Central Logging Server

[vhoover]

We have several web servers that we watch the event logs for. They are old windows 2003 servers (vlan A) that cannot handle the load of nrpe on a pull of every 15 minutes. The servers are in a DMZ LAN and cannot talk to the nagios server without an established connection. What I would like to do is setup a central log server (already have a windows 2008 server available (vlan B)). for the event logs to get exported to and then read from there by Nagios (vlan C). I have looked at several options, but I am unsure of what the recommended path would be. To add to the list of restrictions besides not setting a static route from the DMZ to nagios, I have been given a budget of $0. Can someone please advise on the best course of action? The Network team will not allow a route from VLAN A to VLAN C, but they have set one up for access to VLAN B. VLAN C can talk to VLAN B.

[tmcdonald]

This falls more into the realm of general networking support. We can't really provide this sort of assistance unfortunately. If you do manage to get the central log server set up we can certainly help you monitor it.

[vhoover]

That is fine, but if I use another instance of Nagios to receive the event logs, and then have that instance ship them off to their final destination, do I need licenses for the instance in the middle. Basically can I use another instance of Nagios to act as a proxy without actually monitoring anything on that instance?

[slansing]

Your nagios xi license includes three installations, generally one for production, one for testing, another for failover/backup. However you can also use a Nagios Core installation in the middle, to receive the logs, and then you can push them to your central XI installation.

[vhoover]

Thanks I ended up doing a Nagios Core instance as it will only be a "man-in the middle" instance.

[slansing]

Sounds good, thanks for letting us know!