Host and service views

Last updated: May 11. 2016


1. Introduction

The most important task performed by Check_MK's user interface is displaying the current status of hosts and services. This is achieved largely in part by interface views. In order for the daily operations to run as efficiently as possible, these tables offer numerous functions and they can be customised to meet your requirements.

We distinguish between global views and those that require a context. Global views can always e directly called up. An example is the list of all current service problems. A contextual view has a scope, such has the services of a specific host. Such views can only be called up in situations relevant to a particular host.

The global view is most easily accessed via the Tactical Overview and Views. In the tactical overview each of the six fields is clickable, which takes you to a global view that individually lists the hosts or services counted in each case respectively.

In the Views element all global views are accessible - grouped according to theme. In addition, you will find a few entries that actually aren't Views - like e.g. the dashboards, which are sorted under the Overview theme. Dashboards can however contain views.

From a global view, with a further step you can access the details for a particular host or service. On the one hand there are the names of hosts and services, and also other columns in which individual cells are clickable for detailed views:

In a specific host or service view, at the top you can find a row of buttons that can be opened with . These buttons then show further views with the same context - meaning those from the same host or service.

Another way to the detailed view is via the search element in the sidebar:

Which view you receive will depend on the result of the search. If the search identifies a host explicitely, you will reach this host's Services of host ... page directly. There you will again find the buttons for the other views of this same host. Especially practical: a click on the host's name takes you a detailed view of the host's availability:

2. Using views

2.1. Options, filters and commands

At the top left of every view there are six symbols with which you can influence the display and trigger actions:

Opens the dialogue with the filters. With this you can further limit the displayed data. As soon as you set a filter the symbol on changes so that it is clear that under certain circumstances not all data will be will be displayed. Conversely, some views already have predefined filters, (e.g. the list of all problems). Here, by removing the filters you can also have more data displayed. Changes to filters are not saved, rather they are reset when you quit the view.
Opens the display options, with which you can, e.g. define the time data format (relative or absolute). Which options are available depends on what is appropriate for the information displayed in the view.
Here you can execute commands on the object shown (e.g. entering scheduled downtimes). The commands are described in detail in their own article.
With this you switch checkboxes on or off. With the checkboxes you can restrict the commands to selected data sets.
This 'thumbwheel' can be turned by clicking on it or with the mouse wheel. It defines the number of columns for the selected view. Views with multiple columns allow the space available on wider monitors to be exploited. For views that only display a single data set this setting has no effect.
This 'thumbwheel' defines the view's refresh interval. You can also disable the automatic refreshing. Be aware that in this case it is possible that you will not be informed of problems that occur in the meantime!

2.2. Time and date declaration

Check_MK is showing time data as relative statements in all of the state views if these are less than 24 hours in the past or future - e.g. 16 hours. You can switch to absolute time statements if you change the option time stamp format to absolute.

2.3. Sorting

The tabular views can be sorted by clicking on the column heading. A column has three states that can be selected in a loop of multiple clicks:

  • sorted in ascending order
  • sorted in descending order
  • column unsorted

Views are initially sorted 'naturally' according to how the view is defined. In service lists the sorting is alphabetic by service name - with the exception of Check_MK services that are always at the top. The Check_MK service is responsible for managing the monitoring agent. There are also Check_MK Discovery and Check_MK HW/SW Inventory services.

Sorting by the Perf-O-Meter column sometimes produces surprising results. This is due to the graphic display of the values being partly a percentaged summarisation of the actual values. The sorting is however performed according to absolute values and is always based on the first metric produced by a service.

2.4. Export

Data displayed in a view can be exported in several formats:

Format Action
PDF Only  Check_MK Enterprise Edition: The PDF-export button is found in the view's heading - possibly hidden behind . With this the so-called Instant-Report is produced. This is a quasi quick report with only a single element. Its layout can be customised with special templates in the report module.
CSV The symbol for CSV-export is found at the foot of the page. A semicolon is used as a separator. The individual cells are enclosed in quotes. The first line contains the internal abreviations for each column. Some of the columns cannot be meaningfully converted into CSV format. One example is the Icons. These columns will be included in the CSV data but will nevertheless be empty.
JSON Because a JSON-Export is generally used for automatic scripts it has no symbol. You produce the export by entering &output_format=json in the view's URL field. You can test this simply by first exiting the frameset with the sidebar, and by only displaying the frame with the view. This is done with, e.g. the symbol at the end of the page. You can then extend the URL in the browser.
JSONP JSONP is almost the same as JSON, but the syntax invokes a Javascript procedure. Enter jsonp as the format and likewise the name of the JSON procedure in the jsonp variable. Example: ...&output_format=jsonp&jsonp=myfunc.
Python Exporting as a Python data structure is like JSON, in which you enter output_format=python for the format. This is particularly practical if you wish to continue processing the data directly in a Python script.

2.5. The display limit

In a larger monitoring environment displaying all views is no longer practical. When you are monitoring 50,000 services and select the All Services view, not only will the display require a very long time - it will also not be very useful.

In such situations, in order to protect the user from long waiting times and to avoid crippling the system with absurd quantities of data, views are limited to 1000 entries in their display. Exceeding this limit produces the following warning:

As you can see, the data set being displayed is not necessarily the first 1000 entries according to the selected sorting method! There is a technical reason for this: namely that the limit is applied to the data source in the connected instance's monitoring cores. This is very important, because if we accumulate one million data sets from your environment spread around the world, then 99.9% of the data will be deleted immediately. The sorting takes place from the end of the list, thus it happens after the limit. The data from all instances must, after all, be sorted together.

If you really want to see more than one thousand data sets, then you can reach the next level by clicking on Repeat query and allow more results. Here the limit is 5,000 data sets. If this limit has again been exceeded, with unlimited you can continue. Insofar this is a potentially risky action, you will require Administrator rights. You have been warned!

You can define both levels in the WATO ➳ Global Settings under User interface:

3. Customising views

3.1. The basics

Check_MK allows you to customise its standard views, and even to create new ones that you can incorporate into reports and dashboards. Thus you can define numerous different aspects for every view:

  • General items such as title, theme, etc.
  • Which data source to be displayed (e.g. hosts, services, events on the event console, etc.)?
  • Which selection of data sets is to be displayed (filtering)?
  • Which columns will be displayed?
  • Which other views are linked to the text in the columns?
  • How will views be sorted as standard?
  • Is there a grouping, and if so, how does it look?
  • Where and for which user should the view be visible?
  • Which style of table layout should be used?

The edit mode for views can be reached in two ways:

  1. From an active view via the button (which is possibly hidden behind ).
  2. From the sidebar element Views via the button. Here you can create completely new views with , or customise existing ones with :

3.2. Clone first - then modify

The views supplied as standard are a part of the software and as such cannot be changed, however Check_MK does recognise the concept of cloning. When a view is first customised (regardless if by using or via the list) a copy of that view is created automatically. This copy is added to your user profile.

This copy can then be customised as desired. The original view is retained but is 'greyed-out' - overlaid by your version in effect. You can return to the standard view later by simply deleting your clone (achieved in the table of views, as you might expect, with ).

This concept has one further advantage: namely, that you can define whether the view should be changed for all users or just for yourself. This is specified in the view's General Properties with the checkbox Make this view available for all users. Not surprisingly, you can only select this checkbox if you have administrator rights (or more correctly, this function has its own right - Publish views).

What happens when a view is customised and published by several users? Each user then has their own variant of the view. Which view will be visible for which user(s)? This can be determined with the following rules:

  1. When a user creates a view for themself, this always has priority for him/her.
  2. After this are views that have been customised and published by an administrator (to be precise, someone with the Modify building views right).
  3. If there are none here, then those views apply that another normal user with the Publish Views right has published.
  4. And when there is also nothing here then the supplied version will be visible.

How can you create a real copy of a view, so that when done you can have both the supplied and your own views? This is defined by using Unique ID in the General Properties. Simply give your view a new name, so that it will no longer be identified as a clone of the supplied view, rather it will begin its own life.

The ID is the decisive keyword for opening views in the URL. The schema is very simple. Here for example is how the global view with its ID allhosts is opened:

/mysite/check_mk/view.py?view_name=allhosts

The concept with cloning, customising and visibility can be found at many other locations in Check_MK, namely in:

3.3. Integrating a view into the sidebar

How and if a view will be shown in the sidebar's Views element, is defined by the following characteristics under General Properties:

  • Title - the item's name
  • Topic - the view will be sorted under this topic. You can also define other topics.
  • Hide this view from the sidebar - this view will not appear in the sidebar

3.4. Context button for a view

A Context Button only makes sense for views with a context. An example is the button which is linked to the host view (and which will always be shown when a host is known). This is defined in the view's characteristics:

  • The view has a context, namely Show information of single... host.
  • has been selected as the Icon for the button.
  • The Button Text has been set as services.
  • The checkbox Do not show a context button to this view is deactivated.

So are all of the requirements satified, and whenever we move in a host's context a button for this view will appear (possibly behind as usual).

3.5. Basic layout

The next block - View Properties - defines the view's general appearance:

Under Basic Layout there are various styles for displaying the data in tables. Most views use table - a normal table that can be sorted by columns - or single data set - which has the legend on the left and which is mostly used for single data sets. You can however also use {{single data set}} for views with more than one object. The All Hosts view looks something like this when altered to single data set:

The Number of Columns setting is the default for the counter for specifying the number of columns. Similarly, Automatic page reload is the default for the display refresh counter.

3.6. Columns and grouping

The Columns box defines which columns you wish to see. The possible column selection depends on the selected data source. The most columns are found in services, naturally, as all information for the particular service is available. The list can be quite long here, and if you are uncertain which column is the right one, there is only one thing to do - try it out:

The Link field offers a selection of all views. If a view is selected here, then the column's respective cell is clickable and takes the the user to the chosen view. This really only makes sense if the targetted view has a context. The best example is the All Hosts view. The Hostname column is clickable here and takes the user to this host's Services of host.

Under Tooltip, on the other hand, you will find a list of all columns. Thus you can show further information for the host or service, when the user moves the mouse cursor over the respective cell (the IP-address in this example).

3.7. Information for services in a host view

Let's imagine that you'd like to display the information for particular services in a table of hosts. The following example illustrates this situation very well: here the current uptime, the CPU-load, the memory usage and the NTP-synchronisation are shown for each host:

Here a table of hosts has been generated in which for each host the Perf-O-Meter service column for four different services is displayed. One sees that for three of the five servers the NTP Time service does not exist and that the column is consequently empty.

This view's configuration was achieved by adding columns of the Joined column type. Here the column for services in which Perf-O-Meter has been selected appears under Column. The Title entry defines the column's heading. The service's exact name is entered (upper and lower case sensitive!) in Of Service:

Naturally such a display is only useful if the view shows a list of similar hosts which also all utilise the selected services. That is also the reason why Check_MK does not provide views of this type: which columns are meaningful here depends entirely on the type of host selected. For Linux servers the information of interest is certainly completely different to that for, e.g. USVs.

3.8. Sorting

The sorting of a view is configured in the the fourth block. It's only a matter of the predefined sorting method: users can, as described above, determine the sorting order themselves with a click on the column heading. In the view's configuration however you have more possibilities: you can define a multi-step sorting order, e.g. first by service-status, and for the same status by service name. The order so determined is retained as a subordinate sorting when the user resorts in a specific column.

3.9. Grouping

Through grouping you divide a table into several segments - in which each segment's data is related in some way. The best example of this is the Service problems view, which is reached simply via the Tactical overview. As you can see, this table is grouped with Service status (first all CRIT, then UNKNOWN, then WARN):

The grouping in a view is configured similarly to the columns. Simply define which column the grouping should relate to. It is usually only one, but can be more. All data sets with the same value for all selected columns will then be displayed in a group - and the column heading will be shown as the group title.

It is important that you also sort the data sets by priority according to the group's selected characteristic! Otherwise it can be possible that the same group makes multiple appearances (which may at times be desirable). Incidentally, a resorting by column performed by a user has no effect on the grouping - in such a case only the group's sequence is determined and the data sets sorted within the group. The groups themselves are unchanged.

3.10. Filters, contexts and searches

An important aspect of views is the data selection. Which hosts or services should be displayed in a table? Check_MK uses the filter concept for this purpose. Here are a couple of examples of host-filters:

Every filter can be defined with search terms or other criteria by a user, thus reducing the list of results to those data sets meeting the criteria. In this way the filters are UND-linked. The filter criteria actually used for a view are assembled from three sources:

  1. Filters with criteria defined as standard for the view
  2. Filters set interactively by the user with in the view
  3. Filters that can be set with variables via the URL

The filters you assemble by editing in the view's context / search filters box have two functions. Firstly, you decide which filter will be available to a user with a click on , secondly, you can predefine filters with criteria, thus limiting the data to be displayed in the view. (point 1 above).

If you create or edit a view with context - instead of the filter for the relevant object only an optional entry field appears. In this an exact comparison always applies (upper and lower case sensitive). As an example we can take the host view, which displays all services of a specified host. The host's name will be added through a context to the view. You can also build a display in which the diplayed host is effectively hard-coded directly in the view:

In this way you can summon the view without context, and also simply add it to the sidebar's Views element if desired.

3.11. Special search views

The supplied views Host search and Service search (and others) behave in a special way in relation to the filters: when you you select one of these views, it opens with a filter formula, and then only shows hosts and services when this filter is activated.

Why? It would simply be very impractical if you first had to go to All services, and then be forced to wait until several thousand services are displayed before you could filter the result with a search entry. This behaviour is regulated by the Show data only on search option:

4. Creating new views

Creating a new view with functions in principle just like the editing of an exsting view - with a small difference: you must first select a data source and a specific object type.

4.1. 1. Data source

The data source could be described like a table in an SQL database. Check_MK doesn't use SQL-Data bases, but is similarly structured internally. In most cases you will be correct with All services or All hosts. There are however a few data sources that will be explained in more detail here:

Data source Meaning
Host groups Every line in the view will show a summary of a host group. Because the individual objects are the groups themselves, there are no host filters to be found here!
Host groups, merged This is the same as in Host groups, but in a distributed environment host groups with the same names, existing in multiple instances, will be combined into a host group.
Hosts grouped by host groups These data sources are used, e.g. in the supplied Host groups view. This is a table in which a host's every group membership has its own line. The group's information is available in these lines. A host in multiple groups will make multiple appearances here. A data base specialist would describe this as a Join of the table host with the table host group.
Service groups A table of the service groups - as for Host groups.
Service groups, merged The same, only in combined distributed monitoring - as for Host groups, merged.
Services grouped by host groups A table of the services with a join to the table of the Host groups.
Services grouped by service groups A table of the services with a join to the table of the Service groups.

4.2. 2. Object type - global or with context

Here it can be decided whether your new view should have a context or if it will be a global view. The selections available to you depend on the data source. The most common context by far is 'Host'. The image above appears after selecting the All services data source.

Checking the Show information of a single host box defines that the new view describes one specific host. Thus you have created the basis for a view that is not globally, but rather visible via a link:

  • For a host view with a context button (possibly hidden behind )
  • As a link in a column (see above, e.g. click on a host name in a view)

There are two possibilities for the Service context type: If you select only {{Show information of a single service}}, you can build a view that displays all services with the same name on different hosts. If it should be a specific service for a single host, then check the {{Show information of a single host}} box.

5. The matrix

When you specify the Matrix layout in one of your views you will probably see strange things at first, and ask yourself what is going on. The matrix is certainly not intuitive on first viewing, but you can achieve good things with it.

In the supplied standard views there is one that utilises this layout - and that is {{Metrics|Search peformance data}}. The following image shows how I searched for the CPU|Memory|Filesystem service printout in this view in my testsystem:

The result is a neat table of my hosts, in which all of the service's metrics are listed adjacent. Not all hosts have the same services, so some of the fields are simply empty:

The result at first looks very similar to that described somewhat earlier Information for services in a host view. There are a couple of significant differences however:

  1. The list of services is dynamic and has no fixed configuration.
  2. Here the hosts are the columns - not the lines.
  3. With the matrix you can do much more.

When you look at the view's definition you can see how it is constructed:

  • Matrix is specified in Basic layout.
  • The Hostname is specified as the only column in Grouping.
  • In Columns the Service description and the Service Perf-O-Meter are specified.

The rule for the matrix layout is:

  • The Group columns are used as headings for the vertical columns.
  • The first normal column on the left provides the titles for the lines.
  • All further normal columns are shown in the cells.

If you, e.g. wish to display more information about the host, simply add more group columns. Thus the table from above will look like this when you insert the Host icons and WATO folder - just folder name columns:

Further normal columns then land directly in the cells. The following example shows (abreviated) the matrix with the extra Output of check plugin column:

5.1. Recognising outliers

Why are do some cells have a coloured background? This alerts you to values lying outside the majority. This is actually not so meaningful for measurement data. But there are users with a specially-constructed matrix who can tell at a glance, e.g., if an incorrect contact group has been entered for certain hosts or services!

6. Alarm sounds

A view can sound an alarm tone over the browser if at least one problem appears in the table (a host that is not UP or a service that is not OK). This primitive type of alarm is, e.g., interesting for control centres where there is always a list of problems on a screen that the operator doesn't want to be continuously staring at.

The alarm sounds are deactivated by default. You can switch them on via the Global settings ➳ User interface ➳ Enable sounds in views global switch. As always the search field helps here:

Sounds will not be heard in all views, rather only in those for which sounds are activated in View Properties:

7. Embedding views in external websites

Since every view is accessible via a URL you can also embed these in other websites, for example via an <iframe>. A number of elements in a view however make no sense or are even distracting in such a context. In such a case you can attach a display_options=... variable to the URL, via which you can precisely control which component of the view should be generated in HTML code.

Every component is coded with a letter. If you use lower case letters the denoted element will be deactivated and all those remaining will be created (a quasi "opt-out"). With capital letters this situation is reversed: here with capitals you nominate only the elements to be created ("opt-in"). A mixture of upper and lower cases makes no sense.

The following letters have been defined:

OnOffWhat will be displayed?
H hHTML headers and footers including the <HTML>, <HEAD> and <BODY> tags
T tTitle line with a heading and logged in users
B bContext buttons that link to other views
F fButtons that open the filter
C cButtons that open the Command box, and likewise icons for executing commands
O oThe setting-wheels for the number of columns and for screen-refresh
D dThe button for a display's options
E eThe button for editing the view
Z zThe footer in which refresh: 30s will appear
R rThe Javascript code for the automatic refresh
S sThe playing of alarm sounds for the WARN and CRIT service states
I iLinks to other views
X xAll other links
M mWith this option links are assigned the main HTML-frame as their target. Check_MK itself uses this when embedding views in dashboards.
L lLinks in column headings
W wLimit and live status error messages

For example - if you want to switch off all control elements and buttons and only display the actual table, a link on the allhosts view will look like this:

http://myserver/mysite/check_mk/view.py?view_name=allhosts&display_options=tbdezocf