Cannot stop thold from alerting after deleting entries and the entire plugin

[andyb2000]

Odd one here! We had a thold alert setup and this was working great. We then wanted to remove it so delete the threshold entry from the GUI. It kept on alerting. We did all sorts to try and stop the alert.
Finally I disabled the plugin (no change) and then I have now deleted the entire plugin folder from /usr/share/cacti/site/plugins
But STILL we get the email alert on the threshold (The alert is valid, it is detecting the old conditions and attached the correct graph!) but we need it to stop.

I've also checked (what I thought) were the right database tables and ensured they were empty also, but still the alerts come in!

Help! Suggestions on why the poller is clearly still able to generate/run the detection and send the alerts please.

Cacti version: 1.2.10
Threshold version (before uninstall): 1.5.2
Running on Ubuntu 20.04.1 LTS

[TheWitness]

Restore the folder and then don't disable, uninstall. If you have the monitor plugin installed, you need to uninstall it first.

[andyb2000]

Hi,
Thanks for the reply.
I've just tried that and unfortunately still the same, after the uninstall it's still triggering threshold alerts on non-existent entries!
Any other suggestions/methods to track down how it's generating these alerts?

[TheWitness]

Code: Select all

mysql -A cacti
show tables like '%thold%';
drop table XXX;
drop table YYY;
show tables like '%notification%';
drop table XXX;
quit;

[andyb2000]

Thank you!
However, it seems this is even stranger and stranger!

Code: Select all

MariaDB [(none)]> use cacti;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [cacti]> show tables like '%thold%';
Empty set (0.001 sec)

MariaDB [cacti]>

But on the notifications:

Code: Select all

MariaDB [cacti]> show tables like '%notification%';
+----------------------------------+
| Tables_in_cacti (%notification%) |
+----------------------------------+
| snmpagent_cache_notifications    |
| snmpagent_managers_notifications |
| snmpagent_notifications_log      |
+----------------------------------+
3 rows in set (0.001 sec)

MariaDB [cacti]> select * from snmpagent_cache_notifications;
+-----------------------------------+---------------------+----------------------------+-------------+
| name                              | mib                 | attribute                  | sequence_id |
+-----------------------------------+---------------------+----------------------------+-------------+
| cactiNotify                       | CACTI-MIB           | cactiEventDescription      |           0 |
| cactiNotifyDeviceDown             | CACTI-MIB           | cactiApplDeviceDescription |           2 |
| cactiNotifyDeviceDown             | CACTI-MIB           | cactiApplDeviceHostname    |           4 |
| cactiNotifyDeviceDown             | CACTI-MIB           | cactiApplDeviceIndex       |           0 |
| cactiNotifyDeviceDown             | CACTI-MIB           | cactiApplDeviceLastError   |           6 |
| cactiNotifyDeviceFailedPoll       | CACTI-MIB           | cactiApplDeviceDescription |           2 |
| cactiNotifyDeviceFailedPoll       | CACTI-MIB           | cactiApplDeviceHostname    |           4 |
| cactiNotifyDeviceFailedPoll       | CACTI-MIB           | cactiApplDeviceIndex       |           0 |
| cactiNotifyDeviceFailedPoll       | CACTI-MIB           | cactiApplDeviceLastError   |           6 |
| cactiNotifyDeviceRecovering       | CACTI-MIB           | cactiApplDeviceDescription |           2 |
| cactiNotifyDeviceRecovering       | CACTI-MIB           | cactiApplDeviceHostname    |           4 |
| cactiNotifyDeviceRecovering       | CACTI-MIB           | cactiApplDeviceIndex       |           0 |
| cactiNotifyDeviceRecovering       | CACTI-MIB           | cactiApplDeviceLastError   |           6 |
| cactiNotifyPollerRuntimeExceeding | CACTI-MIB           | cactiApplPollerHostname    |           2 |
| cactiNotifyPollerRuntimeExceeding | CACTI-MIB           | cactiApplPollerIndex       |           0 |
| cactiNotifyPollerRuntimeExceeding | CACTI-MIB           | cactiApplPollerIpAddress   |           4 |
| snmpagentNotificationTest         | CACTI-SNMPAGENT-MIB | snmpagentEventDescription  |           0 |
+-----------------------------------+---------------------+----------------------------+-------------+
17 rows in set (0.000 sec)

MariaDB [cacti]> select * from snmpagent_managers_notifications;
Empty set (0.000 sec)

MariaDB [cacti]> select * from snmpagent_notifications_log;
Empty set (0.000 sec)

MariaDB [cacti]>

I don't see any threshold alert notices there, but I've dropped the tables anyway to see if they are somehow interacting.

Hopefully this will do it!

[TheWitness]

Whoops, don't do the snmp_agent tables.

[TheWitness]

Is Monitor installed?

[andyb2000]

No worries!
Yes I suspected those weren't to be dropped.
No, only plugins are Weathermap and thold.

[TheWitness]

Well, the only thing that core Cacti notifies on are data collector issues and unexpected page errors experienced in the interface, pollers or clis. So, it's likely coming from some place else.

[andyb2000]

They are still coming through! I've checked mail headers, etc, and definitely that machine sending them.

Emails coming through are formatted for the Thold plugin:
Subject: "ALERT: cr01- Errors - x.x.x.x - TenGigE0/0/0/5.3044 [discards_in] went above threshold of 5.00 with 31.91"
Body: "An Alert has been issued that requires your attention.

Device: cr01 (1.2.3.4)
URL: Link to Graph in Cacti
Message: ALERT: cr01 - Errors - x.x.x.x - TenGigE0/0/0/5.3044 [discards_in] went above threshold of 5.00 with 31.91"

Still can't stop them! I'll keep digging and respond back on what I can find out.

[TheWitness]

If the plugin is removed, then the alerts are coming from another server, or you are not clear as to where it is installed. If you are using Ubuntu, you might want to install mlocate and then run updatedb and then use the command locate index.php to find the real install location.

[Osiris]

I think this was fixed in the develop branch today.