The existing escalation_options directive in escalation definitions will likely get you this behavior without the need for a patch. <a href="http://nagios.sourceforge.net/docs/3_0/escalations.html">http://nagios.sourceforge.net/docs/3_0/escalations.html</a> - see the very bottom of this page as well as the object definition documentation for escalation_options. Regards, Martin Melin <div class="gmail_quote">On Fri, Nov 6, 2009 at 3:49 AM, Mark Gius <<a href="mailto:mgius@createspace.com">mgius@createspace.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Currently, service notifications contain "first/last_notification" directives, that specify the range of notifications that the escalation should apply to. This method of escalation has a weakness however. At my work, we let warnings go to the default contact (which happens to be email), and escalate to a pager chain on critical. However, if a service sits in WARNING for a length of time (which is likely to happen in the middle of the night), by the time the service enters a CRITICAL state the notification count exceeds our highest escalation, and our entire team gets paged immediately. What I'd like to see is the ability to distinguish between a WARNING notification and a CRITICAL notification in the escalation, and set up escalation chains that work based on the number of CRITICAL's that have been sent, as opposed to the total number of notifications. I am planning on patching nagios to support this behavior if there isn't a way to achieve this behavior with the current implementation. My plan is to add a warning/critical count to service, add a first/last warning/critical state to service escalations, and add the directives "(first|last)_(warning|critical)_notification" to the service escalation configs. The idea is also to keep the current behavior (notification_count and first/last_notification would still be present), but allow finer grained control over when escalations are sent out. This way if somebody didn't want to use the finer grained control their behavior would stay the same. My current plan is to match the escalation if _any_ of the 3 notification ranges match (all/warning/critical). Any advice on making this behavior happen with Nagios as-is, or suggestions/advice on the implementation are welcome. -Gius ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. <a href="http://p.sf.net/sfu/bobj-july" target="_blank">http://p.sf.net/sfu/bobj-july</a> _______________________________________________ Nagios-users mailing list <a href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a> <a href="https://lists.sourceforge.net/lists/listinfo/nagios-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null </blockquote></div>