Change Monitoring Configuration by Tag and Time period

[alanb (Alan)]

I’m wondering if there is a way to change the monitoring configuration parameters by time period and tag. I have hosts that flap a lot, and I have some clients that work only daytime hours. Right now when I wake up in the morning or on weekends I still have tons of notifications that these sites went up/down overnight, when it’s unimportant, but I still want to know if it happens for an extended period of time.

What I’d like to do is the equivalent of

if a host has a tag of ‘daytime_hours’
and the time period is ‘not daytime hours’
then increase the ‘maximum check attempts for a host’ to 10

I can do half of this in the notification rules by creating a rule to turn off notifications by tag and time period - but I don’t want to turn off notifications completely.

I can do half of it by increasing notification checks by tag - but I can’t assign to hosts by time period and tag, only by tag.

I can’t seem to figure out how to combine the two of these together in one.

Help appreciated.

[andreas-doehler (Andreas)]

Yes this is not so easy to solve.

One way would be the approach you already took.

@alanb

I can do half of this in the notification rules by creating a rule to turn off notifications by tag and time period - but I don’t want to turn off notifications completely.

I would modify this a little bit.
Your notification rule should include the tags, the timeperiod and as a new filter “Restrict to n’th to m’th notification”. Now you need to configure that if the host has the tag “daytime_hours” and that there are a rule “Periodic notifications during service problems” is created. If you set this to 10 minutes and you set your notification rule the restrict parameter to “2 - 2” then only a mail after 10minutes is sent.
Pay attention to set the “Restrict to n’th to m’th notification” in other rules to only the first message.

Here the settings for the notification rule
For normal services

If you want a delay of 20 minutes

[alanb (Alan)]

Thanks a lot for your reply Andreas, but I think I must be missing something in your explanation. Just to clarify, in case it got missed or misunderstood, I only want to throttle alerts for non-business hours. IE: 5pm-9am, and leave the notifications as normal. Your answer sounds a bit like it’s how to throttle for clients tagged as 9-5 all day.

I would modify this a little bit.
Your notification rule should include the tags, the timeperiod and as a new filter “Restrict to n’th to m’th notification”. Now you need to configure that if the host has the tag “daytime_hours” and that there are a rule “Periodic notifications during service problems” is created. If you set this to 10 minutes and you set your notification rule the restrict parameter to “2 - 2” then only a mail after 10minutes is sent.
Pay attention to set the “Restrict to n’th to m’th notification” in other rules to only the first message.

I have created a monitoring configuration rule as for max number of check attempts as follows, setting max checks to 6 if the host has the 9-5 tag and put it just before the default alert rule:

This isn’t what I want though, because that throttles the tagged host at all times, not just during a time period, and I’m not seeing a way to set time period in here. I also notice I don’t have the “Periodic notifications during service problems” as you have to let me set the periodic notifications setting - I’m running 1.6.0p14.

I have also created a notification rule as a copy of the default, with the changes of matching the host tag and it being during the time period, and restricting to the n-th to m-th notification.

It almost seems (now I’m looking at it) that the second part (the new notification rule with n-th-m-th) is all that’s needed, as that will (I think) let me ignore certain notifications. So if I were to set it to 3-9999, that would say “ignore the first and second notification, but send notifications for anything after that.”

Would that accomplish sort of what I want? IE: with just the second part - the notification rule - the system would still do the same number of checks in the same time period, but I could ignore the first 2, so if it does flap on and off over night, I wouldn’t get alerts until it was hard down for more than the first 2 default max check attempts?

I am understanding this right?

Or am I misunderstanding your reply completely

[andreas-doehler (Andreas)]

@alanb

Your answer sounds a bit like it’s how to throttle for clients tagged as 9-5 all day.

You can add the wanted timeperiod when you want to throttle the messages to the rule.
Then this notification rule will only work inside the selected timeperiod.