Nagios XI log retention

[atsb]

Hello!

About nagios XI environment
1) Linux Distribution and version? Centos 7
2) 32 or 64bit? 64bit
3) VMware Image or Manual Install of XI? Manual install
4) Are there special configurations on your system, ie; is Gnome installed? Are you using a proxy? Are you using SSL? SSL
5) NagiosXI version: 5.6.3

I have a problem with log retention - its not working. It looks like last time it worked was 2018/01/31. I just have deleted some of the log files which were between 15-25GB(/usr/local/nagiosxi/var). Let me know what kind of information you need to debug it. Thanks.

[benjaminsmith]

Hi @atsb,

Thanks for providing the information about your environment. Just to clarify a few things:

1. Is Nagios XI monitoring and sending notifications as expected?

2. Go to Reports > Legacy Reports > Event Log. Are you able to view the most recent activity such as Service Alerts?

3. Did you make any system changes on 2018/1/31?

4.Please PM (private message) your system profile for us to review. Thanks.

To send us your system profile.
Login to the Nagios XI GUI using a web browser.
Click the "Admin" > "System Profile" Menu
Click the "Download Profile" button
Save the profile.zip file and share in a private message or upload it to the post/ticket.

[atsb]

Hi @atsb,

Thanks for providing the information about your environment, Just to clarify a few things:

1. Is Nagios XI monitoring and sending notifications as expected?

2. Go to Reports > Legacy Reports > Event Log. Are you able to view the most recent activity such as Service Alerts?

3. Did you make any system changes on 2018/1/31?

4.Please PM (private message) your system profile for us to review. Thanks.

To send us your system profile.
Login to the Nagios XI GUI using a web browser.
Click the "Admin" > "System Profile" Menu
Click the "Download Profile" button
Save the profile.zip file and share in a private message or upload it to the post/ticket.

1. Yes it is monitoring as expected and sending alerts
2. works, can see HOST/SERVICE alerts labeled with todays date.
3. I am not 100% sure but that might be around the time we migrated from old nagios server to new one - with that also the OS changed from centos 6 32bit to centos 7 64bit.
4. Sent via PM.

[benjaminsmith]

Hi @atsb,

My understanding of the problem is that you are not able to retrieve Event Log data under Available Reports? Is this an accurate statement? There's also the Audit Log data which is stored different database than Event Log data. Can you upload a report or screenshot of the issue?

Please log into the terminal and run the following command to check the database table sizes:

Code: Select all

echo "SELECT table_name AS 'Table', round(((data_length + index_length) / 1024 / 1024), 2) 'Size in MB' FROM information_schema.TABLES WHERE table_schema IN ('nagios', 'nagiosql', 'nagiosxi');" | mysql -uroot -pnagiosxi --table

Next, restart the Nagios stack, and test the server again.

Code: Select all

systemctl stop crond
systemctl stop npcd
systemctl stop nagios
systemctl stop ndo2db
pkill -9 -u nagios
for i in $(ipcs -q | grep nagios |awk '{print $2}'); do ipcrm -q $i; done
rm -rf /usr/local/nagiosxi/var/dbmaint.lock
rm -rf /usr/local/nagiosxi/var/event_handler.lock
rm -rf /usr/local/nagiosxi/scripts/reconfigure_nagios.lock
systemctl restart mariadb
systemctl start ndo2db
systemctl start nagios
systemctl start npcd
systemctl start crond

[atsb]

The problem is that under "/usr/local/nagiosxi/var/" log files grow over 15GB and they grow until i get a alert that nagios disk is going to be full and i cant see that these logs are packed and moved every week/month. Last time it "archived" these logs were 2018/02/08.
-rw-r--r--. 1 nagios nagios 234923 Jan 31 2018 perfdataproc.log-20180131.gz
-rw-r--r--. 1 nagios nagios 32959 Feb 3 2018 cleaner.log-20180203.gz
-rw-r--r--. 1 nagios nagios 275161 Feb 3 2018 dbmaint.log-20180203.gz
-rw-r--r--. 1 nagios nagios 47101 Feb 6 2018 recurringdowntime.log-20180206.gz
-rw-r--r--. 1 nagios nagios 384276 Feb 6 2018 cmdsubsys.log-20180206.gz
-rw-r--r--. 1 nagios nagios 399584 Feb 7 2018 eventman.log-20180207.gz
-rw-r--r--. 1 nagios nagios 473352 Feb 8 2018 sysstat.log-20180208.gz
-rw-r--r--. 1 nagios nagios 367975 Feb 8 2018 event_handler.log-20180208.gz
last time i deleted sysstat.log file which was 23GB and i have done it several times with some other logs. My understanding is that nagios should pack logs every week and keep only them for a few months?

[benjaminsmith]

Hi @atsb,

The files in /usr/local/nagiosxi/var are managed by cron and are logs related to the Nagios Xi subsystems. Nagios XI uses the application logrotate to handle automatic compression and archiving of these log files. This is setup as a daily cron ( see /etc/cron.daily ) and it's either not running on your server or there are permission issues.

Please search or post the cron log /var/log/cron to determine if this program is running or other related errors. The configuration file for nagios xi is found in /etc/logrotate.d/nagiosxi.

References: Nagios XI Log Locations and Descriptions

[atsb]

Thats correct, permission issues under logrotate. Thank you, it seems to work like it should.

[benjaminsmith]

Hello @atsb,

Thats correct, permission issues under logrotate. Thank you, it seems to work like it should.

Great. Did you have any other questions or may we close this thread?

[atsb]

you can close this thread

[scottwilkerson]

you can close this thread

Great!

Locking