How to clear an event in Nagios

Take a look at the Nagios macro ISVALIDTIME.

This is a special on-demand macro that returns a 1 or 0 depending on whether or not a particular time is valid within a specified timeperiod. There are two ways of using this macro:

$ISVALIDTIME:24x7$ will be set to "1" if the current time is valid within the "24x7" timeperiod. If not, it will be set to "0".
$ISVALIDTIME:24x7:timestamp$ will be set to "1" if the time specified by the "timestamp" argument (which must be in time_t format) is valid within the "24x7" timeperiod. If not, it will be set to "0".

Don't know whether this is present in the service context, but you can test it. Define a timeperiod "non-working hours" and take ISVALIDTIME as a parameter to your eventhandler script. When the script is called during working hours, let it do nothing and exit.

When this doesn't work, you could just verify the time of day in the eventhandler script.

check_http can only check one site at a time. If you need to check multiple sites in a single service check, you would need to write your own check to implement the logic. This could easily be done in a simple shell script that calls check_http for each virtual host and returns the appropriate failure code to Nagios if any of the check_http executions are unsuccessful. Such a script might look like the following.

#!/bin/sh

for HOST in $* ; do
   check_http -H $HOST [...other args...] >/dev/null 
   if [ $? -ne 0 ] ; then
      echo "$HOST not responding"
      exit 2
   fi
done
echo "All hosts ok"
exit 0

Alternatively, you may be able to use Nagios' service dependencies to reach your goal. Assume for the moment that you wish to check all of your Apache virtual hosts but not be flooded with a notification for each one if the Apache process is not available. This would allow you to see the status detail of each virtual host, allow for more fine grained reporting, and let you have different notification and time period options.

To implement this you would create a service check for each virtual host, then create one check for Apache, presumably by using check_http to check via the IP address and make sure something is listening on port 80.

Next you would create service dependencies for each virtual host's service check and configure them to be dependent on the Apache check. If the Apache check fails, all of the virtual host checks (which depend on the Apache check) will stop sending notifications and/or executing checks until the Apache check recovers.