we just discovered by accident that when a downtime for a host is created via API and the hostname is left out (accidentally), then Checkmk creates a downtime for multiple hosts.
We could verify this with 1.6p17 CEE
The (incorrect) API call for a 15minute downtime then would be:
In our productive environment Checkmk sets downtimes for about 9000 of 20500 hosts, in our test env about 1000 of 1300 hosts are affected. The hosts Checkmk picks seem to have nothing in common.
We noticed it when we saw thousands of deferred “Downtime start” and “Donwtime end” in spooler directory.
Btw: Kudos to the developers: although there were so many deferred notifications, this had no impact on the Notifications per se and Checkmk tried to process them all.