Nagios LogServer Offline Instructions

[scott.brown8]

We are using these instructions for offline installation of LogServer

https://support.nagios.com/kb/article/n ... e-496.html

Everything works up until the ./upgrade where it continues to look for online repos. We got past the ncpa and some (htmltox) package that we commented out after installing, but now its looking for the gem repo which are sitting in /tmp/gemfiles.. we can't find where to fix the script to ignore that..

[cdienger]

Comment out lines 244:

Code: Select all

#$backenddir/logstash/bin/logstash-plugin update logstash-input-tcp

and 262:

Code: Select all

#$backenddir/logstash/bin/logstash-plugin update logstash-filter-geoip

in the upgrade script(/tmp/nagioslogserver/upgrade) as well as 12:

Code: Select all

#/usr/local/nagioslogserver/logstash/bin/logstash-plugin update logstash-input-tcp || true

and 16:

Code: Select all

#/usr/local/nagioslogserver/logstash/bin/logstash-plugin update logstash-filter-geoip || true

in the /tmp/nagioslogserver/subcomponents/logstash/post-install script.

[scott.brown8]

Is there an updated package that works for offline? we followed your instructions and it worked, well it didnt error again other than long timeouts.

But when running the validate, it complains about the gem files, and its not collecting logs even from itself..

[cdienger]

The packages don't differ from the online install. They just differ in how they get installed. I'll see about getting the documentation upgraded.

Were are you seeing an error about gemfiles? What exactly is the error?

[scott.brown8]

I dont have the exact error anymore, but between the two logservers, one gemfile had a 1byte size difference... we dont touch those, so no idea why.

On a new topic, what is the best way to remove the logserver software completely and start from scratch? With VMWare snaoshot rollbacks, these are currently in such a state we'd just like to start over without having to rebuild. Will our original license key work if we give it the same name/IP?

[cdienger]

These should do it:

Code: Select all

service logstash stop
service elasticsearch stop
yum erase httpd
rm -rf /usr/local/nagioslogserver
rm -rf /var/www/html/nagioslogserver
rm /etc/rc.d/init.d/elasticsearch
rm /etc/rc.d/init.d/logstash
rm /etc/rsyslog.d/nagioslogserver.conf
rm /etc/cron.d/nagioslogserver
pip uninstall elasticsearch-curator==3.4.0
service crond restart
rm -rf /tmp/nagioslogserver
rm -f /var/www/html/nagioslogserver

And if you use the same IP then you shouldn't have an issue activating again.

[scott.brown8]

We removed the software per your instructions..
Reinstalled using the Offline Installation instructions. Got to the part where it wants to install ncpa and failed.. installed it mnaually, and now the install script thinks its fully installed..

This wasnt an upgrade, it was a fullinstall after removal.

Do we need to comment out lines in the fullinstall script?

Being in the environment its in, can you please test a method and advise?

[cdienger]

Yeah, I will do some testing to update https://support.nagios.com/kb/article/n ... n-495.html. I think there are two parts that need to be added. Roughly they are(for cent/rhel anyway. Let me know if you have a different OS):

ncpa:

Code: Select all

Download from https://www.nagios.org/ncpa/ and then copy it to /tmp/nagioslogserver/subcomponents/ncpa and edit /tmp/nagioslogserver/subcomponents/ncpa/install to comment out line 41(the wget line):

40 # Download a new package
41 #wget "$assets$pkgname"
42
43 if [ "$distro" == "Debian" ] || [ "$distro" == "Ubuntu" ]; then
44 dpkg --force-confnew -i "$pkgname"
45 else
46 yum localinstall -y "$pkgname"
47 fi

and wkhtmltox:

Code: Select all

Download a copy of wkhtmltox for your system at https://assets.nagios.com/downloads/nagiosxi/packages/wkhtmltox-0.12.1.3.el7.x86_64.rpm​, https://assets.nagios.com/downloads/nagiosxi/packages/wkhtmltox-0.12.1.3.el6.x86_64.rpm​ and move it to /tmp/nagioslogserver/subcomponents/wkhtmltox/, and then comment out line 42 of /tmp/nagioslogserver/subcomponents/wkhtmltox/install:

#wget "$assets$pkgname"

[scott.brown8]

So do we have to preform the removal process, then redo?

[cdienger]

If it completed the install and you see ncpa, wkhtmltox, and the gem files installed, then it should be good to go. I haven't had a chance to go through the steps and write them up but hope to do that right away tomorrow.

Code: Select all

yum list installed | grep ncpa
yum list installed | grep wkhtmltox
/usr/local/nagioslogserver/logstash/bin/logstash-plugin list --verbose | grep logstash-input-tcp
/usr/local/nagioslogserver/logstash/bin/logstash-plugin list --verbose | grep logstash-filter-geoip

The last two we'd want to see version 4.2.4 and 4.0.4 respectively.