a large number of objects, and a big time range (time period), this would cause wkhtmltopdf to keep running for a very long time, utilizing many of the system resources.

FYI, there will be an improvement in performance, especially for the Availability reports in Nagios XI 5.7.x.

Is there any way of telling who scheduled a report?

With Nagios XI Enterprise Edition, you can see who added a scheduled report, by going to Reports > Report Management > Scheduled Reports. You can see the report's name, frequency, the user who scheduled the report, and the email the report was/will be send to. Unfortunately, there is no way to see who actually ran or emailed the report. This info may be added to the audit log in one of the future releases of Nagios XI.

There are 16 reports scheduled to go out at varying times of the day. So there is no way of telling if one of them runs long or if someone ran a manual report?

No, you can't find this info in the audit log (not in the current version of Nagios XI), but you could do some investigative work to at least find what was the report that was "most likely run". For example, you could view the performance graph for the "Current Load" service on localhost, and see when exactly the load spiked. Then check when your scheduled reports are supposed to run. Maybe one of the reports takes a very long time to run and you would need to remove it. This will not tell you who ran the report, but at least you could take some action, e.g. delete the report.