Expiring acknowledgements

[Marc Powell]

On Jan 23, 2009, at 4:11 PM, Frank Clements wrote:

> Hello,
>
> I'm wondering if there is anyone out there in user-land that has any  
> process
> of expiring acknowledgements after a certain time period.  I've done  
> some
> searching and came up mostly empty handed.  I've seen a mention of  
> using SEC
> to carry this out, but I'm completely unfamiliar with SEC.  If this  
> is the
> way to go I'm game for looking into using it.
>
> Anyone out there doing something like this and care to share how?

Sort of... I've written a perl script that does it based on some other  
criteria. When we acknowledge something, the comment is always a  
ticket number. I periodically troll the comments list (extinfo.cgi? 
type=3), pull out the hostname, service name, current state, ticket  
number and comment id number.

#!/usr/bin/perl

my $echocmd="/bin/echo";
my $CommandFile="/usr/local/nagios/var/rw/nagios.cmd";
my $LogFile="/usr/local/nagios/var/commentmgr.log";
my $CommentsPage="http://nagios/cgi/extinfo.cgi?&type=3";
my $AuthInfo="username:password";
my $GetCommand="/usr/bin/GET -C $AuthInfo \"$CommentsPage\"";
my ($datetime,$cmdline,$input,$state,$status);

open (COMMENTS, "$GetCommand |");
while (<COMMENTS>) {
         $input = $_;
         chomp ($input);
         next if !($input =~ /(OK)|(CRITICAL)/);
         next if ($input =~ /flapping/);
         next if ($input =~ /scheduled for downtime/);
         ($tempname = $input) =~ s/.*type=2\&host=(.*)\&service=([\w\ 
%2d\+\-\.]+)\'.*/$1 $2/;
         ($host,$service) = split (/ /,$tempname);
         ($ticket = $input) =~ s/.*\w\w(\d\d\d\d\d\d\d).*/$1/;
         next if ($ticket =~ /Delete/);
         $state = "OK" if ($input =~/(OK)/);
         $state = "CRITICAL" if ($input =~/(CRITICAL)/);
         ($comment=$input) =~ s/.*com_id\=(\d+).*/$1/;

(ticket verification removed)

If the state is OK and the ticket is closed, remove the comment.

         # create the command line to add to the command file
         # Ticket is closed and state is OK. All is well.
         if (($status == "closed") && ($state eq "OK")) {
                 $cmdline="[$datetime] DEL_SVC_COMMENT;$comment\n";
                 $action = localtime($datetime) ." - $ticket - host:  
$host - service: $service - state: $state - ticket: $statustext  
($status) -  Deleted Comment\n";
                 # append the command to the end of the command file
                 system("$echocmd \"$cmdline\" >> $CommandFile");
		# Log it.
                 system("$echocmd \"$action\" >> $LogFile");
         }

If the state is Critical and the ticket is closed, remove the comment  
and acknowledgement so that it's prominent again

         # create the command line to add to the command file
         # Ticket is closed and state is CRITICAL. Premature  
closeation. All is not well.
         if (($status == "closed") && ($state eq "CRITICAL")) {
                 $cmdline="[$datetime] REMOVE_SVC_ACKNOWLEDGEMENT; 
$host;$service\n[$datetime] DEL_SVC_COMMENT;$comment\n";
                 $action = localtime($datetime) ." - $ticket - cid:  
$comment - host: $host - service: $service - state: $state - ticket:  
$statustext ($status) -  Deleted Comment and Acknowledgement\n";
                 # append the command to the end of the command file
                 system("$echocmd \"$cmdline\" >> $CommandFile");
		# Log it.
                 system("$echocmd \"$action\" >> $LogFile");
         }
}

That's the bulk of it. You'd just need to parse the date out of the  
comment line, convert it to something testable (epoch time, for  
example) and change the test case.

HTH,

marc


------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null