Managing multiple users with unique views of services

[dukevader]

Hello All,

I've been searching for a few days and I can't find a straight forward document or explanation on how to manage this. Here is the situation:

We have Nagios Core installed. Its currently monitoring 80 servers and 1400 services. These hosts are split into various host groups. I've created contact groups and contacts and matched the hosts with the appropriate group.

Because most of these servers are cPanel based, I created a service group called cPanel and assigned each host to the service group. Also, some servers are unique so several service groups were created to speed up the adding of hosts. In short, multiple service groups.

Here is where the problem is.

While authentication for each user works, and they can log in and see their servers, they can also see hosts from other groups because of the service groups that were created. What I'm trying to do is either have a tutorial on how to properly manage the groups so that a user only sees their own hosts and services and can't see other hosts/services just because they share a service group, OR have someone tell me where I'm going wrong lol.

So to recap:

I need users to see specific hosts/services without seeing other hosts who may share the same service group.

Thanks all.

[abrist]

The users should not have access to objects that they are not a monitoring contact of. If the users are made monitoring contacts of the services in the servicegroup, instead of the hosts or hostgroups, then they will see all the services for all the hosts that use the servicegroup. You are best off configuring your contacts on a host/hostgroup level, and not on the service/servicegroup level.

[dukevader]

Hello,

Thank you for that.

Perhaps there is a better way of doing what I am trying to do. Allow me to explain in more detail:

80 hosts
1400 services.
10 users.

Each user has several hosts attached to it that must be hidden from other users.

Rather than have 1 host have 20 or 30 specific service checks, I need a quick way of assigning the services.

I created several service groups, assigned to the specific services needed.

The hosts are then assigned to the various service groups so quickly add the services for each host.

Once this is done, each user can now see whatever hosts are attached to the service group.

To automate adding a user account, do you not need to have a host group?

Thanks.




Here is an example of what an authenticated user sees.

[sreinhardt]

You are correct, you do not need to do this via groups. You certainly can use templates instead, which would allow some hiding of hosts\service. Additionally you should be alerted, that if a host is part of a group and the contact for that host can see the other hosts in that group, not their services, just the hosts and status of them. If restricting what users can see is your objective, I would highly suggest templates instead.

[dukevader]

Hello,

Thanks for the assistance so far.

If I were to use templates, what kind of templates do I use? Do I assign the template to the service? Sorry for the n00b questions.

[sreinhardt]

You would likely need to create your own templates. Probably the easiest way would be to use them to define a host\service check, and have a separate template\contact group to attach contacts, so that you can manage them individually. Just to clarify, templates are very similar to groups in the way that you can define commands and arguments for use with a service that may not have it defined already, however it does not combine them into a logical group like actual groups do.

[dukevader]

Hello,

Could you elaborate a bit on this? I have several templates in existence but the only way I've been ale to have services attach to hosts is by the use of service groups, which is part of the problem. Could someone either give a step by step for 1 example host, or point me to a KB article/walkthrough on how to do this correctly?

Thanks.

[slansing]

You should be able to create both host and service templates in the templates.cfg file on your server. Here, define a host template with any settings you wish the host you will assign it to, to have. This would include check intervals, etc. You do not need to define an address here as anything not present in the template will be filled in by the actual hosts.

You can do the exact same for service templates. Simply add the definition you wish to see on certain services, and you should be good to go. Now, in the actual services.cfg and hosts.cfg files you would add the following to your host or service definitions:

Code: Select all

use "template definition name here without quotes"