BPI visibility inconsistency?

[gsl_ops_practice]

Hello,

We running latest 2014R2.7, and are setting up BPI groups so we can present a service dashboard to a team that only wants to see the overall status of the service without any details (and we don't want them to be able to drill down to see what's going on).

I created a test user without any access to anything, testbpiuser. I then added this user as an authorized user to the BPI group in question. When I log in as the testbpiuser, I can see the BPI group no problem, not able to expand it to see what makes up the group. So far so good.

I am am then logged in as an admin user, I bring down enough services to cause the master BPI group to turn red (looking at it as the admin user). Problem is, this same group says green when I am logged in as the testbpiuser.

Your thoughts on how this can fixed would be appreciated.

Thank you,
Alex

[gsl_ops_practice]

Ok, I just re-read the BPI documentation and found this bit:

Now non-admin users will only be able to view groups that they are specifically authorized for in the group definition. If a group has hosts or
services in it that a read-only user is not authorized to see, the member will be ignored for that user and will not be calculated for the
group's state, nor will it be visible in the user interface

We are specifically trying to create a dashboard to show the service status without revealing the nuts and bolts, so at this point I'm really not sure how to go about it. Any thoughts?

Thanks,
Alex

[gsl_ops_practice]

One more bit of info:

The Primary BPI group contains 3 other groups. I added the "testbpiuser" as an authorized user to each group, but they are not showing up as sub-groups under the primary group when testbpiuser is logged in.

Thanks,
Alex

[lmiltchev]

Can you show us how the 3 groups are defined in the BPI config?

Home->Nagios BPI->Manually Edit Config

[gsl_ops_practice]

Hello,

Please find config below:

Code: Select all

						
##################################

define 1234 {
		title=APP Availability
		desc=APP Availability
		primary=1
		info=
		members=$LOC1_appserver1_APP_availability;&, $LOC1_appserver2_APP_availability;&, $LOC1_appserver3_APP_availability;&, 
		warning_threshold=32
		critical_threshold=30 
		priority=2
		type=default
		auth_users=testbpmuser		
}

define LOC1_appserver1_APP_availability {
		title=LOC1_App1_APP
		desc=
		primary=0
		info=
		members=appserver-1-loc1;Log - APP Transactions;|, appserver-1-loc1;Process - APP 1;&, appserver-1-loc1;Process - APP 2;&, appserver-1-loc1;Process - APP 3;&, appserver-1-loc1;Process - APP 4;&, 
		warning_threshold=26
		critical_threshold=24 
		priority=2
		type=default
		auth_users=testbpmuser		
}

define LOC1_appserver2_APP_availability {
		title=LOC1_App2_APP
		desc=
		primary=0
		info=
		members=appserver-2-loc1;Log - APP Transactions;|, appserver-2-loc1;Process - APP 1;&, appserver-2-loc1;Process - APP 2;&, appserver-2-loc1;Process - APP 3;&, appserver-2-loc1;Process - APP 4;&, 
		warning_threshold=26
		critical_threshold=24 
		priority=2
		type=default
		auth_users=testbpmuser		
}
			

define LOC1_appserver3_APP_availability {
		title=LOC1_App3_APP
		desc=
		primary=0
		info=
		members=appserver-3-loc1;Log - APP Transactions;|, appserver-3-loc1;Process - APP 1;&, appserver-3-loc1;Process - APP 2;&, appserver-3-loc1;Process - APP 3;&, appserver-3-loc1;Process - APP 4;&, 
		warning_threshold=26
		critical_threshold=24 
		priority=2
		type=default
		auth_users=testbpmuser		
}

[lmiltchev]

What happens when you set "testbpmuser" user as a monitoring contact for all services, members of "LOC1_appserver1_APP_availability", "LOC1_appserver2_APP_availability", and "LOC1_appserver3_APP_availability" BPI groups AND THEIR HOSTs in Nagios XI? Can "testbpmuser" user view the subgroups after making these changes?

Note: In mid July I posted an internal bug report (task_id=5674) about an issue in BPI, where an authorized user is unable to view sub groups/hosts/services unless the user is added as a monitoring contact to BOTH, the host and its services. Our developers will be looking into this issue.

[gsl_ops_practice]

Hello again,

We updated our test server to the latest Nagios yesterday, seems the issue is still present.

We are looking to give some users a dashboard of the service status by using BPI groups so that these users can not see the actual host/service status. Please advise if this is doable at all.

Thank you.

[lmiltchev]

This issue should not be present in 5.2.3. I was not able to recreate it. Here's what I did:

1. Created a test user "test1" and added it as a monitoring contact to a linux, windows, and a web host, the their services in Nagios XI.

2. Next, I created a primary BPI group called "test1BPIgroup" with 3 subgroups - "Linux", "Web", and "Windows". I added the linux, windows, and a web host/services to each one respectively. I set up "test1" as an "authorized user" for "test1BPIgroup", "Linux", "Web", and "Windows" BPI groups.

3. I logged in as "test1" user, accessed the BPI and I was able to view the "test1BPIgroup" and its subgroups. See the image below:

example01.PNG

[gsl_ops_practice]

Thank you for that.

Is there a way to use BPI without making that "test1" user a monitoring contact for the hosts/services? I need to show a user a dashboard of service availability based on specific logic without exposing all the underlying monitors.

[lmiltchev]

You can either add this user as a monitoring contacts for hosts/services you want him/her to be able to see, or show all BPI groups to all users. These are the only two options.

Go to "Edit BPI Settings", select "Show All Groups To All Users" check-box, and click on "Apply Settings".

example01.PNG