Are dependencies zone-dependent?

Hi everyone,

I pretty much guess I already know the answer to the title question already (hint: they are), but I’ll still explain what we are trying to do :smiley:

We have numerous checks against the SentinelOne API. These checks run on hosts in many different zones.
As SentinelOne might “randomly” decide when they will have a maintenance and therefore the API is not reachable, we decided that a dependency is our best option to suppress notifications.

For that I created a health check for the API that is run in “zone A”.
All the other checks using the API are run in “zone A” to “zone Z”

Now the problem is that the dependency causes the config validation to fail on the satellites of the various zones (This happens silently I might add, we are investigating that) and the new configuration isn’t activated.

Message is

Error: Validation failed for object 'zoneX-mgmt02!service-s1-fanotify!generic-sentinelone-dependency' of type 'Dependency'; Attribute 'parent_host_name': Object 'SentinelOne_Mgmt-Console' of type 'Host' does not exist.

Dependency config


apply Dependency "generic-sentinelone-dependency" to Service {
    import "sentinelone_agent_health-dependency"

    parent_host_name = "SentinelOne_Mgmt-Console"
    parent_service_name = "s1_mgmt-console_status"
    assign where match("service-s1-*", || match("service-sentinel*", || match("sentinelone*",
    states = [ OK ]

Parent host configuration:

object Host "SentinelOne_Mgmt-Console" {
    import "zoneA-azure-host-template"
    import "dummy_hosts"

    address = "the API url of sentinelone"
    vars.notification_period = "none"

Is there a possibility to get this setup running?
It seems like the dependency objects are created in the respective zone of the host and not in the global zone.

Any insight into this would be helpful :slight_smile:


Do the dependency objects need to exist outside of the master zone?
In my case the masters are the only ones that do the notifying and if I’m correct the master needs to know all objects or it will discard information form satellites and agents about the object.

1 Like


If you have multiple zones (like we do), objects are a “member” of a specific zone. And each zone only has knowledge about its own objects.
The master knows about all objects because it holds the entire config.
And that is the problem here, because the parent host is inside the master zone, which the objects of the other zones don’t know about.

Ping @theFeu. Is there any hope that I can get this config working^^? Maybe someone of the Icinga core team could share an insight.

1 Like

But have you tried to configure the apply dependency only in the master zone?

Nope, haven’t done that yet.
As I used the Director the config is placed in the Directors global zone.

Will try putting it in the master zone via a dedicated config file though!

Thanks :slight_smile:

edit: does not work either.
The config deploys without problem on the master and the satellites and I can see the dependency objects

Object 'q1au3-dc01!service-sentinelagent!generic-sentinelone-dependency' of type 'Dependency':
  % declared in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
  * __name = "q1au3-dc01!service-sentinelagent!generic-sentinelone-dependency"
  * child_host_name = "q1au3-dc01"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
  * child_service_name = "service-sentinelagent"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
  * disable_checks = false
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 10:5-10:26
  * disable_notifications = true
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 11:5-11:32
  * ignore_soft_states = false
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 12:5-12:30
  * name = "generic-sentinelone-dependency"
  * package = "_etc"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
  * parent_host_name = "SentinelOne_Mgmt-Console"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 17:5-17:49
  * parent_service_name = "s1_mgmt-console_status"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 18:5-18:50
  * period = "24x7"
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 13:5-13:19
  * source_location
    * first_column = 1
    * first_line = 14
    * last_column = 60
    * last_line = 14
    * path = "/etc/icinga2/zones.d/master/dependencies.conf"
  * states = [ "OK" ]
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 14:5-14:28
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 20:5-20:19
  * templates = [ "generic-sentinelone-dependency", "sentinelone_agent_health-dependency" ]
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60
    % = modified in '/var/lib/icinga2/api/packages/director/2c0ccb8a-2350-428f-8bed-029ad028d635/zones.d/director-global/dependency_templates.conf', lines 9:1-9:57
  * type = "Dependency"
  * vars = null
  * zone = "q1au3-private_vcloud"
    % = modified in '/etc/icinga2/zones.d/master/dependencies.conf', lines 14:1-14:60

But when I set the parent service in a critical state the “Reachable” status in the web interface does not change on any host :frowning:

Hello @log1c!

No idea how to do the following in Director, but as a static config user I’d try to move the parent object definition to the child zone, but setting zone=“master”. That way I could move the Dependency to the child zone as well.


Hi @Al2Klimov

thanks for the suggestion.
Never knew I could create a host object in a child zone and pin it to a different zone.

Apart from that, wouldn’t I then have to do that for each child zone (currently around 15)?

I would have liked to have one host object that acts as a parent and the dependency objects not inside the different satellite zones, so they don’t care that the parent isn’t in “their” zone.

Would putting the dependency config in the master zone work, because the master should know about all objects?

That would be the nicer option, have you tried it out?
Oh, and while you’re on it do zone=“master” in the apply rule.
Yes. zone=“master” in an apply rule already being in a file of the master zone.

has not been merged yet.

This actually works. I’m a bit surprised to be honest :smiley:
Had the dependency config in the master zone once before, but without the zone = "master".
That was the last bit that made it work.

apply Dependency "generic-sentinelone-dependency" to Service {
    import "sentinelone_agent_health-dependency"

    parent_host_name = "SentinelOne_Mgmt-Console"
    parent_service_name = "s1_mgmt-console_status"
    states = [ OK ]
    zone = "master"
    assign where match("service-s1-*", || match("service-sentinel*", || match("sentinelone*",


And this would make it possible to put zone = "whatever" into a config that is sitting in a different zone than “whatever”, correct?

1 Like

The PR would automatically write zone = $ZONE in apply rules being in $ZONE.

Director puts the dependency in the global zone by default…but you can pick a specific zone in the interface to override that.

Hi @Al2Klimov
I have a follow-up question.

Due to a problem with our HA-Cluster (continuous sync loop) , which resulted in the need to shut down one of the nodes, we did some debugging and stumbled upon a “curious” behavior.

After I activated the dependency config above the IDO mysql-queries increased about 2x-3x to ~150-200k per 15min

After deactivating the dependecy apply rule again the queries went down to their “normal” number to ~60k per 15min.

Is this a normal behavior?

I don’t think so.

Hi all, I would like to expand on this topic because we have a use case which requires that a dependency works for hosts which are in different child zones not the master zone. So basically we have a distributed Icinga cluster with 3 zones. Each of these zones contains a host with 2 services replicalag1 and replicalag2 which check the state of replication of a generic postgres cluster. What we are trying to achieve is that an alert should be notified only if at least one of the replicalag1 services is in error and a corresponding replicalag2 service is also in error on at least one of the slave postgres nodes. Also we only schedule a replicalag2 service check if one of the replicalag1 services is in error.
Now using the latest icinga-director 1.11 we have most of this working. The only problem we are experiencing is that the config validation fails because each host is in a different zone so it complains that it can’t find the host in the other zones.
I think for dependencies to make sense there must be some way to allow global visibility of hosts otherwise the service to host or host to host aspect looses a lot of potential. Has anyone got something similar working? We are using a host custom variable to pass the nodes of the postgres cluster for the dependency apply rule. So each of the three hosts references at least a node which is in another zone.
Hope something can work.