Page 1 of 2

Notifications report is "possessed"....

Posted: Thu Jan 10, 2013 10:31 am
by Brian_M
Hello All,

I was awakened at 6 this morning by a panicked application owner in Poland that told me one of his production servers has been down for the past 8 hours. After getting the server issue sorted, I checked the notification log for this server to see if staff were notified and saw that emails were indeed sent to the proper persons / groups, but also a bunch of other persons / groups that were not specified in the host / service configuration (e.g. Uzbekistan, Armenia, Mongolia, Ukraine admins were alerted to a problem in Poland, Lotus Notes administrators were also lumped into the notifications report although this application has nothing to do with Lotus Notes).

Specified teams did receive email notifications, but the others did not (even though the report indicates they were sent out). Is this a known bug? I found a similar report here in the forums which is locked and was handled via support ticket.

In the below attachment, the following users / group contacts are correct (stan, nagiosadmin, ipower_admin, cz_admin, problem_admin), the rest are seemingly pulled at random and have nothing to do with this server and these users are not on any contact lists regarding this host (ln_admin, uz_admin, am_admin, aura_admin, etc.). Also note that different users / groups are notified on each polling cycle.

Thanks,
Brian
notification report.png

Re: Notifications report is "possessed"....

Posted: Thu Jan 10, 2013 10:41 am
by slansing
While we pick our brains on this, could you link to the support forum thread that was related to this one and locked? We may be able to resurrect the ticket and take a look. Can you also upload your latest config snapshot? If you feel it should not be uploaded to the public you can send it to [email protected] or PM one of the staff here.

Re: Notifications report is "possessed"....

Posted: Thu Jan 10, 2013 10:49 am
by Brian_M
As always, thanks for the quick response =)

http://support.nagios.com/forum/viewtop ... ons#p38435 (this problem is mentioned in the 2nd post by the original OP)

Re: Notifications report is "possessed"....

Posted: Thu Jan 10, 2013 10:59 am
by slansing
Great thanks, looking into it now, do you remember the forum thread's name which you were looking at?

(EDIT: Did not notice thread post above)

Re: Notifications report is "possessed"....

Posted: Mon Jan 14, 2013 11:16 am
by Brian_M
Link to thread where it's also mentioned is in my above post... thread was named "notification oddity"

Re: Notifications report is "possessed"....

Posted: Mon Jan 14, 2013 12:39 pm
by scottwilkerson
About the only thing I can think of that might cause this would be multiple instances of Nagios, or someone Nagios got out of sync with ndoutils, so lets eliminate that as a possibility.

Code: Select all

service nagios stop
killall -9 nagios
service ndo2db restart
service nagios start

Re: Notifications report is "possessed"....

Posted: Wed Jan 16, 2013 8:45 am
by Brian_M
Sorry, few minutes after trying the above I received more "possessed" notification warnings :-(

-Brian

Re: Notifications report is "possessed"....

Posted: Wed Jan 16, 2013 12:16 pm
by scottwilkerson
What version of XI are you using?

Re: Notifications report is "possessed"....

Posted: Thu Jan 17, 2013 3:18 am
by Brian_M
Nagios XI Version : 2012R1.3
ceeprgpmon01.cee.ema.ad.pwcinternal.com 2.6.32-279.14.1.el6.i686 i686
CentOS release 6.3 (Final)
Gnome Installed

Re: Notifications report is "possessed"....

Posted: Thu Jan 17, 2013 5:39 pm
by scottwilkerson
This is so bizarre, I cannot replicate it at all...

You may need to send a current /usr/local/nagios/var/objects.cache for us to dif into.

Please send to [email protected] and reference this thread.