Histogram issue in nagiosls

[oliviergautreau]

Hi there,

I'm very new on this forum. That is my first topic and i hope i 'm opening it at the right place.
We are using Nagios Log Server 2.1.4, and we mostly use the default fonctionalities. We run the nagios appliance.

Yesterday my boss asked some statistics about VPN usage. (Indeed, because of Coronas Virus, our people are working from home now !)

Goal is to know the number of concurrent users logged in !

Fortulately, the device is sending us every hour this information encapsulated in a message.
Thanks to this forum and with the usage of grok filter, we managed to cut the message matching the correct pattern. Awesome !
So far, so good: i have a concurrentuser field with the correct information. Great !

Now, I want to do something very simple but didn't find out how to do it !
I just want to print this information on a Nagios Dashboard as an histogram.

See screenshot.

How to draw an histogrann with timestamp on X and concurrent user number on Y ?
This should be very simple but, I don't get it...

Of course csv export is working, but how to do it in through the nagios interface ?

thx, Oliver

[scottwilkerson]

If you go to edit the Histogram and click on the Panel tab, what do you have in the "Values" area?

[oliviergautreau]

Hi Scott,

I have : count / mean / min / max / total

02-04-2020 17-56-22.png

If I change to total, and choose ConcurrentUsers in new Value Field, i get a ClassCastException

[scottwilkerson]

Is ConcurrentUsers set to an Integer per your GROK you setup? It has to be numeric or this will not work

[oliviergautreau]

hi Scott and thank you for this feedback.

Indeed, we got a ClassCastException error message.
But ConcurrentUsers is set to a NUMBER. Should i convert the ConcurrentUsers Field and how ?

With the following syntax %{NUMBER:concurrentUsers:int} ?
I will try this !

thx, Olivier






if [host] == '172.19.251.10' {
grok {
match => { "message" => "%{DATA:field1} - - - %{DATA:field2} - ive - \[%{IP:PublicIP}\] %{DATA:field3}::%{WORD:username}(%{DATA:field4})\[%{DATA:field5}\] - Number of concurrent users logged in to the device: %{NUMBER:ConcurrentUsers}" }
match => { "message" => "%{DATA:field1} - - - %{DATA:field2} - ive - \[%{IP:PublicIP}\] %{DATA:field3}::%{WORD:username}(%{DATA:field4})\[%{DATA:field5}\] - %{GREEDYDATA:VPNevent}" }
}

[oliviergautreau]

Yes, it is working now with the :int convertion.
ConcurrentUsers is a not a string anymore but a long.

thx a lot for your help !

[scottwilkerson]

Yes, it is working now with the :int convertion.
ConcurrentUsers is a not a string anymore but a long.

thx a lot for your help !

great!

Locking thread