(Acknowledged) Host Down & (Open) Service critical not shown in Main Screen

[SchmuFoo]

Hello (again) :-)

one hosts has an (achknowledged) Alarm in Nagios, and one Check_MK service which has an open critical state.

The Host and Service are only visible in the "Show all" section.

I also tried to add that host in the "Critical Items" List but same behavior.

Is that the normal behavior, maybe due to the ACK of the Alarm? If yes, that would be not that good ;)

Cheers!

[SchmuFoo]

Relevant "Show all" Entry:

BTW: "Hidden services REGEX at main view" doesnt have any entrys

[SchmuFoo]

[SchmuFoo]

View from Nagios:

SMD connects via "Livestatus socket path" to Check_MK/Nagios (OMD Suite)

[nuxsmin]

Hello!

I'd need to check out if the host status is taken into account for filtering the service, because the filter message tells that is being filtered by the host status.

[SchmuFoo]

Good Morning .-)

I'd need to check out if the host status is taken into account for filtering the service, because the filter message tells that is being filtered by the host status.

I don't know exactly how to interpret your response, sorry :o)

If you are interessted we can do a live show/tell session via TeamViewer - Or I can supply more and uncleaned screenshots if you provide me an private contact possibility!

Cheers!

[nuxsmin]

Umm, don't worry, I've checked out the code and the event is not being shown on the main view because the host status, that is if the item state is 1 (or above) or the host state is 1 (or above), the event will be filtered out of the main view:

    private function getFilterState(EventInterface $item)
    {
        if ($item->getHostState()
            && $item->getState() > SERVICE_WARNING
            && $item->getHostState() >= HOST_DOWN
        ) {
            $item->setFilterStatus('Host Status');
            return true;
        }

        return false;
    }

[nuxsmin]

Good morning! :)

[nuxsmin]

And why that is done so?, because the host check has failed, you don't know exactly if the service is down due to the host issue, so I decided to filter out of the main view to keep it clean in the meantime the host status becomes ok.

[SchmuFoo]

But wouldn't it make sense to show up an down and acknowdledge'd host at least due to that feature:

"Critical items: a comma separated list of critical hosts/services that will be always shown (non OK states)."

?

With that in place colleagues all around would see immediately that a) is a problem with that host b) some colleague is already working on it

P.S.: I have checked "Show scheduled events" and after every logout and relogin from/to the config section, the checkbox is unchecked again

[nuxsmin]

Sorry, you're right, the item should be shown because it matches a regular expression, but the filtering is getting rid of that.

I'll take a look to the config issue too.

Kind regards

[nuxsmin]

Please, let me know if it works fine now.

[SchmuFoo]

Just tried it in an test folder an "Show scheduled events" setting is persistent now, thx.

But on the mainview I got now all Hosts, even the ones which normaly are only shown on the the "show more" page. Verbose: I see hosts with the note "Filter: No Regex Host & No Critical"

[SchmuFoo]

Better but not perfect again with the newest patch :-)

Now I have "34/52 notices" on the main page, and round about 80% still have "Filter: No Regex Host & No Critical" reason on the main page.

Following Level types:

Flapping
Warning
Critical

Since levels from 5 Minutes up to 130 Days

[nuxsmin]

Hello, I've done some tweaks and should be fine (I hope...). Please blank any regex on "Shown hosts REGEX at main view"

[nuxsmin]

Sorry for the inconvenience, but my testing environment is currently broken so I can't do any test...

[SchmuFoo]

Hmm the newest version of sysMonDash.class.php results in the following behavior:

The not wanted Hosts are still there in the main view, but now without the explanation ""Filter: No Regex Host & No Critical"

When I remove every regex from "Shown hosts REGEX at main view" and include my VIP Hosts only in the "Critical items", after saving and checking again the config I see: The default value in show hosts "/.*/" is listed again in the field. I also tried to add an ! in front of but the result of showing to much Hosts in the main view is still existing.

If I can test more and or If you want to do a TeamViewer Session just let me know!

Cheers and THX very much for your motivation!

[nuxsmin]

You're welcome ;)

The current behavior is to show all host and services that have a problem (non OK status), BUT some items will be filtered out when the status isn't so accurate because a dependent host/service or it's acknowledged.

The "VIP" hosts/service regex is useful to always show those items regardless other filtering, but if you only need to show some hosts/services, you need to create a "Shown hosts REGEX at main view" regex that matches those items (it could be very hard to maintain...).

I've just pushed a revision to not set the default hosts regex

[SchmuFoo]

I exchanged the ConfigData.class.php with the current one, but still got /.*/after clearing/saveing/reopen the config. Also checked the file via vim and checked permissions to make sure I realy use the new one ;)

I fully understand the current behavior and due to that I used the "Shown hosts REGEX at main view" since the beginning and it worked fine - Since this -> d7de7d8 ;-)

[nuxsmin]

In the meantime, you could edit the SMD config file located in /etc/sysMonDashand set the regex.

Which hosts are currently shown?

[SchmuFoo]

item type="criticalItems"^COMPANYNAME|^..CA|^..SE|!^..LX|ATBA....cut... item>
&
regexHostShow ^COMPANYNAME|^..CA|^..SE|!^..LX|ATBA...cut.......

But on the Main View I got f.e. also:

CRITICAL 2d 13h 30m 45s DECS..... CRITICAL - Socket timeout after 10 seconds
WARNING 116d 13h 1m 39s ROBA.... CRITICAL - 10.....: rta nan, lost 100%
FLAPPING 6d 20h 31m 13s SABA... OK - 10.....: rta 210.430ms, lost 0%

[nuxsmin]

Did you tested the regex?, i think that the ^ could be set only once​, at the beginning of the pattern and then enclose the words within () and many pipes to catch any word.

[nuxsmin]

And critical items should be separated by commas, it isn't a regular expression

[SchmuFoo]

I use that exact RegEx Style in my old running version of SMD and its working fine there .-)

I've done a little test in the current version:

Even with only one Host without any regex stuff, the main view filter doesnt reflect it. I got nearly all host and services Alarms -> 41/70 notices

[nuxsmin]

Please, try out the latest commit, the issues should be already solved.

[SchmuFoo]

We're close, very close :-)

• When I explicit add an VIP Host to "Critical items" I see them (When Non-OK) all the time in the Main View with the description "Filter: Critical Host/Service". So far so good now. Great!

• When no Host is listed in "Shown hosts REGEX at main view" I got only fresh Non-OK States from all kind of devices/services. So far so good now. Great!

• But, when I enter something to "Shown hosts REGEX at main view" it doesnt have any effect any more. Regardless if it is the Wildcard, an Host, my previously working REGEX List etc. I only see them in Show More -> "73/73 notices"

[nuxsmin]

Right, critical items are always shown.

I'll check out the third point, because I've done some tests and it worked fine. Could you try out with a single item in the pattern?

[SchmuFoo]

I did, but the result was the same!

Thanks & Cheers

[nuxsmin]

Could you send me a single host pattern example? (Real name not needed)

[SchmuFoo]

Just tested it with two example Hosts from "Show More" Page, but they didn't show up on the "Main Page"

COMPANY-XY-FOOBAR-Z
XYZZFOOBARXX01

[nuxsmin]

So, you mean that these hosts have been set in the regex pattern and the main screen doesn't show them, right?

[SchmuFoo]

100% ACK

[nuxsmin]

Umm, what are the state of them?

[SchmuFoo]

I have added an single COMPANY-XY-FOOBAR-Z Pattern (In this syntax as it is configured in Nagios) to the Shown Host REGEX, but I didnt see it on the Main View.

I got the following output on the "Show More" Page

[SchmuFoo]

BTW: The "-" are part of the host in Nagios (!)

[SchmuFoo]

Point of View from Nagios:

[nuxsmin]

Ok, I'll take a look to the code, because the tests done yesterday worked fine using even a hostname containing dots and then escaping them in the pattern "\.".

Thanks for the feedback!

[SchmuFoo]

Hy,

sorry for the late reply, hope your are doing well!

I did a test and found a few things:

1. When I enter VIP Hosts in "Critical Items", all (different) hosts in "Shown hosts REGEX at main view" (which have error states etc) doesnt show up in the main view any longer. So it seems that the cirtical items list overwrite the shown hosts list.

2. When I remove the "Critical Items" list completly and only use my "Shown hosts .." list, the "show all" sections sound one maybe confusing info -> Hosts which are not in the "shown hosts.." list have the Filter reason "Filter: Regex Host". Maybe it us usefull to rename it to something like "Filter: Host is not in Regex List and due to that ony listed here in show all" ;-)

Cheers!

[nuxsmin]

Hi!, so sorry about the late reply, I forgot your post.

I'll check it out shortly and let you know how to fix it.

Cheers!