Alerting Utilizing NSCA from Core to XI

[dsydnor]

Hello,

I have a distributed environment consisting of Nagios Core servers for my remote sites, and one XI Core server as my central federated site. From my remote sites (Core), I am able to monitor my local clients, and alert as expected. However, when I attempt to enable passive checks from the central XI server for the remote server clients using the NSCA client, I'm unsuccess in receiving alerts to the central XI node. Network connectivity is accessible for all of the Nagios servers so I was expecting that the remote server would forward the alerts to the central. What I discovered is that the central node is reporting the remote client node down, but, if I enable the network to allow communication from the central node to the remote site client node, it reports as expected. I have attached my configuration files for your review.

Thanks,

--Darryn

[slansing]

Well... Nagios XI will require a network connection of some sort to the remote host in order to check it, or receive passive results from it. What you are saying is when that connection is down, the host goes critical, and you get alerts, and when the connection is up, all is fine? That is expected behavior when a network route fails.

[dsydnor]

I was under the assumption that since my Nagios servers (central,remote) could communicate, I would not need network access from the central server (XI) to the remote client nodes as my remote Nagios server (CORE) was capturing those local host alerts. Are you saying that my central Nagios server is unable to pull the local host alerts from my remote Nagios server that has this information?

[abrist]

Passive checks should be configured on the remote servers and returned to the Central server - Or you can open a port on the remote firewall and run active checks against the remote device.

Are you saying that my central Nagios server is unable to pull the local host alerts from my remote Nagios server that has this information?

Pull? No. Not unless you open up a port. You could always *push* the results to your central server . . . .

[dsydnor]

So based on the original configs that I attached (remote.cfg,central.cf) that enabled passive checks for NSCA, were these configured correctly, or will I need an additional service/component to push the alerts to the central server?

[sreinhardt]

In regards to the central server having only passive checks, and your remote site using either passive or active, yes this is correct. However it does not display whether nsca is able to or configured to send from core to xi, which it absolutely can do. So your initial thinking that your clients can be polled or send results passively to the local core systems, then core can forward to your central XI system is perfectly reasonable and can work. You will need 5667 for ncpa open incoming into the central nagios system though. You might be interested, if this hasn't taken too much time already, to look into nrdp though. It works over 80 or 443 and in my opinion is easier to setup.

[dsydnor]

I will give NRDP a shot.

Thanks!

[slansing]

Awesome, we're here to help if you have questions.

[dsydnor]

So, I have installed/configured NRPE, and I'm still experiencing the same issue. Let me explain my network:

Nagios Central Server (XI) --> 192.100.1.X

Remote Server (Core) --> 192.100.1.x, 210,200.0.X
Node-A local client (reporting to remote) --> 210.200.0.X

The local client (Node-A) alerts/monitoring is reporting as expected to the Remote Server. However, when I attempt to use NRPE from the central server to check services on
the the local client (Node-A), it is unsuccessful "Connection refused by host" since there is no direct connection from the Central Server to the Node-A. As a note, if I enable a
network interface to communicate with Node-A on the same VLAN, the NRPE works as expected.

Based on research, some are using the OSCP command to forward the results after each service check to the Central Server. Is that what I am
missing, or should the NRPE plugin be sufficient?

Thanks,

--Darryn

[scottwilkerson]

I want to step back a bit. The following post is an example of using NSCA to send results from Core to XI and may suit your needs....

http://support.nagios.com/forum/viewtop ... sca#p30341