Nagios XI, NCPA and NRDP to sync config / plugins

[dv2kJLUPv]

Hello,

We're fairly new to Nagios XI and we are currently trialing the product with the view to purchase it in future if we believe it's the right decision.

Our current set up uses Nagios Core + NRPE clients on Linux and NSClients on Windows. All the checks we perform are active checks, mostly within the hosting environments we run (there are a few external checks).

Managing the configuration while maintaining a good idea of how different hosts are inheriting services / being excluded etc. is getting troublesome due to how it's grown and not changed much since the original implementation. Nagios XI looks to solve this nicely and we've created modular services / hostgroups to allow us to designate what each host does (and needs in terms of checks) in a modular way that's easy to maintain going forward.

One of the awesome features I came across when testing the various clients was that NRDP could install any missing plugins required for the checks; however we've now decided to go forward with NCPA due to NRDP/NRDS only supporting passive checks. Currently when servers are built, our build automatically installs a variety of nagios plugins that we commonly use on the different hosts. This however leads to more updates needing to be done (via YUM etc.) or plugins potentially not getting updated if they are installed without using the package manager/

My questions are:

1. Is there a way to have the NCPA client sync the required plugins for the checks to the server?
2. If not, is there a way to "cheat" the system by using NRDP to sync the clients but actually do the checks via NCPA?
3. Is there any negative / downside to changing the NCPA plugins directory on the client to where the package manager (yum) installers the plugins? They usually go to /usr/lib64/nagios/plugins whereas NCPA by default uses the plugins directory found within it's own folder.

Thank you

[mcapra]

1. Is there a way to have the NCPA client sync the required plugins for the checks to the server?

This appears to be on the table, though no milestone has been assigned yet:
https://github.com/NagiosEnterprises/ncpa/issues/318

Judging by the changelog, I'd say @jomann has been very busy with NLS v2 recently

2. If not, is there a way to "cheat" the system by using NRDP to sync the clients but actually do the checks via NCPA?

This is all hypothetical as I've never actually tried it.

If you were to point NCPA's plugin_path at where NRDP/NRDS stores the plugins, I think that should be enough to at least have the plugins available and exposed via NCPA's plugins endpoint. Once the plugins are exposed, it should be a simple matter of configuring the appropriate service checks from Nagios XI.

There's probably things to consider regarding file permissions.

3. Is there any negative / downside to changing the NCPA plugins directory on the client to where the package manager (yum) installers the plugins? They usually go to /usr/lib64/nagios/plugins whereas NCPA by default uses the plugins directory found within it's own folder.

I would assume not being that the plugin_path configuration directive exists. More info:
https://www.nagios.org/ncpa/help/2.0/co ... -reference

The only potential downside I can see would be if you were manually installing plugins to that path that are also managed by yum/apt. In which case, installing a plugin's corresponding package might overwrite your existing one.

Though I've never personally used that directive with NCPA v2.

You might also consider requesting a quickstart and getting a complementary hour with a technician to go over this topic:
https://www.nagios.com/services/quickstart/

[npolovenko]

Thanks for the detailed answer, @mcapra.
@dv2kJLUPv, Please let us know if you have any further questions.

[dv2kJLUPv]

Thank you, that is indeed a very detailed answer and much appreciated.

Do you think NCPA is in a stable, robust condition? I was reading through the issues / bug reports and some of them are a bit worrying (crashes, incorrect reports etc.). We've used NRPE & NSClient for a long time and I've never experienced any issues with them that weren't due to some change we made (e.g. an update once caused lots of NRPE clients to stop reporting due to SSL issues).

Is there a better way to achieve what we're hoping for (automated / managed deployment of plugins to servers when they are needed)?

Also, although probably behind the scope of this thread, it would be good to get feedback on the "modular" structure we're hoping to achieve through Host Templates & Host Groups. I'll use our linux structure as example:

The majority of linux servers will use a "linux-server" template, which is based on a "generic-server" template.
The linux servers will then belong to several groups which define the overall role of the server. The vast majority (if not all) will belong to a "linux-servers" host group.

Servers running apache will belong to "linux-apache".
Servers running a database will belong to "has-mysql" (if using MySQL).
Servers running an FTP service (such as ProFTPD) would belong to "linux-ftp".

Each host group has one or more services assigned to it that relate to that specific host group, e.g. for "has-mysql" there is various checks to ensure the service is running, space for databases are OK etc.

This allows us to create a host and attach all the relevant host groups. The majority of the servers we host do not vary that much from the standard configuration, and if they do we have "free variables" that are used to substitute the default parameters when needed.

[kyang]

by dv2kJLUPv,
Do you think NCPA is in a stable, robust condition? I was reading through the issues/bug reports and some of them are a bit worrying (crashes, incorrect reports etc.).

I think it depends on your requirements, such as what are you really going to monitor and it's timeframe? NCPA is nice in my opinion because there's still a lot more it can do with it being cross-platform. The issues/bugs shouldn't be too concerning since they are being addressed by the NCPA developer.

As for the other question, you could take a look at automated tools for deployment. Generally something like Ansible, Chef, Puppet etc.

Otherwise, a quick start with a tech is an awesome idea.
https://www.nagios.com/services/quickstart/