version 5.2.0

- Add ping_monitor to built-in plugins list
- Update cpu_monitor (uptime) and memory_monitor (ZFS ARC) descriptions
- Replace "aggregated status" bullet with accurate per-check reporting note
- Fix RTT hysteresis default: 0.1 → 0.02
- Fix client YAML config: remove non-existent server:/port: keys, use hb_port:
- Fix nagios_runner commands format: plain strings → {name:, command:} dicts
- Fix Supported Metrics: exit_code → actual <name>_status_code/<name>_status/<name>_output fields

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -58,10 +58,11 @@ Heartbeat includes a comprehensive plugin architecture that extends monitoring b
 ### Built-in Plugins
 
 - `os_info`: Collects OS, kernel, distribution, and architecture information
-- `cpu_monitor`: Monitors CPU usage, load average, frequency, and process counts
+- `cpu_monitor`: Monitors CPU usage, load average, frequency, process counts, and uptime
-- `memory_monitor`: Monitors RAM and swap usage, available memory
+- `memory_monitor`: Monitors RAM and swap usage, available memory (ZFS ARC-aware)
 - `disk_monitor`: Monitors disk usage, I/O statistics, and filesystem metrics
 - `network_monitor`: Monitors network interface statistics, bandwidth, and connections
+- `ping_monitor`: Measures round-trip latency to configured hosts
 - `filesystem_info`: Collects mounted filesystem information (physical filesystems only by default)
 - `nagios_runner`: Executes Nagios monitoring plugins (check_disk, check_load, check_http, etc.)
 - `zfs_monitor`: Monitors ZFS pool health, capacity, fragmentation, dedup ratio, and cumulative I/O via `zpool(8)`
@@ -76,7 +77,7 @@ The `nagios_runner` plugin provides seamless integration with the vast Nagios pl
 - Validates absolute command paths at startup and warns on missing or non-executable files
 - Parses exit codes (OK/WARNING/CRITICAL/UNKNOWN)
 - Extracts performance data with thresholds
-- Reports aggregated status across all configured checks
+- Reports per-check status, exit code, and output; no aggregate rollup field
 
 See [docs/NAGIOS_INTEGRATION.md](docs/NAGIOS_INTEGRATION.md) for complete integration guide including configuration examples and custom plugin development.
 
@@ -181,7 +182,8 @@ thresholds:
       warning: 80.0      # Warn when CPU > 80%
       critical: 90.0     # Critical when CPU > 90%
       operator: ">"
-      hysteresis: 0.1    # 10% hysteresis to prevent flapping
+      hysteresis: 0.02   # 2% hysteresis to prevent flapping
+      display: "(threshold: {op_symbol} {threshold_value}%)"  # optional
   
   memory_monitor:
     percent:
@@ -223,7 +225,7 @@ thresholds:
     <hostname>:
       warning: <milliseconds>   # Warn when RTT > this value
       critical: <milliseconds>  # Critical when RTT > this value
-      hysteresis: 0.1           # Optional: 10% hysteresis (default)
+      hysteresis: 0.02          # Optional: 2% hysteresis (default)
 ```
 
 **Example alerts:**
@@ -274,7 +276,59 @@ All plugin metrics can be thresholded:
 - **Memory**: percent, available_mb, swap_percent
 - **Disk**: Per-partition percent, free_gb, free_mb
 - **Network**: errors_total, dropped packets, connection counts
-- **Nagios**: exit_code mapping (0=OK, 1=WARNING, 2=CRITICAL)
+- **Nagios**: Any field emitted by `nagios_runner` (`<name>_status_code`, `<name>_status`, `<name>_output`, performance data fields)
+
+### Display Format Templates
+
+Each threshold entry accepts an optional `display` field — a Python format string shown in notifications and on the Alerts dashboard:
+
+```yaml
+nagios_runner:
+  status_code:
+    warning: 1
+    critical: 2
+    operator: ">="
+    display: "{check_name}: exit {value} (expected < {threshold_value})"
+```
+
+Available variables:
+
+| Variable | Description |
+|---|---|
+| `{value}` | Current metric value |
+| `{threshold_value}` | Threshold that was crossed |
+| `{op_symbol}` | Comparison operator (`>`, `<`, `>=`, …); `"nagios"` for the nagios operator |
+| `{check_name}` | Prefix stripped by generic matching (see below) |
+| `{metric_name}` | Full field name within the plugin data |
+| `{output}` | For `nagios_runner` generic matches: the matched check's status text (alias for `{check_name}_output`) |
+| `{status}` | For `nagios_runner` generic matches: the matched check's status name — OK/WARNING/CRITICAL/UNKNOWN (alias for `{check_name}_status`) |
+| any plugin field | Any other field present in the plugin's data |
+
+### Generic Threshold Matching
+
+When a metric name has no exact threshold entry, the server progressively strips leading underscore-separated segments and re-tries the lookup. This lets a single generic entry cover an entire family of metrics.
+
+The classic use case is `nagios_runner`, which names each metric after the command that produced it:
+
+```
+nagios_runner.check_disk_root_status_code    → no exact match
+nagios_runner.disk_root_status_code          → no match
+nagios_runner.root_status_code               → no match
+nagios_runner.status_code                    → matched ✓
+```
+
+Configure the generic threshold once using the `nagios` operator, which maps exit codes directly to alert severity without requiring numeric warning/critical values:
+
+```yaml
+nagios_runner:
+  status_code:
+    operator: "nagios"   # 0=OK  1=WARNING  2=CRITICAL  3=UNKNOWN
+    display: "{check_name}: {output}"
+```
+
+The stripped prefix (`check_disk_root` in the example above) is available as `{check_name}` in the display template, so you can identify which check triggered the alert without writing a separate threshold entry per command.
+
+Exact matches always take priority. A generic entry only applies when no specific one is defined.
 
 ### Per-Host Threshold Profiles
 
@@ -461,12 +515,11 @@ You can also run it via the module entrypoint:
 python -m hbd.client.main your-server.example.com
 ```
 
-Client configuration can also be specified in YAML:
+Client configuration can also be specified in YAML (`~/.hbc.yaml`):
 
 ```yaml
-server: hbd.example.com
+hb_port: 50003        # Server port (default: 50003)
-port: 50003
+interval: 30          # Heartbeat interval in seconds
-interval: 30
 plugins:
   cpu_monitor:
     interval: 300      # Check every 5 minutes (default)
@@ -480,10 +533,14 @@ plugins:
   nagios_runner:
     interval: 300      # Check every 5 minutes (default)
     commands:
-      - /usr/lib/nagios/plugins/check_load -w 5,4,3 -c 10,8,6
+      - name: check_load
-      - /usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /
+        command: /usr/lib/nagios/plugins/check_load -w 5,4,3 -c 10,8,6
+      - name: check_disk
+        command: /usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /
 ```
 
+The server hostname is always passed as a positional command-line argument; there is no `server:` config key.
+
 All monitoring plugins default to 5-minute (300 second) intervals, but can be customized as needed.
 
 **Connection retry:** If a server is temporarily unreachable, `hbc` retries `open()` indefinitely on every heartbeat interval. IPv6 connections that never succeeded during early startup are dropped after 3 consecutive failures (to handle hosts without IPv6 routing), while IPv4 connections always retry.

docs/NAGIOS_INTEGRATION.md

@@ -104,11 +104,6 @@ The `nagios_runner` plugin collects:
 - `{name}_{metric}_min` - Minimum value (if present)
 - `{name}_{metric}_max` - Maximum value (if present)
 
-**Overall:**
-- `overall_status` - Worst status from all commands
-- `overall_status_code` - Worst status code
-- `plugin_count` - Number of Nagios plugins executed
-
 ## Configuration Options
 
 ```yaml

docs/THRESHOLD_ALERTING.md

@@ -1110,33 +1110,6 @@ hosts:
   db-02:
     threshold_config: [tight_memory, db_disk]
 ```
-
-### Backward Compatibility
-
-The legacy single threshold configuration is fully supported:
-
-```yaml
-# Old format - still works
-thresholds:
-  cpu_monitor:
-    cpu_percent:
-      warning: 80.0
-      critical: 90.0
-```
-
-This is equivalent to:
-
-```yaml
-# New format
-threshold_configs:
-  default:
-    thresholds:
-      cpu_monitor:
-        cpu_percent:
-          warning: 80.0
-          critical: 90.0
-```
-
 ### Configuration Priority
 
 1. **Host `threshold_config` (list)**: Layer each named config's overrides left-to-right on top of the defaults

hbd/__init__.py

@@ -14,4 +14,4 @@ Install options:
 """
 
 __all__ = ["__version__"]
-__version__ = "5.1.18"
+__version__ = "5.2.0"

hbd/client/main.py

@@ -463,18 +463,14 @@ async def cleanup(connections: List[AsyncConnection]):
     logger = logging.getLogger("hbc.cleanup")
     logger.info("Cleaning up connections")
     
-    for conn in connections:
+    target = next((c for c in connections if c.transport), connections[0] if connections else None)
+    if target:
         try:
-            msg = {
+            await target.sendto({"shutdown": 1, "acks": target.ackcount})
-                "shutdown": 1,
-                "acks": conn.ackcount
-            }
-            await conn.sendto(msg)
         except Exception as e:
             logger.error(f"Error sending shutdown: {e}")
-        
+    for conn in connections:
         conn.close()
-        break  # Only send shutdown on first connection to avoid duplicates
     
     # Give messages time to send
     await asyncio.sleep(0.5)
@@ -539,9 +535,8 @@ async def async_main(args, config):
             boot_msg["msg"] = args.message
         
         boot_msg["acks"] = 0
-        for conn in connections:
+        target = next((c for c in connections if c.transport), connections[0])
-            await conn.sendto(boot_msg)
+        await target.sendto(boot_msg)
-            break  # Only send message on first connection to avoid duplicates
         
         if args.message and not args.daemon:
             # Message-only mode

hbd/client/plugins/cpu_monitor.py

@@ -119,6 +119,13 @@ class CPUMonitorPlugin(MonitorPlugin):
             except Exception as e:
                 self.logger.debug(f"Could not get CPU times: {e}")
 
+            # Uptime in seconds
+            try:
+                import time
+                data["uptime_seconds"] = int(time.time() - self.psutil.boot_time())
+            except Exception as e:
+                self.logger.debug(f"Could not get uptime: {e}")
+            
             self.logger.debug(
                 f"Collected CPU metrics: {data.get('cpu_percent', 'N/A')}% usage"
             )

hbd/client/plugins/memory_monitor.py

@@ -14,6 +14,24 @@ except ImportError:
 
 from hbd.client.plugin import MonitorPlugin
 
+
+def _zfs_arc_bytes() -> int:
+    """Return current ZFS ARC size in bytes, or 0 if ZFS is not present.
+
+    ZFS ARC is reclaimable but is not included in MemAvailable by the Linux
+    kernel (it is not in SReclaimable), so it would otherwise be counted as
+    used memory.
+    """
+    try:
+        with open("/proc/spl/kstat/zfs/arcstats") as fh:
+            for line in fh:
+                parts = line.split()
+                if len(parts) >= 3 and parts[0] == "size":
+                    return int(parts[2])
+    except (OSError, ValueError):
+        pass
+    return 0
+
 logger = logging.getLogger(__name__)
 
 
@@ -101,11 +119,21 @@ class MemoryMonitorPlugin(MonitorPlugin):
         
         # Virtual (physical) memory statistics
         vmem = psutil.virtual_memory()
+
+        # psutil's available already excludes page cache / file buffers
+        # (uses MemAvailable on Linux). Add ZFS ARC on top because the kernel
+        # does not include it in SReclaimable / MemAvailable even though it is
+        # reclaimable.
+        arc_bytes = _zfs_arc_bytes()
+        available = min(vmem.available + arc_bytes, vmem.total)
+        used = vmem.total - available
+        percent = round(used / vmem.total * 100, 1) if vmem.total else 0.0
+
         metrics['memory_total'] = vmem.total
-        metrics['memory_available'] = vmem.available
+        metrics['memory_available'] = available
-        metrics['memory_used'] = vmem.used
+        metrics['memory_used'] = used
         metrics['memory_free'] = vmem.free
-        metrics['memory_percent'] = vmem.percent
+        metrics['memory_percent'] = percent
         
         # Platform-specific memory details
         if hasattr(vmem, 'active'):

hbd/client/plugins/nagios_runner.py

@@ -31,16 +31,13 @@ from hbd.client.plugin import MonitorPlugin
 
 
 # Nagios exit codes
-NAGIOS_OK = 0
-NAGIOS_WARNING = 1
-NAGIOS_CRITICAL = 2
 NAGIOS_UNKNOWN = 3
 
 STATUS_NAMES = {
-    NAGIOS_OK: "OK",
+    0: "OK",
-    NAGIOS_WARNING: "WARNING",
+    1: "WARNING",
-    NAGIOS_CRITICAL: "CRITICAL",
+    2: "CRITICAL",
-    NAGIOS_UNKNOWN: "UNKNOWN"
+    3: "UNKNOWN",
 }
 
 
@@ -129,9 +126,6 @@ class NagiosRunnerPlugin(MonitorPlugin):
         """
         results = {}
 
-        # Track overall status (worst status wins)
-        worst_status = NAGIOS_OK
-        
         for cmd_config in self.commands:
             name = cmd_config.get("name")
             command = cmd_config.get("command")
@@ -149,10 +143,6 @@ class NagiosRunnerPlugin(MonitorPlugin):
                 results[f"{name}_status_code"] = status_code
                 results[f"{name}_output"] = output
 
-                # Track worst status
-                if status_code > worst_status:
-                    worst_status = status_code
-                
                 # Parse and add performance data
                 if perfdata:
                     for metric_name, metric_value in perfdata.items():
@@ -167,12 +157,6 @@ class NagiosRunnerPlugin(MonitorPlugin):
                 results[f"{name}_status"] = "ERROR"
                 results[f"{name}_status_code"] = NAGIOS_UNKNOWN
                 results[f"{name}_output"] = str(e)
-                worst_status = NAGIOS_UNKNOWN
-        
-        # Add overall status
-        results["overall_status"] = STATUS_NAMES.get(worst_status, "UNKNOWN")
-        results["overall_status_code"] = worst_status
-        results["plugin_count"] = len(self.commands)
 
         return results
     

hbd/server/config.py

@@ -95,6 +95,12 @@ THRESHOLD_DEFAULTS = {
                 'warning': 200,
                 'critical': 250.0,
                 'count': 3  # Optional: number of consecutive breaches before alerting
+            },
+            'nagios_runner': {
+                'status_code': {
+                    'display': '{check_name} {output}',
+                    'operator': "nagios"
+                }   
             }
         }
     }

hbd/server/templates/alerts.html

@@ -4,7 +4,7 @@
 
   <style>
 
-    body {
+    html, body {
       height: auto;
       overflow-y: auto;
     }
@@ -175,8 +175,12 @@
 
     .alert-hostname {
       font-weight: bold;
-      color: #333;
+      color: #0066cc;
       font-size: 1.1em;
+      text-decoration: none;
+    }
+    .alert-hostname:hover {
+      text-decoration: underline;
     }
 
     .alert-metric {
@@ -405,6 +409,10 @@
         } else if (alert.threshold_value !== undefined && alert.threshold_value !== null && alert.operator) {
           valueText += ` <span class="threshold-info">(threshold: ${alert.operator} ${formatValue(alert.threshold_value)})</span>`;
         }
+        if (alert.recovery_threshold !== undefined && alert.recovery_threshold !== null) {
+          const recOp = (alert.operator === '>' || alert.operator === '>=') ? '<' : '>';
+          valueText += ` <span class="threshold-info" style="color:#888">(recovers ${recOp} ${formatValue(alert.recovery_threshold)})</span>`;
+        }
         
         // Build actions section
         let actionsHtml = '';
@@ -429,7 +437,7 @@
             <div class="alert-main">
               <div class="alert-header">
                 <span class="alert-level ${level}">${alert.level}</span>
-                <span class="alert-hostname">${alert.hostname}</span>
+                <a class="alert-hostname" href="/plugins#${alert.hostname}">${alert.hostname}</a>
               </div>
               <div class="alert-metric">${alert.metric_path}</div>
               <div class="alert-details">

hbd/server/templates/plugins.html

@@ -499,6 +499,17 @@
         return pluginCache[hostname]?.[pluginName] ?? null;
       }
 
+      // Return worst nagios exit code (0-3) found in a nagios_runner data object.
+      function nagiosWorstStatus(data) {
+        let worst = 0;
+        for (const [k, v] of Object.entries(data || {})) {
+          if (k.endsWith('_status_code') && typeof v === 'number' && v > worst) {
+            worst = v;
+          }
+        }
+        return worst;
+      }
+
       // ── Fetch helpers ───────────────────────────────────────────────────────
 
       async function fetchPlugin(hostname, pluginName) {
@@ -600,13 +611,13 @@
           ? chips.join('')
           : '<span class="glance-loading">—</span>';
 
-        // Nagios badge
+        // Nagios badge — derive worst status from individual check codes
         const nagios = getCache(hostname, 'nagios_runner');
         if (nagosBadge && nagios) {
-          const status = (nagios.data.overall_status || '—').toUpperCase();
+          const worst = nagiosWorstStatus(nagios.data);
-          const cls = status === 'OK' ? 'ok'
+          const names = {0:'OK', 1:'WARNING', 2:'CRITICAL', 3:'UNKNOWN'};
-            : status === 'WARNING' ? 'warning'
+          const status = names[worst] || '—';
-            : status === 'CRITICAL' ? 'critical' : '';
+          const cls = worst === 0 ? 'ok' : worst === 1 ? 'warning' : worst >= 2 ? 'critical' : '';
           nagosBadge.className = `nagios-badge ${cls}`;
           nagosBadge.textContent = status;
         }
@@ -715,9 +726,10 @@
             break;
           }
           case 'nagios_runner': {
-            const status = (d.overall_status || '?').toUpperCase();
+            const worst = nagiosWorstStatus(d);
-            const count = d.plugin_count;
+            const names = {0:'OK', 1:'WARNING', 2:'CRITICAL', 3:'UNKNOWN'};
-            text = status + (count != null ? ` — ${count} checks` : '');
+            const codes = Object.keys(d).filter(k => k.endsWith('_status_code'));
+            text = (names[worst] || '?') + (codes.length ? ` — ${codes.length} checks` : '');
             break;
           }
           case 'filesystem_info': {

hbd/server/threshold.py

@@ -30,12 +30,13 @@ class AlertLevel(Enum):
 
 class ComparisonOperator(Enum):
     """Supported comparison operators for threshold checks."""
-    GT = ">"      # Greater than
+    GT = ">"        # Greater than
-    GTE = ">="    # Greater than or equal
+    GTE = ">="      # Greater than or equal
-    LT = "<"      # Less than
+    LT = "<"        # Less than
-    LTE = "<="    # Less than or equal
+    LTE = "<="      # Less than or equal
-    EQ = "=="     # Equal to
+    EQ = "=="       # Equal to
-    NEQ = "!="    # Not equal to
+    NEQ = "!="      # Not equal to
+    NAGIOS = "nagios"  # Nagios exit-code semantics: 0=OK 1=WARNING 2=CRITICAL 3=UNKNOWN
 
 
 class AlertState:
@@ -57,6 +58,7 @@ class AlertState:
         self.last_notification = None
         self.threshold_value = None  # The threshold value that triggered alert
         self.operator = None  # The comparison operator (>, <, >=, etc.)
+        self.hysteresis: Optional[float] = None  # Hysteresis fraction used for recovery
         self.formatted_message = None  # Formatted display message for UI
         self.acknowledged = False  # Whether alert has been acknowledged
         self.acknowledged_at = None  # Timestamp when acknowledged
@@ -152,6 +154,15 @@ class AlertState:
         if self.formatted_message is not None:
             result["formatted_message"] = self.formatted_message
 
+        # Compute and expose the recovery threshold so the UI can display it
+        if (self.hysteresis and self.threshold_value is not None
+                and self.operator is not None):
+            ha = abs(self.threshold_value * self.hysteresis)
+            if self.operator in ('>', '>='):
+                result["recovery_threshold"] = round(self.threshold_value - ha, 4)
+            elif self.operator in ('<', '<='):
+                result["recovery_threshold"] = round(self.threshold_value + ha, 4)
+
         return result
     
     def __setstate__(self, state):
@@ -159,6 +170,8 @@ class AlertState:
         self.__dict__.update(state)
         if not hasattr(self, 'consecutive_count'):
             self.consecutive_count = 0
+        if not hasattr(self, 'hysteresis'):
+            self.hysteresis = None
 
     def acknowledge(self):
         """Acknowledge this alert to stop reminder notifications."""
@@ -227,6 +240,16 @@ class ThresholdConfig:
         if not self.enabled:
             return AlertLevel.OK
 
+        # Nagios exit-code semantics: value IS the severity
+        if self.operator == ComparisonOperator.NAGIOS:
+            try:
+                code = int(value)
+            except (TypeError, ValueError):
+                return AlertLevel.UNKNOWN
+            return {0: AlertLevel.OK, 1: AlertLevel.WARNING, 2: AlertLevel.CRITICAL}.get(
+                code, AlertLevel.UNKNOWN
+            )
+
         try:
             # Convert value to float for comparison
             value = float(value)
@@ -263,6 +286,10 @@ class ThresholdConfig:
         """
         new_level = self.evaluate(value)
 
+        # Nagios exit codes are discrete integers — hysteresis doesn't apply
+        if self.operator == ComparisonOperator.NAGIOS:
+            return new_level
+
         # If no hysteresis, return new level
         if self.hysteresis == 0.0:
             return new_level
@@ -396,10 +423,24 @@ class ThresholdChecker:
         Supports two formats:
         1. Legacy format with direct 'thresholds' section
         2. New format with 'threshold_configs' and 'host_threshold_mapping'
+
+        In all cases, THRESHOLD_DEFAULTS are seeded into threshold_configs["default"]
+        so the Settings page always shows the built-in defaults.
+        _parse_multi_config() overwrites this with the fully-merged effective defaults.
         """
+        # Always expose built-in defaults through threshold_configs["default"] so
+        # the Settings page has something to display even in legacy/no-config mode.
+        seed: Dict[str, ThresholdConfig] = {}
+        for plugin_name, plugin_thresholds in THRESHOLD_DEFAULTS.get("thresholds", {}).items():
+            if isinstance(plugin_thresholds, dict):
+                self._parse_plugin_thresholds(plugin_name, plugin_thresholds, target_dict=seed)
+        if seed:
+            self.threshold_configs["default"] = seed
+            self.threshold_raw_configs["default"] = {}
+
         # Check for new multi-config format
         if "threshold_configs" in config:
-            self._parse_multi_config(config)
+            self._parse_multi_config(config)  # overwrites threshold_configs["default"]
         elif "thresholds" in config:
             # Legacy single threshold configuration
             self._parse_legacy_config(config)
@@ -545,11 +586,14 @@ class ThresholdChecker:
             warning = threshold_config.get("warning")
             critical = threshold_config.get("critical")
             operator = threshold_config.get("operator", ">")
-            display = threshold_config.get("display", "(threshold: {op_symbol} {threshold_value})")
+            # Nagios operator maps exit codes directly; no numeric thresholds needed
-            hysteresis = threshold_config.get("hysteresis", 0.1)  # 10% default
+            is_nagios_op = (operator == "nagios")
+            default_display = "{check_name}: {output}" if is_nagios_op else "(threshold: {op_symbol} {threshold_value})"
+            display = threshold_config.get("display", default_display)
+            hysteresis = threshold_config.get("hysteresis", 0.0 if is_nagios_op else 0.02)
             enabled = threshold_config.get("enabled", True)
 
-            if warning is None and critical is None:
+            if warning is None and critical is None and not is_nagios_op:
                 logger.warning("No thresholds defined for %s, skipping", metric_path)
                 continue
             
@@ -649,7 +693,7 @@ class ThresholdChecker:
         warning = rtt_thresholds.get("warning")
         critical = rtt_thresholds.get("critical")
         operator = rtt_thresholds.get("operator", ">")
-        hysteresis = rtt_thresholds.get("hysteresis", 0.1)  # 10% default
+        hysteresis = rtt_thresholds.get("hysteresis", 0.02)  # 2% default
         enabled = rtt_thresholds.get("enabled", True)
         display = rtt_thresholds.get("display")
         count = rtt_thresholds.get("count", 1)
@@ -794,6 +838,12 @@ class ThresholdChecker:
         elif new_level == AlertLevel.WARNING and threshold.warning is not None:
             threshold_value = threshold.warning
 
+        # Keep hysteresis on the state so the UI can show the recovery threshold
+        if new_level != AlertLevel.OK:
+            alert_state.hysteresis = threshold.hysteresis
+        else:
+            alert_state.hysteresis = None
+
         # Update state and check for changes
         old_level = alert_state.level
         if alert_state.update(new_level, value, threshold_value, threshold.operator.value):
@@ -805,26 +855,33 @@ class ThresholdChecker:
         return None
     def _find_threshold(
         self, thresholds: Dict[str, "ThresholdConfig"], metric_path: str
-    ) -> Optional["ThresholdConfig"]:
+    ) -> Tuple[Optional["ThresholdConfig"], Optional[str]]:
-        """Return the threshold for *metric_path*, falling back to suffix matches.
+        """Return (threshold, check_name) for *metric_path*, falling back to suffix matches.
 
-        Allows generic thresholds like ``ping_monitor.rtt_avg`` to match
+        Allows generic thresholds like ``nagios_runner.status_code`` to match
-        fully-qualified paths like ``ping_monitor.8_8_8_8_rtt_avg``.
+        fully-qualified paths like ``nagios_runner.check_disk_root_status_code``.
         The exact match is always tried first; then successive leading
         underscore-delimited segments are stripped from the field name until
         a match is found or no segments remain.
+
+        Returns:
+            (ThresholdConfig, None) for an exact match.
+            (ThresholdConfig, "check_disk_root") for a suffix match — the second
+            element is the stripped prefix, available as ``{check_name}`` in
+            display format templates.
+            (None, None) when no threshold is found.
         """
         if metric_path in thresholds:
-            return thresholds[metric_path]
+            return thresholds[metric_path], None
         plugin, sep, field = metric_path.partition(".")
         if not sep:
-            return None
+            return None, None
         parts = field.split("_")
         for i in range(1, len(parts)):
             candidate = plugin + "." + "_".join(parts[i:])
             if candidate in thresholds:
-                return thresholds[candidate]
+                return thresholds[candidate], "_".join(parts[:i])
-        return None
+        return None, None
 
     def check_plugin_data(
         self,
@@ -854,7 +911,7 @@ class ThresholdChecker:
         for metric_name, value in data.items():
             metric_path = f"{plugin_name}.{metric_name}"
 
-            threshold = self._find_threshold(thresholds, metric_path)
+            threshold, check_name = self._find_threshold(thresholds, metric_path)
             if threshold is None:
                 continue
 
@@ -877,13 +934,15 @@ class ThresholdChecker:
             elif new_level == AlertLevel.WARNING and threshold.warning is not None:
                 threshold_value = threshold.warning
 
+            alert_state.hysteresis = threshold.hysteresis if new_level != AlertLevel.OK else None
+
             # Update state and check for changes
             old_level = alert_state.level
             if alert_state.update(new_level, value, threshold_value, threshold.operator.value):
                 state_changes.append((metric_path, old_level, new_level, value))
-                self._apply_grace(host_name, alert_state, metric_path, old_level, new_level, value, threshold, data)
+                self._apply_grace(host_name, alert_state, metric_path, old_level, new_level, value, threshold, data, check_name=check_name, metric_name=metric_name)
             elif new_level != AlertLevel.OK:
-                self._check_pending_or_renotify(host_name, alert_state, metric_path, value, threshold, data)
+                self._check_pending_or_renotify(host_name, alert_state, metric_path, value, threshold, data, check_name=check_name, metric_name=metric_name)
 
         # Check nested metrics (e.g., partition data in disk_monitor)
         self._check_nested_metrics(
@@ -943,6 +1002,8 @@ class ThresholdChecker:
                     elif new_level == AlertLevel.WARNING and threshold.warning is not None:
                         threshold_value = threshold.warning
 
+                    alert_state.hysteresis = threshold.hysteresis if new_level != AlertLevel.OK else None
+
                     old_level = alert_state.level
                     if alert_state.update(new_level, value, threshold_value, threshold.operator.value):
                         state_changes.append((metric_path, old_level, new_level, value))
@@ -959,6 +1020,8 @@ class ThresholdChecker:
         value: Any,
         threshold: ThresholdConfig,
         plugin_data: Optional[Dict[str, Any]] = None,
+        check_name: Optional[str] = None,
+        metric_name: Optional[str] = None,
     ):
         """Trigger a notification for an alert state change.
         
@@ -985,50 +1048,45 @@ class ThresholdChecker:
         import math
         display_value = "overdue" if isinstance(value, float) and math.isinf(value) else value
 
-        # Format message
+        # Format message — for the nagios operator there is no numeric threshold_value;
+        # render the display template whenever one is available.
+        has_display = threshold_value is not None or threshold.operator == ComparisonOperator.NAGIOS
+
+        def _fmt():
+            return self._format_display(
+                threshold.display,
+                value=display_value,
+                threshold_value=threshold_value,
+                op_symbol=op_symbol,
+                plugin_data=plugin_data,
+                check_name=check_name,
+                metric_name=metric_name,
+            )
+
         if new_level == AlertLevel.OK:
             lvl = "RECOVER"
             message = f"{metric_path} = {display_value} ({old_level.name} -> OK)"
         elif new_level == AlertLevel.WARNING:
             lvl = "WARNING"
-            if threshold_value is not None:
+            if has_display:
-                threshold_info = self._format_display(
+                message = f"{metric_path} = {display_value} {_fmt()}"
-                    threshold.display,
-                    value=display_value,
-                    threshold_value=threshold_value,
-                    op_symbol=op_symbol,
-                    plugin_data=plugin_data
-                )
-                message = f"{metric_path} = {display_value} {threshold_info}"
             else:
                 message = f"{metric_path} = {display_value}"
         elif new_level == AlertLevel.CRITICAL:
             lvl = "CRITICAL"
-            if threshold_value is not None:
+            if has_display:
-                threshold_info = self._format_display(
+                message = f"{metric_path} = {display_value} {_fmt()}"
-                    threshold.display,
-                    value=display_value,
-                    threshold_value=threshold_value,
-                    op_symbol=op_symbol,
-                    plugin_data=plugin_data
-                )
-                message = f"{metric_path} = {display_value} {threshold_info}"
             else:
                 message = f"{metric_path} = {display_value}"
         else:
             lvl = "UNKNOWN"
-            message = f"{metric_path} = {display_value}"
+            if has_display:
+                message = f"{metric_path} = {display_value} {_fmt()}"
+            else:
+                message = f"{metric_path} = {display_value}"
 
-        # Return the formatted threshold info for storing in AlertState
+        # Formatted threshold info stored on AlertState for the UI
-        formatted_threshold_msg = None
+        formatted_threshold_msg = _fmt() if has_display and new_level != AlertLevel.OK else None
-        if threshold_value is not None and new_level != AlertLevel.OK:
-            formatted_threshold_msg = self._format_display(
-                threshold.display,
-                value=display_value,
-                threshold_value=threshold_value,
-                op_symbol=op_symbol,
-                plugin_data=plugin_data
-            )
 
         return lvl, message, formatted_threshold_msg
     
@@ -1077,18 +1135,24 @@ class ThresholdChecker:
         self,
         display_format: str,
         value: Any,
-        threshold_value: float,
+        threshold_value: Optional[float],
         op_symbol: str,
         plugin_data: Optional[Dict[str, Any]] = None,
+        check_name: Optional[str] = None,
+        metric_name: Optional[str] = None,
     ) -> str:
         """Format the display string using available data.
 
-        Args:
+        Available template variables:
-            display_format: Format string from threshold config
+            {value}           - current metric value
-            value: Current metric value
+            {threshold_value} - threshold that was exceeded
-            threshold_value: Threshold value that was exceeded
+            {op_symbol}       - comparison operator (>, <, >=, <=, ==, !=)
-            op_symbol: Comparison operator symbol
+            {check_name}      - prefix stripped for generic threshold match
-            plugin_data: Optional dictionary of plugin data fields
+                                (e.g. "check_disk_root" when metric
+                                "check_disk_root_status_code" matched generic
+                                threshold "status_code")
+            {metric_name}     - field name within the plugin data dict
+            Any key from plugin_data is also available.
 
         Returns:
             Formatted display string
@@ -1096,14 +1160,34 @@ class ThresholdChecker:
         # Build format context with standard variables
         format_context = {
             'value': value,
-            'threshold_value': threshold_value,
             'op_symbol': op_symbol,
         }
+        if threshold_value is not None:
+            format_context['threshold_value'] = threshold_value
+
+        # Add generic-match context variables when available
+        if check_name is not None:
+            format_context['check_name'] = check_name
+        if metric_name is not None:
+            format_context['metric_name'] = metric_name
 
         # Add all plugin data fields if available
         if plugin_data:
             format_context.update(plugin_data)
 
+        # For nagios_runner generic matches, expose the matched check's output
+        # and status as short aliases {output} and {status} so display templates
+        # don't need to use the full {check_disk_root_output} form.
+        if check_name and plugin_data:
+            if 'output' not in format_context:
+                output = plugin_data.get(f"{check_name}_output")
+                if output is not None:
+                    format_context['output'] = output
+            if 'status' not in format_context:
+                status = plugin_data.get(f"{check_name}_status")
+                if status is not None:
+                    format_context['status'] = status
+        
         try:
             # Format the display string
             return display_format.format(**format_context)
@@ -1133,6 +1217,8 @@ class ThresholdChecker:
         value: Any,
         threshold: ThresholdConfig,
         plugin_data: Optional[Dict[str, Any]],
+        check_name: Optional[str] = None,
+        metric_name: Optional[str] = None,
     ) -> None:
         """Handle a state-change transition with grace-period logic.
 
@@ -1145,7 +1231,8 @@ class ThresholdChecker:
           - Past grace: fires the RECOVER notification normally.
         """
         lvl, message, formatted_msg = self._trigger_notification(
-            host_name, metric_path, old_level, new_level, value, threshold, plugin_data
+            host_name, metric_path, old_level, new_level, value, threshold, plugin_data,
+            check_name=check_name, metric_name=metric_name,
         )
         alert_state.formatted_message = formatted_msg
 
@@ -1181,6 +1268,8 @@ class ThresholdChecker:
         value: Any,
         threshold: ThresholdConfig,
         plugin_data: Optional[Dict[str, Any]],
+        check_name: Optional[str] = None,
+        metric_name: Optional[str] = None,
     ) -> None:
         """Called when alert level is unchanged and non-OK.
 
@@ -1190,7 +1279,8 @@ class ThresholdChecker:
         if alert_state.pending_since is not None:
             if time.time() - alert_state.pending_since >= self.grace_seconds:
                 lvl, message, formatted_msg = self._trigger_notification(
-                    host_name, metric_path, AlertLevel.OK, alert_state.level, value, threshold, plugin_data
+                    host_name, metric_path, AlertLevel.OK, alert_state.level, value, threshold, plugin_data,
+                    check_name=check_name, metric_name=metric_name,
                 )
                 alert_state.formatted_message = formatted_msg
                 self._send_notification(
@@ -1199,7 +1289,7 @@ class ThresholdChecker:
                 alert_state.pending_since = None
             # else: still within grace window, do nothing
         else:
-            self._check_renotify(host_name, alert_state, metric_path, value, threshold, plugin_data)
+            self._check_renotify(host_name, alert_state, metric_path, value, threshold, plugin_data, check_name=check_name, metric_name=metric_name)
 
     def _check_renotify(
         self,
@@ -1209,6 +1299,8 @@ class ThresholdChecker:
         value: Any,
         threshold: ThresholdConfig,
         plugin_data: Optional[Dict[str, Any]] = None,
+        check_name: Optional[str] = None,
+        metric_name: Optional[str] = None,
     ):
         """Check if we should send a repeat notification.
         
@@ -1255,7 +1347,9 @@ class ThresholdChecker:
                     value=value,
                     threshold_value=threshold_value,
                     op_symbol=op_symbol,
-                    plugin_data=plugin_data
+                    plugin_data=plugin_data,
+                    check_name=check_name,
+                    metric_name=metric_name,
                 )
                 message = f"REMINDER ({alert_state.level.name}): {host_name} - {metric_path} = {value} {threshold_info}, ongoing for {int(now - alert_state.since)}s"
             else:
@@ -1288,7 +1382,7 @@ class ThresholdChecker:
             if not host.alert_states:
                 continue
             configured = self.get_thresholds_for_host(hostname)
-            stale = [mp for mp in host.alert_states if mp not in configured]
+            stale = [mp for mp in host.alert_states if self._find_threshold(configured, mp)[0] is None]
             for mp in stale:
                 logger.info(
                     "Purging stale alert state for %s / %s (no threshold configured)",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hbd"
-version = "5.1.18"
+version = "5.2.0"
 description = "Heartbeat monitoring system — client (hbc) and server (hbd)"
 readme = "README.md"
 requires-python = ">=3.11"

scripts/hbc_mini.py

@@ -41,7 +41,7 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
 # updated by scripts/bumpminor.sh
-__version__ = "5.1.18"
+__version__ = "5.2.0"
 
 # ---------------------------------------------------------------------------
 # Protocol  (mirrors hbd/common/proto.py)
@@ -388,7 +388,6 @@ class NagiosRunnerPlugin(MonitorPlugin):
 
     async def _collect_metrics(self) -> Dict[str, Any]:
         results: Dict[str, Any] = {}
-        worst = 0
         for cmd_cfg in self.commands:
             name = cmd_cfg.get("name")
             command = cmd_cfg.get("command")
@@ -399,10 +398,6 @@ class NagiosRunnerPlugin(MonitorPlugin):
             results[f"{name}_status_code"] = rc
             results[f"{name}_output"] = msg
             results.update({f"{name}_{k}": v for k, v in perf.items()})
-            worst = max(worst, rc)
-        results["overall_status"] = _NAGIOS_STATUS.get(worst, "UNKNOWN")
-        results["overall_status_code"] = worst
-        results["plugin_count"] = len(self.commands)
         return results
 
 
@@ -487,6 +482,12 @@ class CPUMonitorPlugin(MonitorPlugin):
         except Exception:
             pass
 
+        try:
+            with open("/proc/uptime") as fh:
+                data["uptime_seconds"] = int(float(fh.read().split()[0]))
+        except Exception:
+            pass
+
         return data
 
 
@@ -535,6 +536,20 @@ class MemoryMonitorPlugin(MonitorPlugin):
         total = mi.get("MemTotal", 0)
         avail = mi.get("MemAvailable", mi.get("MemFree", 0))
         free = mi.get("MemFree", 0)
+
+        # ZFS ARC is reclaimable but not included in MemAvailable; add it.
+        arc_kb = 0
+        try:
+            with open("/proc/spl/kstat/zfs/arcstats") as _f:
+                for _line in _f:
+                    _p = _line.split()
+                    if len(_p) >= 3 and _p[0] == "size":
+                        arc_kb = int(_p[2]) // 1024
+                        break
+        except (OSError, ValueError):
+            pass
+
+        avail = min(avail + arc_kb, total)
         used = total - avail
         data: Dict[str, Any] = {
             "memory_total": total * 1024,
@@ -1052,9 +1067,8 @@ async def _async_main(args, cfg: Dict[str, Any]) -> int:
         if args.message:
             bmsg["service"] = "service"
             bmsg["msg"] = args.message
-        for c in connections:
+        target = next((c for c in connections if c._transport), connections[0])
-            await c.sendto(bmsg)
+        await target.sendto(bmsg)
-            break
         if args.message and not args.daemon:
             await asyncio.sleep(0.3)
             for c in connections:
@@ -1086,12 +1100,12 @@ async def _async_main(args, cfg: Dict[str, Any]) -> int:
         pass
 
     log.info("shutting down")
-    for conn in connections:
+    target = next((c for c in connections if c._transport), connections[0] if connections else None)
+    if target:
         try:
-            await conn.sendto({"shutdown": 1, "acks": conn.ackcount})
+            await target.sendto({"shutdown": 1, "acks": target.ackcount})
         except Exception:
             pass
-        break
     for conn in connections:
         conn.close()
     await asyncio.sleep(0.3)

test_nagios.py

@@ -68,8 +68,7 @@ async def test_nagios_runner():
     print(f"   ✓ Collected {len(data)} data points")
     
     print(f"\n4. Results:")
-    print(f"   Overall Status: {data.get('overall_status')} (code: {data.get('overall_status_code')})")
+    print(f"   Data points collected: {len(data)}")
-    print(f"   Plugins Executed: {data.get('plugin_count')}")
     
     # Show individual plugin results
     print(f"\n5. Individual Plugin Results:")