Page 1 of 1
Contact Host and Service Event Handler/Notification Commands
Posted: Thu Apr 02, 2026 12:28 pm
by logisbk
We have certain subset of hosts/service in our environment that we would like to generate tickets when there is an issue. These hosts are assigned a specific contact. I have created two event handlers (host event handler and service event handler) that will create tickets, and under the contact Alert Settings tab, select Manage Host/Service Notification Commands > select the respective Command/Event Handler. This is working correctly if the contact is assigned directly to a Host or Service. What I found that doesn't appear to work, is if the Contact if inherited it will not use the event handler (host/service notification command) as defined in the contact.
For example, Host A has the contact directly assigned and works as expected. There are two Services associated, Service 1 and Service 2. Service 1 has the contact directly assigned and works as expected. Service 2 has no contacts or contact groups directly assigned, so I would expect the behavior to be that it inherits the contact from the host, and thus will use the event handler. Service 2 does not generate tickets as expected.
Anything I am missing or explanation for this not working?
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Thu Apr 02, 2026 2:58 pm
by bbahn
Please verify that your inheritance isn't being negated. Services have some very particular rules around whether they will and what they will inherit from their host.
https://assets.nagios.com/downloads/nag ... tsnew.html
Contact Inheritance - According to the documentation, contacts should only be inherited from host to service if the service has no other contacts whatsoever (and the same goes for escalations), but the way the code previously worked was that it handled contact_groups and contacts directives separately, meaning services with only 'contacts' specified were still eligible for inheriting 'contact_groups' from the host. This has been updated to comply with the documentation.
https://assets.nagios.com/downloads/nag ... nheritance
It actually looks like event handlers are not inherited implicitly, so if you're trying to rely on implied inheritance, it will not work and you'll have to more directly configure the inheritance.
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Mon Apr 06, 2026 3:20 am
by JellyFish
Even though the contact itself is inherited from the host
wacky flip, the notification command selection isn’t always resolved the same way at the service level. In practice, services tend to rely on their own notification context, not just the inherited contact object.
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Mon Apr 06, 2026 10:26 am
by -SN
Also make sure that you're not crossing the streams.
"Event Handlers"
Named for what they are supposed to do, logically handle "on-state-change" events for a host or service objects, event handlers are a great part of Nagios. Handling an event could be anything from forwarding the event to an upstream processor like ServiceNow or PagerDuty to triggering a workflow to tear down an rebuild a virtualized guest.
Couple of things to be aware of with event handlers.
- Assigned at the object level
- Only runs on-state-change
- Host and Services have their own macros
- Not all Nagios macros are available to event handlers
- Need to interpret object-type
- Need to interpret downtime-depth
- Need to interpret state
- Need to interpret state-type
- Requires guarding against check volatility
"Notification Commands"
Using the built-in notification methods of NagiosXI you can assign contacts a command that will be executed for both host and service issues. These commands exist and are executed within the boundaries of XI notification settings and don't require as many bumper guards to be created as with event handlers.
Notification commands are in general, less complex to use.
- Assigned at the contact level
- Separate command for hosts and services
- Uses object notification settings
- Provides path for escalation
- Notification specific Nagios macros
- Some object level macros are available to notification commands
Either route you take, macros are at the heart of it all so keep these handly
https://assets.nagios.com/downloads/nag ... olist.html
https://assets.nagios.com/downloads/nag ... I-2024.pdf
Happy Monitoring,
--SN
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Tue Apr 07, 2026 7:48 am
by logisbk
@-SN I agree that this probably isn't ideal, I wanted to assign the Event handler for the specific hosts and Services in their Check Settings, but I don't know how to do this, except manually. If I put it in a template, I can only use the Bulk Mod Tool to 'Change Templates', which would wipe out any current templates. This is for hundreds of hosts/services and the contact is already assigned to them.
Below is the host notification command provided by our ITSM software:
Code: Select all
curl -X POST -H "Authorization: {Use Password token here without these brackets}" -H "Content-Type: application/json" --data "{"metric_name": "Availability", "hostname": "$HOSTNAME$", "message": "$NOTIFICATIONTYPE$ - $HOSTNAME$ is $HOSTSTATE$", "ip_address": "$HOSTADDRESS$", "severity": "$HOSTSTATE$", "event_id": "$HOSTEVENTID$", "output": "$HOSTOUTPUT$", "perf_data": "$HOSTPERFDATA$", "action_url": "$HOSTACTIONURL$", "check_command": "$HOSTCHECKCOMMAND$", "problem_id": "$HOSTPROBLEMID$" , "long_datetime": "$LONGDATETIME$", "notification_comment": "$NOTIFICATIONCOMMENT$", "notification_type": "$NOTIFICATIONTYPE$", "contact_name": "$CONTACTNAME$", "last_problem_id": "$LASTHOSTPROBLEMID$" }" /api/notify/nagios
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Tue Apr 07, 2026 9:07 am
by -SN
logisbk wrote: ↑Tue Apr 07, 2026 7:48 am
Below is the host notification command provided by our ITSM software:
Code: Select all
curl -X POST -H "Authorization: {Use Password token here without these brackets}" -H "Content-Type: application/json" --data "{"metric_name": "Availability", "hostname": "$HOSTNAME$", "message": "$NOTIFICATIONTYPE$ - $HOSTNAME$ is $HOSTSTATE$", "ip_address": "$HOSTADDRESS$", "severity": "$HOSTSTATE$", "event_id": "$HOSTEVENTID$", "output": "$HOSTOUTPUT$", "perf_data": "$HOSTPERFDATA$", "action_url": "$HOSTACTIONURL$", "check_command": "$HOSTCHECKCOMMAND$", "problem_id": "$HOSTPROBLEMID$" , "long_datetime": "$LONGDATETIME$", "notification_comment": "$NOTIFICATIONCOMMENT$", "notification_type": "$NOTIFICATIONTYPE$", "contact_name": "$CONTACTNAME$", "last_problem_id": "$LASTHOSTPROBLEMID$" }" /api/notify/nagios
From the snippet you provided, it does look like the expected method of execution is "notification".
IMHO, a small python/bash script to make the post is where I'd go with it.
You can use the API to assign the contact if the bulk modification tool is not your jam.
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Tue Apr 07, 2026 9:19 am
by logisbk
This is for HaloITSM, if anyone has experience, as they really don't provide any documentation. Just the configuration page for the integration where they give you the curl commands for Host and Service, like the one I posted and it says
Tickets can be created in Halo whenever an Alert is triggered in Nagios.
To enable this functionality, create outgoing webhooks in Nagios for the Host-Alert, Service-Alert events.
So maybe these aren't really 'Event Handlers', and are meant to be used as Notification Commands, which is what I'm trying to do. I did previously test using them as Event Handlers defined on the Host/Service and that worked to create tickets as well.
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Tue Apr 07, 2026 9:46 am
by -SN
Ah, Halo..
I did an integration with halo service desk. If I remember the project correct, I had to play with oauth and map the ticket type, state and the severity.
I'll see if I can dig up that code.
haloitsm:
URL no trailing slash!
base_url: "
https://instance.haloservicedesk.com"
Oauth2 client credentials:
Configuration > Integrations > HaloITSM API, type = Client ID and Secret.
client_id
client_secret
auth:
For hosted instances use
https://auth.haloservicedesk.com
auth_url: "
https://your-instance.haloservicedesk.com"
Ticket type ID for incidents "GET /api/TicketType"
tickettype_id:
new = 1
resolved = 24
Default Halo priority mapping for Nagios states.
Nagios state: Halo priority_id.
state_map:
CRITICAL: 1
DOWN: 1
UNREACHABLE: 2
WARNING: 3
UNKNOWN: 4
UP: 4
OK: 4
Re: Contact Host and Service Event Handler/Notification Commands
Posted: Wed Apr 08, 2026 2:45 am
by justindev
logisbk wrote: ↑Thu Apr 02, 2026 12:28 pm
We have certain subset of hosts/service in our environment that we would like to generate tickets when there is an issue. These hosts are assigned a specific contact. I have created two event handlers (host event handler and service event handler) that will create tickets, and under the contact Alert Settings tab, select Manage Host/Service Notification Commands > select the respective Command/Event Handler. This is working correctly if the contact is assigned directly to a Host or Service. What I found that doesn't appear to work, is if the Contact if inherited it will not use the event handler (host/service notification command) as defined in the contact.
For example, Host A has the contact directly assigned and works as expected. There are two Services associated, Service 1 and Service 2. Service 1 has the contact directly assigned and works as expected. Service 2 has no contacts or contact groups directly assigned, so I would expect the behavior to be that it inherits the contact from the host, and thus will use the event handler. Service 2 does not generate tickets as expected.
Anything I am missing or explanation for this not working?
wheelie life
Yeah honestly this looks more like a notification setup than event handlers, especially with Halo saying “outgoing webhooks for Host/Service alerts”. I ran into something similar before and ended up switching fully to notification commands—it was way more consistent.
Event handlers can work, but they get tricky with inheritance and only firing on state changes. With notifications tied to the contact, it behaves a lot more predictably across hosts/services (even with inheritance in play).
For the bulk side of things, I feel your pain. I’d probably avoid changing templates and instead either script it via the API or just attach a dedicated contact/contact group for ticketing.
Takes a bit to set up, but saves headaches later