Support for Nagios products and services
https://support.nagios.com/forum/
Host States
Hosts that are checked can be in one of three different states:
UP
DOWN
UNREACHABLE
Host State Determination
Host checks are performed by plugins, which can return a state of OK, WARNING, UNKNOWN, or CRITICAL. How does Nagios translate these plugin return codes into host states of UP, DOWN, or UNREACHABLE? Lets see...
The table below shows how plugin return codes correspond with preliminary host states. Some post-processing (which is described later) is done which may then alter the final host state.
Plugin Result Preliminary Host State
OK UP
WARNING UP or DOWN*
UNKNOWN DOWN
CRITICAL DOWN
Note Note: WARNING results usually means the host is UP. However, WARNING results are interpreted to mean the host is DOWN if the use_aggressive_host_checking option is enabled.
If the preliminary host state is DOWN, Nagios will attempt to see if the host is really DOWN or if it is UNREACHABLE. The distinction between DOWN and UNREACHABLE host states is important, as it allows admins to determine root cause of network outages faster. The following table shows how Nagios makes a final state determination based on the state of the hosts parent(s). A host's parents are defined in the parents directive in host definition.
Preliminary Host State Parent Host State Final Host State
DOWN At least one parent is UP DOWN
DOWN All parents are either DOWN or UNREACHABLE UNREACHABLE
More information on how Nagios distinguishes between DOWN and UNREACHABLE states can be found here.
Host State Changes
As you are probably well aware, hosts don't always stay in one state. Things break, patches get applied, and servers need to be rebooted. When Nagios checks the status of hosts, it will be able to detect when a host changes between UP, DOWN, and UNREACHABLE states and take appropriate action. These state changes result in different state types (HARD or SOFT), which can trigger event handlers to be run and notifications to be sent out. Detecting and dealing with state changes is what Nagios is all about.
When hosts change state too frequently they are considered to be "flapping". A good example of a flapping host would be server that keeps spontaneously rebooting as soon as the operating system loads. That's always a fun scenario to have to deal with. Nagios can detect when hosts start flapping, and can suppress notifications until flapping stops and the host's state stabilizes. More information on the flap detection logic can be found here.