Dynamic warning/critical thresholds

[C. Bensend]

> I've got a bunch of Nagios plugins that monitor things like
> DNS/HTTP/RADIUS hits per second.
>
> I've set what I believe to be sensible max/min warning thresholds but
> what I really want is dynamic thresholds. If some quantity suddenly
> doubles or halves, I'd like an alert.
>
> For example, if I usually serve 10 DNS lookups per second, and suddenly
> it is doing 20 per second, that isn't a "fault" but I would like to know
> about it, because it might mean there is a problem with the network in
> general.
>
> Is there a way of doing this?

There's always a way.  :)

However, in this case, you're probably going to have to write a
plugin to do it.  You're asking to alert on a rate of change, and
I can't think of any of the stock plugins that do that.  Keeping state
between polling runs is something that can get a big ugly.

Do some rooting around the plugin community (the Nagios Exchange
and/or the Monitoring Exchange) to see if you can find some
examples of rate-aware plugins.  While it's not rate that it's
tracking, I know the check_iptraf*.pl plugins will at least keep
state between polling cycles, so that might be somewhere to start.

Benny


-- 
"Death rays, advanced technology or not, no creature wants to be
stabbed in their hoo-hoo."        -- Seen on zombiehunters.org


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null