BPI Feature Enhancement Request

[J.A.K]

As my company tries to make heavy use of BPI a few things have popped up that I think could use some quality of life improvements. Wanted to bring them up here in case others agree these are useful enough for a feature request.

• Have a search available in adding new members. When you have thousands of servers to sort through just the singular list box makes things difficult.
  
  Have the BPI API pull group description as well in the summary.
  
  Not sure if this is a bug, but looks like removing a service check left a blank entry where it was in the BPI group after an apply configuration.
  
  Capture.PNG

[J.A.K]

In addition to the leftover entry I've also noticed it does not sync again after I apply configuration like is stated in this setting:

Capture2.PNG

[ssax]

Great ideas, I'll submit the requests to dev as they would be helpful and update the post shortly.

EDIT: Created:

Code: Select all

XI - BPI - Add Search box when adding/editing a BPI group to make adding items faster
XI - BPI - Show group description as well in the BPI interface (or an option for it) and when adding/editing

Please run this command as root and leave it running:

Code: Select all

tail -Fn0 /var/log/httpd/ssl_error_log /usr/local/nagiosxi/var/cmdsubsys.log

Then apply configuration and wait until the BPI sync stuff occurs (will take a minute or so after applying configuration) and then once that's done send us the full output from the still running tail command above so we can see what's occurring.

Attach this file as well:

Code: Select all

/usr/local/nagiosxi/var/components/bpi.log

What version of XI are you running? You can find it on the bottom left hand side after logging in.

[J.A.K]

I'm on 5.8.1 currently. Attached the zip with both the tail file and the log. Cmd exits as a success it looks like, but checking BPI hostgroups is empty again until I manually click sync.

BPI.zip

Edit: For the second feature request to make sure I got it across correctly I specifically mean pulling the BPI group description back when using the BPI API call. Basically while you would currently get back:

"WeConnect": {
"name": "WeConnect",
"title": "WeConnect",
"type": "default",
"status_text": "Group health below critical threshold of 80%! Health is 0% with 1 problem(s).",
"current_state": 2,
"problems": 1,
"health": 0,
"warning": 90,
"critical": 80
}

After the update you would get back:

"WeConnect": {
"name": "WeConnect",
"title": "WeConnect",
"description": "BPI group for WeConnect App",
"type": "default",
"status_text": "Group health below critical threshold of 80%! Health is 0% with 1 problem(s).",
"current_state": 2,
"problems": 1,
"health": 0,
"warning": 90,
"critical": 80
}

[ssax]

I've added another one:

Code: Select all

XI - API - BPI endpoint - Show group description when querying

Please PM me a copy of your profile so I can lab this up with what you have, you can download it from Admin > System Profile by clicking the Download Profile button.

[J.A.K]

Just wanted to make sure did you get the system profile I PM'ed?

[ssax]

Yes, received.

What is the output of this command?

Code: Select all

systemctl status php-fpm

If it's not started, try starting it:

Code: Select all

systemctl start php-fpm

Do you have any security software installed on the server that could be impacting it?

Please run this command as root and send me the resulting /tmp/HTTPDFILES.zip file:

Code: Select all

zip -r /tmp/HTTPDFILES.zip /etc/httpd/conf/httpd.conf /etc/httpd/conf.d /etc/php.ini /etc/php-fpm.conf /etc/php-fpm.d

EDIT: Send the output of this command as well:

Code: Select all

mysql -h 127.0.0.1 -uroot -pnagiosxi -e "SELECT @@SQL_MODE, @@GLOBAL.SQL_MODE\G;"

[J.A.K]

Yep php-fpm is running. We do have security called FireEye that should be have exclusions on all Nagios folders, but I can't have our security team stop it without proof it's affecting something.

Output of the MySQL CMD:

[f10000003j@vml1038 ~]$ mysql -h 127.0.0.1 -uroot -pnagiosxi -e "SELECT @@SQL_MODE, @@GLOBAL.SQL_MODE\G;"
mysql: [Warning] Using a password on the command line interface can be insecure.
*************************** 1. row ***************************
@@SQL_MODE: ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION
@@GLOBAL.SQL_MODE: ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION


Here's the zip file:

HTTPDFILES.zip

[ssax]

You would need to have your team investigate your security tool in order to determine if it's blocking anything, you may want to reach out to them to have them check the logs to see if they see anything.

I would do this first though:

You will need to set sql_mode="" under the [mysqld] section of your /etc/my.cnf.d/mysql-server.cnf:

Code: Select all

[mysqld]
sql_mode=""

Then restart mysqld:

Code: Select all

systemctl restart mysqld

Then test the BPI sync again.

[J.A.K]

No dice on the mysql line. Added it. Restarted the service. Hit Apply Config. BPI hostgroups are blank.

I did open a ticket with our security team and FireEye hasn't quarantined any processes or files on our XI server recently. At this point should I open an enterprise ticket and reference this thread?