<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:o = "urn:schemas-microsoft-com:office:office" xmlns:w = "urn:schemas-microsoft-com:office:word"><HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META content=Word.Document name=ProgId> <META content="MSHTML 6.00.2800.1400" name=GENERATOR> <META content="Microsoft Word 10" name=Originator><LINK href="cid:filelist.xml@01C43E5A.378A3640" rel=File-List> <STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; mso-header-margin: .5in; mso-footer-margin: .5in; mso-paper-source: 0; } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline; text-underline: single } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline; text-underline: single } A:visited { COLOR: purple; TEXT-DECORATION: underline; text-underline: single } SPAN.MsoHyperlinkFollowed { COLOR: purple; TEXT-DECORATION: underline; text-underline: single } SPAN.EmailStyle17 { COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose; mso-style-noshow: yes; mso-ansi-font-size: 10.0pt; mso-bidi-font-size: 10.0pt; mso-ascii-font-family: Arial; mso-hansi-font-family: Arial; mso-bidi-font-family: Arial } SPAN.SpellE { mso-style-name: ""; mso-spl-e: yes } SPAN.GramE { mso-style-name: ""; mso-gram-e: yes } DIV.Section1 { page: Section1 } </STYLE> </HEAD> <BODY lang=EN-US style="tab-interval: .5in" vLink=purple link=blue> <DIV>It was my finding (and I have been wrong before) that the children "Services" won't report being down but the children "Hosts" will. That is why we don't do any notifications on just Hosts at all. We are only using notifications for services on the various hosts. We make sure we have at least one Service per host to validate that the host itself is working. We use the same check_ping that the Host Check does but we do it as a service so when a blocking host goes down we don't get any children notifications.</DIV> <DIV> </DIV> <DIV>I could be wrong and if someone knows of a better way without entering every single host in the dependencies.cfg that would be great to hear about it.</DIV> <DIV> </DIV> <DIV> </DIV> <DIV class=OutlookMessageHeader dir=ltr align=left>-----Original Message----- From: nagios-users-admin@lists.sourceforge.net [mailto:nagios-users-admin@lists.sourceforge.net]On Behalf Of ling Zhang Sent: Thursday, May 20, 2004 1:04 PM To: nagios-users@lists.sourceforge.net Cc: 'Gregory Bell'; harper.mann@comcast.com; CHui Subject: [Nagios-users] False positives after the Parent host recovered </DIV> <DIV class=Section1> Hi,<o:p></o:p> <o:p> </o:p> I hope to get your input on a frustrating problem. Right after a “parent” host goes down and recovers, I receive a burst of notifications indicating that downstream “children” have gone down & recovered, even though that’s not the case. Although this behavior doesn’t happen every time a “parent” node goes down, my impression is that the odds are greater than 30%. <o:p></o:p> <o:p> </o:p> For example, suppose this my network:<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Nagios--------Bridge------Parent Switch--------Child switch1<o:p></o:p> |<o:p></o:p> |<o:p></o:p> Child Switch2--------Child switch3<o:p></o:p> <o:p> </o:p> The series of events go like this:<o:p></o:p> <o:p> </o:p> 1. Disconnect link between "Bridge" and "parent switch". <o:p></o:p> 2. Nagios reports and only reports "parent switch" down. (good) <o:p></o:p> 3. Re-connect link between "Bridge" and "parent switch". <o:p></o:p> 4. Nagios reports "parent switch" recovered. (very good)<o:p></o:p> 5. Nagios reports "child switch1" and "child switch2" down right after "parent switch" recovered. (what the?) <o:p></o:p> 6. Nagios reports "child switch1" and "child switch2" recovered shortly. (????????)<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Now, My nagios host configuration for the testing network looks like this:<o:p></o:p> <o:p> </o:p> define host{<o:p></o:p> name generic-Bridge<o:p></o:p> notifications_enabled 1 ; Host notifications are enabled<o:p></o:p> event_handler_enabled 1 ; Host event handler is enabled<o:p></o:p> flap_detection_enabled 0 ; Flap detection is enabled<o:p></o:p> process_perf_data 1 ; Process performance data<o:p></o:p> retain_status_information 1 <o:p></o:p> retain_nonstatus_information 1 <o:p></o:p> check_command check-host-alive<o:p></o:p> max_check_attempts 3<o:p></o:p> notification_interval 0<o:p></o:p> notification_period 24x7<o:p></o:p> notification_options d,r<o:p></o:p> register 0 <o:p></o:p> }<o:p></o:p> <o:p> </o:p> <o:p> </o:p> define host{<o:p></o:p> name generic-switch ;<o:p></o:p> notifications_enabled 1 ; Host notifications are enabled<o:p></o:p> event_handler_enabled 1 ; Host event handler is enabled<o:p></o:p> flap_detection_enabled 0 ; Flap detection is enabled<o:p></o:p> process_perf_data 1 ; Process performance data<o:p></o:p> retain_status_information 1 <o:p></o:p> retain_nonstatus_information 1 <o:p></o:p> check_command check-host-alive<o:p></o:p> max_check_attempts 3<o:p></o:p> notification_interval 0<o:p></o:p> notification_period 24x7<o:p></o:p> notification_options d,r <o:p></o:p> register 0 <o:p></o:p> }<o:p></o:p> <o:p> </o:p> <o:p> </o:p> define host {<o:p></o:p> use generic-bridge<o:p></o:p> host_name Bridge<o:p></o:p> address 1.1.1.1<o:p></o:p> } <o:p></o:p> <o:p> </o:p> <o:p> </o:p> define host {<o:p></o:p> use generic-switch<o:p></o:p> host_name parent-switch<o:p></o:p> address 1.1.1.10<o:p></o:p> parents Bridge<o:p></o:p> } <o:p></o:p> <o:p></o:p> define host {<o:p></o:p> use generic-switch<o:p></o:p> host_name child-switch1<o:p></o:p> address 1.1.1.11<o:p></o:p> parents parent-switch<o:p></o:p> }<o:p></o:p> <o:p></o:p> <o:p> </o:p> define host {<o:p></o:p> use generic-switch<o:p></o:p> host_name child-switch2<o:p></o:p> address 1.1.1.12<o:p></o:p> parents parent-switch<o:p></o:p> }<o:p></o:p> <o:p> </o:p> <o:p> </o:p> define host {<o:p></o:p> use generic-switch<o:p></o:p> host_name child-switch3<o:p></o:p> address 1.1.1.13<o:p></o:p> parents child-switch2<o:p></o:p> }<o:p></o:p> <o:p> </o:p> <o:p> </o:p> So, any idea on this?<o:p></o:p> <o:p> </o:p> Thanks.<o:p></o:p> <o:p> </o:p> Ling<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p></DIV> _____________________________________________________________________ Message scanned for viruses _____________________________________________________________________ This message has been checked for all known viruses </BODY></HTML>