NagiosXI alert email links display "Bad Ticket" when clicked

[KiwiBloke]

Hi,

I've been advised that both our Nagios servers are sending alert emails as expected, but that when users click the link in the email to respond to the alarm or fault the page on the nagios server simply responds with "Bad Ticket".

I do not have a clear indication of how long this has been happening, but that it is happening to both is unusual. Both servers are running NagiosXI 2011R.3.3.

Can you advise, where i can start looking for issues first?,, the current config loads and commits without any errors.

Cheers,

C.

[sreinhardt]

Let's try to answer a couple questions to narrow things down a bit.

1) Is this happening for a single person, multiple people but not everyone, or all users?

2) When such a thing happens, is the alert going back to resolved\up or staying warning\critical?

[KiwiBloke]

Hi,

sorry for the delay..

1.
The link being clicked is on the email sent out to the nagiosadmin contact, This link should take you directly to the object device screen where you can see the current state and choose to put it into maintenance mode, or acknowledge the current situation. So this link could be clicked by anyone as nagios should allow this link (ticket) though. but instead all we see is "bad ticket".

2.
We see this behavior on things that have resolved (high cpu load) and things that are still in effect (eg disk usage)

Cheers,

[lmiltchev]

Is the response url link "clickable" or you copy/paste in the browser's address bar? You will get "Bad ticket" error message if there is a character missing...

[KiwiBloke]

Hi,

both. if you click the link you get "bad ticket", and if you copy and paste the entire url you get bad ticket.

eg http://<servername>/nagiosxi//rr.php?uid=18--1-16fcd3f8654d7504574255243a83cd13

[lmiltchev]

It seems like you have two dashes "--" in the URL (between "18" and "1"), where you should have only one. So, instead of this:

Code: Select all

http://<servername>/nagiosxi//rr.php?uid=18--1-16fcd3f8654d7504574255243a83cd13

you should have this:

Code: Select all

http://<servername>/nagiosxi//rr.php?uid=18-1-16fcd3f8654d7504574255243a83cd13

Try removing one of the dashes and try again.

BTW, I have no idea why you have two dashes. We haven't seen this issue before, and the code hasn't changed from version 2011R2.3.

[KiwiBloke]

Hi,

Sorry for the delay in replying, we have been running a skeleton crew over Christmas and we are all finally back at work so I can look back at some of these "low" priority issues.

I tested that double dash theory on a recent alert and you are correct. instead of getting invalid ticket we actually get a sensible answer.

however, although i could acknowledge the event and schedule downtime, i did get an error when I attempted to view the host details

The error was:

Not Authorized
You are not authorized to view the requested object, or the object does not exist.

We seem to be seeing alot of these sorts of errors (permission) , as when I view a Host/Service and expect to see charts, I often see these errors aswell (even though I am logged in as nagiosadmin), The status details alway seem to say pending lask check neer, and next check not scheduled, with the current service check showing as pending.

The service attributes also all show as red, and don't respond to being turned 'on'.

I am begining to wonder if i just don't replace these boxes with your newer version and be done with it!

[scottwilkerson]

Can you run the following command for about a minute or so (or until a few notifications get sent out from Nagios), and then send us the output file: myevents.log?

Code: Select all

tail -f /usr/local/nagiosxi/var/eventman.log | tee myevents.log

[KiwiBloke]

Hi,

Sorry for the late reply, its been an 'exciting' month.

attached is the log you requested.

Cheers,

KB

[scottwilkerson]

Boy is this strange, I cannot replicate it but maybe it was a bug specifice to 2011R3.3.

Can I have you unzip the attached file and place it in
/usr/local/nagiosxi/html/includes

and see if it removes the extra -