[Check_mk (english)] Get list of acknowledged services/hosts from livestatus, entry_time incorrect?

Archive checkmk-en
1

Hi. I’m trying to write a script that will automatically un-acknowledge any alert that has been ack’d for more than 8 hours. It seems there is no direct way of getting the current duration since a service was acknowledged, so I’m trying to determine a way for me to calculate that base on various queries. One of the things I need to get is a list of acknowledged services. It looks to me like the entry_time column from the comments table is what I want to check to see when a service/host was acknowledged. Unfortunately, it either isn’t showing me the correct time or I’m not understanding the intention of this field.

Here’s what I get with one of my queries trying to determine the entry_time:

[root@dc01kg0066na mk-livestatus-1.2.2p1]# echo -e ‘GET comments\nFilter: entry_type = 2\nColumns: entry_time’ | nc 127.0.0.1 6557 | wc -l

764

[root@dc01kg0066na mk-livestatus-1.2.2p1]# echo -e ‘GET comments\nFilter: entry_type = 2\nColumns: entry_time’ | nc 127.0.0.1 6557 | sort | uniq

1368048393

1368048394

1368048395

1368048396

1368048398

[root@dc01kg0066na mk-livestatus-1.2.2p1]# date -d @1368048393

Wed May 8 16:26:33 CDT 2013

[root@dc01kg0066na mk-livestatus-1.2.2p1]# date

Wed May 8 16:49:52 CDT 2013

I know I currently have a LOT of akc’d alerts, so 764 total acknowledgements sounds realistic. Probably a little low actually. :slight_smile: But, as you can see, of the 764 acknowledgements, there are only 5 uniq times and they are all within ~20 minutes. That is very wrong. I know I currently have acknowledgements that have been there for days, weeks, and even months.

Any guidance appreciated.

Thanks

John

2

Any guidance appreciated.
Thanks

John

_______________________________________________
checkmk-en mailing list
checkmk-en@...
http://lists.mathias-kettner.de/mailman/listinfo/c

i don't know if it's right.
but i think on a nagios reload/restart and on logrotation at midnight,
if you don't changed this.
nagios set's the acknolegement new,
so the time since the last reload/restart/logrotate
should be the time it give's back on the query.

3

Ah, that would make sense with the times I'm seeing. I didn't even think of
that. Can anyone think of any way for me to get the current duration of an
acknowledgement? I'm sure I an parse the log files and get it, but I'm
hoping livestatus would provide me an easier way. :slight_smile:

···

On Thu, May 9, 2013 at 2:55 PM, Stefan B. <stefan927@gmx.de> wrote:

i don't know if it's right.
but i think on a nagios reload/restart and on logrotation at midnight,
if you don't changed this.
nagios set's the acknolegement new,
so the time since the last reload/restart/logrotate
should be the time it give's back on the query.

--
John Alberts