Passive service on Windows 2003 box notifies intermittently

[Marc Powell]

On Nov 19, 2009, at 8:50 AM, C. Bensend wrote:


> Nov 19 08:20:12 hostname nagios: SERVICE ALERT: winhost;System
> EventLog;CRITICAL;HARD;1;System [info] [USER32 #1074]: The process
> svchost.exe has initiated the restart of computer WINHOST on behalf of
> user NT AUTHORITY\SYSTEM for the following reason: No title for this
> reason could be found  Reason Code: 0x80070020  Shutdown Type: restart
> 
> -- OK, Nagios generates a service alert here.  Yay.  But ...
> 
> Nov 19 08:20:12 hostname nagios: PASSIVE SERVICE CHECK: winhost;System
> EventLog;2;System [info] [USER32 #1074]: The process Explorer.EXE has
> initiated the restart of computer WINHOST on behalf of user DOMAIN\me for
> the following reason: Application: Maintenance (Planned)  Reason Code:
> 0x84040001  Shutdown Type: restart  Commen
> 
> 
>   That's it.  No notification.  No nothing else, and I didn't skip
> any log entries other than one of the NSClient++ services getting a
> connection refused while the host was rebooting.

The service was already in a HARD non-OK state, no additional notification would be sent.

>   And what makes this worse is that it's not consistent - I get the
> entries from NSCA every time, but I only get the notifications SOME
> of the time.  Here is one that *did* work:

Another possibility is host checks. What is the state of the host when you *do not* receive a notification? You're rebooting it so it's going to be seen as non-OK, depending on the timing of this last passive check. Notifications for services on non-OK hosts are automatically suppressed.

>   This is the first time I've done anything with passive service
> checks; am I just not understanding something silly?  Or .. ?

They're really not treated much differently than active checks; especially in this regard. A non-OK service check results in a check of the host to make sure it's still up (depending on caching options you have set). If the host is down, notifications for services are suppressed.

--
Marc




------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null