Question
We have added few switches in to CheckMK.
It keeps giving us alert on complaining there are some vanished services.
By checking the host configuration, there are quite some services under “Vanished services” section.
However, the system still can give alerts for those services in “Vanished services” section.
I have checked some CheckMK documentation, but still very confused. In what scenario the system will think the services are vanished? Does it mean the system is not able to pull info for these services?
In CheckMK you have two different parts of a service to be discovered and checked. If you scan a host the inventory part of the check plugin defines which service is there and can be added to the monitoring. On the hosts service setup page these services are presented as undecided first. There you add the services which moves them to the monitored services. Now they are monitored. They will stay there even if the inventory part of the plugin does not see them as to be monitored later on (e.g. switch interfaces are only to be monitored if up by default). In this case the services are moved to the vanished services section even though they have valid check results.
According to your screenshot the interfaces are shown as vanished despite the fact that they are up. I expect this to be a result of a change you made to the discovery rules defining that you do not want to monitor these interfaces. To fix it please check your “Network interfaces and switch port discovery” rules.
I second Uwoehler on this. Especially in SNMP you can mess things up if you play around with the discovery settings after a while of monitoring.
Services are different aspects that the system identifies and instantiates while discovering the hosts. If you change the discovery rules, the service’s names change. This might result in the seen issues. You do get SNMP replies for the OIDs but the services are either filtered out while discovering or created with a different name.
With services there’s this rule of thumb: service name = service identity. If you change the name you have a new service and monitoring basically restarts.
Bottom line, if you’re finde with the naming discovery, do a Tabula Rasa Rediscovery of your SNMP devices and then don’t touch the discovery rules again until you absolutely have to do it ^^
Hint: With SNMP - vanished services also occur if your interface dies on you due to technical issues. Checkmk will yield an “UNKNOWN” status in these cases telling you that there was an interface before but it’s gone now. You will have to investigate if there was a change or if the interface or switch died on you…
