Flapping and notifications

[Rafael Barbosa]

Hi again,

I edited the Nagios history log, because the original was too big to be sent
on the list. All information is still there though. Sorry by the
inconvenience.

The original message is bellow.

Best regards,
Rafael Barbosa

---------- Forwarded message ----------
From: Rafael Barbosa <rrbarbosa at gmail.com>
Date: Fri, Aug 8, 2008 at 8:59 AM
Subject: Flapping and notifications
To: nagios-users at lists.sourceforge.net


Hello everybody,

I have been using Nagios for about 4-5 months now to monitor a small network
(we are expanding the number of hosts soon) at my university. Our goal is to
be aware of the status of the hosts and some services on the network, and be
notificated every time something goes wrong, task for which Nagios seems
perfectly suitable.

By analyzing the last days logs I encountered a strange situation. In two
occasions I received two consecutive Critical state notifications for the
PING check without receiving a Warning or OK notification in between, and
this situation happened more then once. I have been looking on the "Host
Alert History" to try to figure out why these notifications were sent, when
I got even more lost. In some cases on the alert history I don't see the
HARD state change that would trigger the alert. My best guess is that these
consecutive notifications are cause by flapping of the host/device, but I am
not sure about it. After I enabled flapping notifications I did not see this
problem anymore, but maybe I just dont have enough data to observe this
problem. Note that when the problem happened, flapping was detected but not
notificated. Another thing that I miss on my log is that sometimes I dont
see the "Flapping Stopped" alert on the log, which makes even more difficult
to find the cause of the problem.

These are the two critical notifications I got from "Host Notifications" and
attached is the "Host Alert History" for the same day (hope is not too big).

ubisense1105<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=1&host=ubisense1105>
PING<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=2&host=ubisense1105&service=PING>
OK 2008-08-01 18:38:20
nagiosadmin<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=contacts#nagiosadmin>
notify-service<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=commands#notify-service>
PING
OK - Packet loss = 0%, RTA = 1.88 ms
ubisense1105<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=1&host=ubisense1105>
PING<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=2&host=ubisense1105&service=PING>
CRITICAL 2008-08-01 17:14:30
nagiosadmin<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=contacts#nagiosadmin>
notify-service<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=commands#notify-service>
PING
CRITICAL - Packet loss = 100%
ubisense1105<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=1&host=ubisense1105>
PING<http://www.sensordatalab.org/nagios/cgi-bin/extinfo.cgi?type=2&host=ubisense1105&service=PING>
CRITICAL 2008-08-01 12:42:30
nagiosadmin<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=contacts#nagiosadmin>
notify-service<http://www.sensordatalab.org/nagios/cgi-bin/config.cgi?type=commands#notify-service>
PING
CRITICAL - Packet loss = 100%
Does anybody knows what could cause this behaviour? When a host is flapping,
notifications about its services are still issued? How is decided what is
logged on the "Host Alert History"?

Best regards,
Rafael Barbosa
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.monitoring-lists.org/archive/users/attachments/20080808/369d1eea/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: History.pdf
Type: application/pdf
Size: 19230 bytes
Desc: not available
URL: <https://www.monitoring-lists.org/archive/users/attachments/20080808/369d1eea/attachment.pdf>
-------------- next part --------------
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-------------- next part --------------
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null