Notes

I had to replace a non-working Icinga, so I decided to give CheckMK a try. Although the configuration workflow is a little bit different to other solutions, it is a nice monitoring tool.

When monitoring some hosts behind a firewall, I got a lot of error messages for the PING service:

CRITICAL - 10.0.0.1: rta nan, lost 100%

The strange thing was that host was marked as UP, only the service showed that behaviour.

Because some of the hosts were connected using IPsec, I tried to change the timeout values, but it had no effect.

In the end, the solution was simple: CheckMK generated lots of ICMP packets and so they were blocked by the firewall (a Sophos UTM). I created a bypass rule for the CheckMK host in both directions and the problems were gone :)