No hard alerts in Nagios but alerts picked in ticketing tool

[deek]

We had scenario where the host and services monitored in Nagios did not show any issues( No hard alert or services change picked up in Nagios) but the ticketing tool(TSOM) captured alerts for monitored services.
on Investigation we found that there was no issues on any of the services the servers/services in Nagios and they are all up and running fine from 4-5 days. We send the SNMP traps to ticketing tool(BMC TSOM) and the tool has picked up the false alerts and the sources are clear that it is from Nagios. But no such events/issues entry found in Nagios.

Any suggestions or help will be great, thank you.

[cdienger]

I assume you're using the SNMP Trap Sender component(https://assets.nagios.com/downloads/nag ... ios-XI.pdf) to send traps that are triggered by alerts in Nagios, but can you confirm?

You mention that you do not see any HARD alerts in Nagios or changes. Can you clarify - does this mean you don't see any SOFT alerts? Have you run a State History report(Reports > Available Reports > State History) for the hosts/services in question?

The SNMP Trap Sender component sends alerts for both HARD and SOFT states by default. Can you confirm the setting you're using?

[deek]

Yes Cdienger. We use snmptraps.
We were not able to see any soft alerts at that poitn of time.
Is there a chance where at that point of time nagios would have failed log all the soft and hard events due to load issue?

[ssax]

If you had crashed tables they could be missing from the XI web interface but should be accessible though the archive log files if there were run:

Code: Select all

/usr/local/nagios/var/archives

Do you see them in there? Note that you'll need to use the following day in the filename of the archives files because they are truncated at 12am the next day, so to view archive data from the 12th you would like at the file with the name of the 13th.

Please PM me that file and copy of your profile.zip from Admin > System Profile.

PM me the host/servicename in question the date/time of the events.