Filter not working

[r34220]

selinux was already disabled.

Code: Select all

getenforce
Disabled

Code: Select all

nagios:x:12300:nagios,apache

Code: Select all

namei -l /usr/local/nagioslogserver/logstash/etc/conf.d/
f: /usr/local/nagioslogserver/logstash/etc/conf.d/
dr-xr-xr-x root   root   /
drwxr-xr-x root   root   usr
drwxr-xr-x root   root   local
drwxrwxr-x nagios nagios nagioslogserver
drwxr-xr-x nagios nagios logstash
drwxrwxr-x nagios nagios etc
drwxrwxr-x nagios nagios conf.d

[r34220]

Maybe the problem is deeper. None of the Ajax calls seem to return anything on these pages either.

system_status.png

config_snap.png

[jolson]

Interesting - it does look like a deeper problem. It looks like this is a manual build - is that correct? Any chance you could download the pre-compiled VM? I want to avoid as many potential problems for you as possible, and the VM is a surefire way to do so.

The first troubleshooting step we should take is tailing jobs.log - please run the following commands in the order specified-
Run tail on all of your nodes:

Code: Select all

tail -f /usr/local/nagioslogserver/var/jobs.log

Now submit the 'Apply Configuration' command from the GUI. You should see something like the following:

Code: Select all

Running command apply_config with args 'a:2:{s:5:"sh_id";s:22:"OZejdfdfeqkXQ";s:10:"sh_created";i:14534306;}' for job id: dgLv1KasdfgX_qTzL7EQ

If you don't see any output in jobs.log, that means that jobs are not reaching your log server for some reason. We can troubleshoot accordingly once you have returned your output. Thank you!

[r34220]

Sorry, I cant use a VM.
I could not find the jobs.log file.

Code: Select all

[root@az84implico13c var]# ll /usr/local/nagioslogserver/var/
total 12
-rwxrwxr-x 1 nagios nagios 10 Mar  9 11:19 cluster_hosts
-rw-rw-r-- 1 nagios nagios 37 Mar  9 11:19 cluster_uuid
-rw-rw-r-- 1 nagios nagios 37 Mar  9 11:19 node_uuid

Maybe I need to start over. Is there instructions on how to remove a install?

[jolson]

If you would like to start over, I recommend reformatting the device in question with a minimal CentOS 6/7 install. Instructions to install Nagios Log Server are as follows: http://assets.nagios.com/downloads/nagi ... Server.pdf

Could you perform the reinstall and let us know how it goes?

[r34220]

I can't reformat the system. Do I have any other options to get this working?

[tmcdonald]

How was this server's OS installed? Clean, minimal install? GUI install? Was anything modified before installation of Logserver? Just trying to figure out what will need to be addressed, so more detail is better.

[r34220]

For the most part it is a clean MS Azure VM that had NRPE client installed for our core nagios instance to montior. I dont have full visablity on what other items were installed by our system support vendor.

[jolson]

Did you install NRPE prior to installing Log Server?

I want to add - since jobs.log does not exist, this points toward a permissions issue. I would like you to check on the following.

Make sure that cron is running (cron picks up the commands from the WebGUI):

Code: Select all

service crond status

Ensure that crond is generating proper logs:

Code: Select all

tail /var/log/cron

[r34220]

Success!

nagios user password expired . Reset and made non-expiring.

Thanks!

Code: Select all

Mar 20 10:55:01 az84implico13c crond[34981]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:55:01 az84implico13c crond[34982]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:56:01 az84implico13c crond[35285]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:56:01 az84implico13c crond[35284]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:57:01 az84implico13c crond[35345]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:57:01 az84implico13c crond[35346]: (nagios) FAILED to authorize user with PAM (Authentication toke
n is no longer valid; new one required)
Mar 20 10:58:01 az84implico13c crond[35385]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:58:01 az84implico13c crond[35384]: (nagios) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)
Mar 20 10:59:01 az84implico13c CROND[35478]: (nagios) CMD (/usr/bin/php -q /var/www/html/nagioslogserver/www/index.php jobs > /usr/local/nagioslogserver/var/jobs.log 2>&1)
Mar 20 10:59:01 az84implico13c CROND[35479]: (nagios) CMD (/usr/bin/php -q /var/www/html/nagioslogserver/www/index.php poller > /usr/local/nagioslogserver/var/poller.log 2>&1)
Mar 20 11:00:01 az84implico13c CROND[35672]: (nagios) CMD (/usr/bin/php -q /var/www/html/nagioslogserver/www
/index.php jobs > /usr/local/nagioslogserver/var/jobs.log 2>&1)