Nagios Support Forum

Hi,

I have a problem controlling who can see what at the service level with Nagios® Core™ 3.5.0. I don't have a problem at the host level that seems to work fine.

So, my question is this: should I be able to control by contact group who can see a subset of services on a particular host, with the caveat that the contact group must be able to see the host itself?

Here's a little more context on that question. I have groups of servers the monitoring for which should be visible to some departments, but not others. The IT department should be able to see all hosts. Then, running on the server there are services that can conceptually be split into two groups; OS services which everyone should see and application services which only the departmental contact group should see. What I want is something like this:

HOSTA - should be visible by IT & DEPT
OS service 1 - visible by IT & DEPT
OS service 2 - visible by IT & DEPT
APP service 1 - visible by DEPT only
APP service 2 - visible by DEPT only

If I associate the contact groups with the host everyone can see the server and all services. That's even though the IT contact group is not associated with the APP services.

If I don't associate the contact groups with the host then the behaviour is as I would expect; the groups can only see the services that association with contact groups implies. However, that doesn't work as a solution because both IT and DEPT need to be able to see the host level checks.

So, what I really need to know is that if this is correct behaviour or if it implies there is some sort of error in my Nagios configuration that is allowing contact group association to bleed into services via host or service groups?

Thanks in advance for any assistance.

Cheers,
Rotty

PS, I found a very similar question on this forum after writing my question, but there was no answer attached - http://support.nagios.com/forum/viewtop ... ity#p14600. That's for a different version though.

Should I be able to control by contact group who can see a subset of services on a particular host, with the caveat that the contact group must be able to see the host itself?

Alas, the answer is no. You can restrict contacts that are just contacts for services. However being a contact for a host has been made to be considered a sort of administrator for all services on that host. Any host contact can see all services associated.

This is the expected behavior, and there is not anything wrong with your configurations or nagios daemon. Probably the best option is to create a ping check or two that each department can be assigned to and use that as a "host check" but run it as a service. This way you can separate them out entirely and they can still see the hosts state.

Hi,

Thanks Spenser for that. It's not what I wanted to hear, but at least I finally have a good answer and I can stop looking for an error that isn't there!

David