Nagios Support Forum

I'm running 1.3.0 - it says it is the latest available when I do an update check.

I've stepped the RAM up again, now 16Gb on each node. That seems to have done the trick. It has been stable for the past few hours now.

Thanks for your help, happy for this to be closed now.

That is looking a lot better now - at least I have logs in the dashboard. If I do "service logstash status" I am seeing lots of Message not fully read - is that normal? [root@hector ~]# service logstash status Logstash Daemonlogstash.service - LSB: Logstash Loaded: loaded (/etc/rc.d/init.d...

Thanks I've given that a go - doesn't seem to have helped as I only got a minute more of logs before it crashed again.

I saw another post about the elasticsearch heap size so I've upped that for both instances. I'll reboot everything and try again - thanks for the quick reply and suggestion.

Hi There, I have NLS running on 2 nodes - has been working well for quite a while now - it has been very set and forget. One of our users recently told me there was nothing in the dashboard, turns out they were right. If I restart elasticsearch and logstash I get about a minute worth of data then .....

Interesting. I had created the SMS contact in XI as a contact rather than a user. I deleted the contact and started again as a user and now I am seeing notifications coming through.

Thanks for the quick reply, it certainly put me on the right path. I'm happy for this ticket to be closed.

Hi There, I am running NagiosXI 2014R2.7 on 64-Bit CentOS 6.6. This is a manual install with no special configurations. I am trying to setup SMS by sending the messages via ssh to an Opengear ACM5505 appliance - I followed these instructions (http://www.linuxproblem.org/art_9.html) to setup SSH with...

OK after a bit of a break from this I came back with a clear head, spotted a typo and it is now working perfectly - no more _grokparsefailure and everything broken up nicely into fields.

Thank you for taking the time to look at this and provide assistance - I am happy for this to be closed.

I've added that filter but I'm not seeing any splitting into fields. I am now getting the tag "_grokparsefailure". The filter I am using is: if [host] == '172.21.5.193' { grok { match => [ "message", "\A%{TIMESTAMP_ISO8601:DateTime}%{SPACE}\[%{NUMBER:Number}\]%{SPACE}%{LOGLE...

That is exactly what I am looking for. I would also like to strip out the domain from the username but that is something I can work on for later.

Of all the doco I have read through I have not seen that page on grok yet so I'll have a look through that - thanks for the link.

I would like to do some manipulation of the fields (as you say, separate the domain and backslash from the username). At this stage I was just trying to get the message broken out into separate fields. Here is an entry from the NLS dashboard (the message field) 2015-01-14 16:39:33,474 [51] INFO [HCF...