Show host/services to Thruk of contact_group with livestatus

[iam33]

Hi!
Thanks in advance!

I need configure Nagios to show only the hosts/services authorized to one contact_group determined, to a Thruk Server using livestatus.
How coul I do it? I can´t solve it!!

I´ve seen in OP5 some one like this(but not work in Nagios):

Code: Select all

broker_module=/usr/lib64/naemon-livestatus/livestatus.so hidden_custom_var_prefix=OP5SECRET_ pnp_path=/opt/monitor/op5/pnp/perfdata /opt/monitor/var/rw/live group_authorization=loose

Thank you so much!

[tgriep]

I think you need to setup Roles in the cgi.cfg file so filter access by users or groups. See this link for details.
https://thruk.org/documentation/cgi-cfg.html

You may want to post this on Thruk's site if you have any other questions about this.
https://thruk.org/support.html

[iam33]

thanks!

Sorry for the inconvenience, maybe I explained myself wrongly.

What I need is to filter the output that is thrown against the livestatus broker, so that it is only sent through the livestatus, what a determined group can see, not everything that is configured in Nagios.

[tgriep]

I am guessing that you want to limit what a user sees when the login to the server and that is not functioning.
You are trying to setup Thruck and Livestatus which are not Nagios applications and you should go to their sites for more details help on the issue.

But, I did find some links that talks about the Visibility of Hosts and Services for Livestatus and the broker_module group_authorization setting.
https://mathias-kettner.com/cms_wato_us ... visibility
https://support.itrsgroup.com/hc/en-us/ ... ermissions

The loose settings for the group_authorization from what I found.
Loose group authorization means that an authenticated contact will gain access to view a host group, given that the user has permission to see at least one of the host group's host members.

Switching to Strict, the user only sees hosts and services which the user is a contact for), will only get to see a certain host group, in case the group solely consists of hosts which the user already has access to view.

[iam33]

Hi!
thanks!!

It seems strange to me that you can not restrict the data from the source(Nagios / livestatus).

For example:
"If the Thruk server (from where the data will be requested via unixcat remotely) is mine, and the Nagios server is from a client of mine, who has asked me to monitor certain services not all of them, can not my client filter the information from the Nagios server of origin, it is absolutely necessary to publish via livestatus all the information on your Nagios server?"

Thank you so much!

[tgriep]

That's pretty much what the roles do in Thruk.
You login with a username that has limited access and that is all you see.
If you want to limit it beforehand, that would have to be part of livestatus and they would have to add it.