Nagios Sends Email. Your On-Call Engineer Needs a Phone Call.
You've built out a solid Nagios monitoring setup. Services are checked, thresholds are defined, and contacts are configured. Then a database goes down at 2 AM, Nagios fires a notification — and nobody wakes up because it landed in an inbox that nobody checks overnight.
Nagios's notification system was designed around email. That's fine for daytime visibility, but it falls apart for on-call response. Getting SMS or voice calls out of Nagios requires one of the following:
- Purchasing the Nagios XI commercial version and configuring its notification add-ons
- Wiring up a Twilio account, writing a notification script, managing credentials, and handling retry logic yourself
- Routing alerts through a purpose-built incident management tool
This post walks through the third option — specifically, how to use Nagios event handlers to post alerts to Alert24, which then handles SMS, voice call, and push notification delivery based on your on-call schedule.
Why the Direct Twilio Route Is More Work Than It Looks
On paper, calling the Twilio API from a Nagios notification script seems straightforward. In practice, you end up owning a lot of edge cases:
| Problem | What you have to build |
|---|---|
| Twilio credentials in Nagios config | Credential storage and rotation |
| Alert goes out, nobody responds | Escalation logic |
| Multiple people on rotation | On-call schedule management |
| Alert fires, gets fixed, fires again | Deduplication and flapping suppression |
| "Who got paged and when?" | Audit trail and acknowledgment tracking |
None of these are impossible to solve, but each one is scope creep on what started as "just send me a text." By the time you've handled escalations and schedules, you've built a subset of PagerDuty inside a Nagios notify script.
Alert24 handles all of that. Your Nagios setup keeps doing what it's good at — running checks — and Alert24 handles the human coordination side: who gets contacted, via which channel, and what happens if they don't respond.
Setting Up Nagios to Post Alerts to Alert24
Alert24 exposes a webhook endpoint for inbound events. You'll create a Nagios event handler script that posts to this endpoint, then wire it into your Nagios notification commands.
Step 1: Get Your Alert24 Webhook URL
In Alert24, go to Integrations and create a new inbound webhook integration. You'll get a URL that looks like:
https://api.alert24.net/v1/ingest/webhook/YOUR_TOKEN_HERE
Copy this — you'll use it in your notification script.
Step 2: Write the Notification Script
Create /usr/local/nagios/libexec/notify-alert24.sh:
#!/bin/bash
# Alert24 Nagios notification script
WEBHOOK_URL="https://api.alert24.net/v1/ingest/webhook/YOUR_TOKEN_HERE"
# Nagios passes alert context via environment variables
PAYLOAD=$(cat <<EOF
{
"title": "$NAGIOS_NOTIFICATIONTYPE: $NAGIOS_HOSTNAME $NAGIOS_SERVICEDESC",
"message": "$NAGIOS_SERVICEOUTPUT",
"severity": "$(echo $NAGIOS_SERVICESTATE | tr '[:upper:]' '[:lower:]')",
"source": "nagios",
"host": "$NAGIOS_HOSTNAME",
"service": "$NAGIOS_SERVICEDESC",
"state": "$NAGIOS_SERVICESTATE",
"notification_type": "$NAGIOS_NOTIFICATIONTYPE"
}
EOF
)
curl -s -X POST "$WEBHOOK_URL" \
-H "Content-Type: application/json" \
-d "$PAYLOAD"
Make it executable:
chmod +x /usr/local/nagios/libexec/notify-alert24.sh
Step 3: Define the Nagios Notification Command
In your Nagios commands configuration (typically /etc/nagios/objects/commands.cfg or a custom file), add:
define command {
command_name notify-service-alert24
command_line /usr/local/nagios/libexec/notify-alert24.sh
}
define command {
command_name notify-host-alert24
command_line /usr/local/nagios/libexec/notify-alert24.sh
}
Step 4: Create a Contact That Uses These Commands
define contact {
contact_name alert24
alias Alert24 Webhook
service_notification_period 24x7
host_notification_period 24x7
service_notification_options w,u,c,r
host_notification_options d,u,r
service_notification_commands notify-service-alert24
host_notification_commands notify-host-alert24
email [email protected]
}
Add this contact to your existing contact groups, or create a new contact group:
define contactgroup {
contactgroup_name on-call
alias On-Call Team
members alert24
}
Assign on-call to the services or host groups you want to monitor.
Step 5: Verify the Integration
Trigger a test notification with nagios-send-service-check or temporarily force a service into a CRITICAL state. Watch the Alert24 inbound events log to confirm the payload arrives, then verify that your on-call engineer gets the configured notification — SMS, voice call, push, or all three depending on your Alert24 escalation policy.
How Alert24 Routes the Alert
Once the payload arrives, Alert24 takes over the delivery side:
- Matches the event to an alert policy based on severity, source, or host/service patterns you configure
- Notifies your on-call engineer via SMS, voice call, push notification — or a sequence of all three with configurable delays between them
- Escalates to the next person in the rotation if there's no acknowledgment within your defined window
- Tracks acknowledgment so the rest of the team can see who's handling it
- Suppresses duplicates so a flapping service doesn't spam the whole team
Your Nagios setup continues running checks on whatever interval you've defined. Alert24 handles what happens after a check fails and a human needs to respond.
Mapping Nagios States to Alert24 Severities
The notification script above passes $NAGIOS_SERVICESTATE directly. In Alert24, you can map these to alert priorities in your policy config:
| Nagios State | Suggested Alert24 Priority |
|---|---|
| CRITICAL | High — immediate SMS + voice call |
| WARNING | Medium — SMS, escalate to call if no ack in 10 min |
| UNKNOWN | Medium — SMS |
| RECOVERY | Informational — push notification only |
You can configure these mappings in Alert24's alert policy editor without touching your Nagios config again.
What You Don't Have to Build
Using this approach, you skip:
- Managing Twilio credentials and API version upgrades
- Writing escalation logic in shell or Python
- Building an on-call schedule system
- Storing acknowledgment state anywhere
- Handling notification deduplication during flapping
Nagios checks when things break. Alert24 handles what happens next. The boundary is clean: one tool per job.
Next Steps
- Create your Alert24 account at alert24.net and generate a webhook token under Integrations
- Deploy the notification script to your Nagios server and add the contact definition
- Configure an escalation policy in Alert24 — set your on-call rotation, notification channels, and escalation timing
- Test with a forced service check to confirm the full path: Nagios fires, Alert24 receives, your engineer gets a call
If you're running Nagios Core on a Linux host, the script above works without modification. If you're on Nagios XI, you can use the same approach — XI doesn't restrict event handlers — and it gives you more flexibility than the built-in notification add-ons because Alert24's escalation policies are more configurable.
The monitoring is already in place. The missing piece is reliable human notification.