Trying to build a monitor for lower than usual web traffic

[gsl_ops_practice]

Hello,

Checking all the previous posts I wasn't able to get a clear answer - hoping this forum is the right place to ask.

I have access logs from multiple apache servers going into NagiosLog server. I need to create a check in NagiosXI that will throw an alarm if the number of web access requests is lower than a specific threshold. in my test NagiosXI check I tried setting a lower value in the critical value than warning, but that did not produce the desired result.

Your help in setting this up would be appreciated.

Thank you,
Alex

[eloyd]

NLS alerting uses standard Nagios thresholds. You can read about them at https://nagios-plugins.org/doc/guidelin ... HOLDFORMAT I'm sure some combination will let you look for events and then alert if you have fewer than X per unit time.

[eloyd]

More specifically, let's say you normally get 1000 events per hour. You want to be in a warning state if you get less than 500 and a critical state if you get less than 200.

Your NLS alert would then be as follows (note that the thresholds are 500: and 200:, including the colons):

screen.jpg

[tmcdonald]

Jeez @eloyd, beating me to the punch like that :)

[eloyd]

Only 160 days left to get #3....

[gsl_ops_practice]

Folks, thanks for that, I can now set up an alarm in NagiosLog server.

I suppose I should then raise another thread in the NagiosXI forum on how to set up the same kind of alarm there? All of our application/infrastructure monitoring goes through NagiosXI, we have at last 20 queries being on from NagiosXI on NagiosLog and then parsing the results and generating corresponding events.

Thanks,
Alex

[eloyd]

Click on Alert, then select Nagios Servers (NRDP). Then use your NRDP token from your Nagios XI NRDP server (dig around in XI and you'll find it) and then NLS can send alerts through XI.

[tmcdonald]

I suppose I should then raise another thread in the NagiosXI forum on how to set up the same kind of alarm there?

That would be much appreciated :)

We generally like to keep posts for different products/issue separated.