nagios.log file locations

[luniversity]

I've recently taken over our Nagios XI environment. We are currently running 2012R1.2. I recently purchase the Enterprise license so that we can have access to the functionality it offers. I am also planning to upgrade to the latest version next week. While testing some of the reporting functionality, the event log report in particular, I received an error message:

Code: Select all

Error: Could not open log file '/var/log/nagios/nagios.log' for reading!

This got me to looking for my nagios.log file on my server. Currently, the only nagios.log file I can find is located here:

Code: Select all

[root@nagios01r6v /]# find / -xdev -iname 'nagios.log'
/usr/local/nagios/var/nagios.log

But my config file contains these entries:

Code: Select all

[root@nagios01r6v /]# grep "log" /usr/local/nagios/etc/nagios.cfg
log_event_handlers=0
log_archive_path=/var/log/nagios/archives
log_external_commands=0
log_file=/var/log/nagios/nagios.log
log_host_retries=1
log_initial_states=0
log_notifications=1
log_passive_checks=0
log_rotation_method=d
log_service_retries=1
use_syslog=0

The directory /var/log/nagios does not exist on my server. I suspect I need to change the log_archive_path and log_file variables to point to /usr/local/nagios but as I am unfamiliar with Nagios I wanted to get input from someone with more experience. Any suggestions or comments would be appreciated.

[tgriep]

Yes you could change this from

Code: Select all

log_archive_path=/var/log/nagios/archives
log_file=/var/log/nagios/nagios.log

To

Code: Select all

log_archive_path=/usr/local/nagios/var/archives
log_file=/usr/local/nagios/var/nagios.log

Then restart nagios

Code: Select all

service nagios restart

Then the log files will be where you want.

[jdalrymple]

Mike,

Your log is in the proper place, the configuration file is pointing to the wrong place and I'm not sure why.

Let's start by making sure that you're even running from the proper nagios.cfg. If you do

Code: Select all

ps -ef | grep nagios

you will probably get quite a lot of output, one or more of the processes should be the nagios main process and it should indicate the configuration file in use after the '-d' argument. Can you take a peek at that for us?

Also, whereabouts are your archives? Are they where that file indicates or are they in the proper place

Code: Select all

/usr/local/nagios/var/archives

?

[luniversity]

Looks like it's the right cfg file:

Code: Select all

nagios   29701  8206  0 13:15 ?        00:00:00 /usr/local/nagios/bin/nagios -d /usr/local/nagios/etc/nagios.cfg

And it looks like the only nagios.cfg on the system:

Code: Select all

[root@nagios01r6v ~]# find / -xdev -iname 'nagios.cfg'
/usr/local/nagios/etc/nagios.cfg

My archive files are in /usr/local/nagios/var/archives/, but the newest file in the directory is Apr 19, 2011. So I don't think they are getting archived.

[lmiltchev]

What is the log rotation method defined in the nagios.cfg?

Code: Select all

grep log_rotation_method /usr/local/nagios/etc/nagios.cfg

You used to have a different path, specified in the config... Do you have anything in the "/var/log/nagios/archives"? Also, are you using mk livestatus? I have seen cases where livestatus creates issues with log rotation in nagios.

[luniversity]

It's set to 'd', which I believe is for daily.

Code: Select all

[root@nagios01r6v ~]# grep log_rot /usr/local/nagios/etc/nagios.cfg
log_rotation_method=d

[lmiltchev]

Do you have anything in the "/var/log/nagios/archives"? Are you using mk livestatus? The "old" archives could've been deleted by someone. It is hard to say. I would recommend keeping an eye on the archives to see if logs will rotate daily from now on.

[luniversity]

No, the /var/log/nagios directory does not even exist. I'm not familiar with mk livestatus. How can I tell if it's running?

[jdalrymple]

I'm not familiar with mk livestatus. How can I tell if it's running?

Code: Select all

grep mk-livestatus /usr/local/nagios/etc/nagios.cfg

[lmiltchev]

Search for "broker_module" lines in the nagios.cfg file. You will see something similar to this:

Code: Select all

broker_module=/usr/local/lib/mk-livestatus/livestatus.o /usr/local/nagios/var/rw/live

If you don't have it, or if it is commented out, this means you are not using it.