Nagios Support Forum

Hello everyone,

I'm trying to configure alerting in Nagios XI so that the behavior differs based on the service state severity (WARNING or CRITICAL), without duplicating services.

Objective
I want a single service to behave as follows:

WARNING: Send the first notification only if the state persists for 15 minutes

CRITICAL: Send the first notification only if the state persists for 10 minutes

The problem
As far as I understand:

max_check_attempts and retry_interval are defined per service, not per state, so I can't have different persistence times for WARNING and CRITICAL in a single service.

notification_delay also applies to the entire service, not per state.

Service Escalations do allow setting different notification_interval values per severity, but they do not control when the first notification is triggered.

What I've already tried
A single service with separate escalation levels for WARNING and CRITICAL.

Controlling re-notification frequency using notification_interval per escalation level.

Tried simulating delay using max_check_attempts × retry_interval, but that applies equally to all states.

Question
Is there any native way, plugin, macro, or condition within Nagios (or even via an event handler) to achieve different delays before sending the first alert depending on whether the state is WARNING or CRITICAL, without duplicating services?

Any suggestions or shared experiences are very welcome.

Thanks in advance

Here's my suggestion
Implement a custom event handler script that tracks how long the state has been alive. Only fire notifications after a threshold you've defined (e.g. 10 minutes for CRITICAL, 15 minutes for WARNING). This bypasses the `max_check_attempts` constraint.

Use the `service_state` and `last_state_change` macros
Add a lightweight delay check logic + state-persistence
Manually call notification scripts

Hope this helps