Nagios XI 5R1.0 AD settings

[jkinning]

I have installed this version in a test VM to check out all the new features. Bravo! Looks nice and love the AD integration. My issue is I have more users and groups than what actually gets populated. Is there a way to increase that? When I click on Users I am only getting to J and I am looking for users in S. I didn't see any search but may have overlooked. Any way to populate more users?

[jomann]

Do you mean that when it pops up the current users it finds in your AD tree that it only shows x amount in the tree? or when you actually do the import it only imports so many?

[jkinning]

When it pops up the current user list for me to select within AD. I need to see more users or search for users to select. The users I am looking for are not listed because it appears to only show X many and I need more.

[jomann]

A search is something that might need to be implemented in the near future, however I am wondering if it's displaying them and not actually showing them because of the way it's framing the data... can you highlight them and drag down and see if it moves the list down? There is no limit on the query for users so I am curious if it's just not generating a scrollbar.

[jkinning]

No, I cannot scroll down anymore. It just stops and I can't add the users that I need.

[jomann]

Do you know roughly how many are being displayed vs how many should be displayed? I'd like to test this on some of our systems to see why it isn't showing the full list.

[jkinning]

I had to modify my ADUC from 2000 to 5000 but it looks like we may have 2104 user objects. Looking in ADUC and my user list when I scroll to the name which Nagios is cutting off it is just a hair past the halfway mark. I couldn't figure out a method to get a user count on either ADUC or Nagios but again it looks like half gets populated in Nagios.

[jomann]

It looks like the way we grab users from ad/ldap we used ldap_list which allows a specified sizelimit set. We don't have a sizelimit set. So whatever the default is what is used. I am not sure what the default it set to but if we set it to 0, it should only use the server-side sizelimit that is being set. If your server's size limit is > 2000 then it's very likely the php default sizelimit is lower and that is where it is having problems. I can send you a patched file if you'd like to overwrite a file in the component to try to get this to work if you'd like.

Edit: Also looking into a search option, but this would have to be thought out a little. Not being an AD expert I'm not sure how searching should be done and what fields we'd want to search.

[jomann]

Someone else is having this exact same issue. I actually mentioned the file and the lines where you should change it to see if it would allow a larger data set to be displayed.

https://support.nagios.com/forum/viewto ... 70#p155470

If you end up doing the edit, let me know if it works and we will push this into this weeks release.

[jkinning]

I made the changes to the lines 128 and 135 but it didn't do anything different.

Code: Select all

        if ($recursive === true) {
            $sr = ldap_search($this->adldap->getLdapConnection(), $searchOu, $filter, array('objectclass', 'distinguishedname', 'samaccountname'),0, 0);
            $entries = @ldap_get_entries($this->adldap->getLdapConnection(), $sr);
            if (is_array($entries)) {
                return $entries;
            }
        }
        else {
            $sr = ldap_list($this->adldap->getLdapConnection(), $searchOu, $filter, array('objectclass', 'distinguishedname', 'samaccountname'),0, 0);
            $entries = @ldap_get_entries($this->adldap->getLdapConnection(), $sr);
            if (is_array($entries)) {
                return $entries;
            }
        }

Does that look correct?

How difficult would it be to add a Search and instead of populating all the users just search and add the user you are looking for? Any thoughts and allowing to use AD Distribution or Security groups that have email addresses associated with it. Then if I have an AD group setup for a specific Business Unit with a distribution email address all the users in that AD group will get notified. It would eliminate the need to maintain the local Nagios contact groups. Then when people come and go it would automatically get updated and the Nagios admin wouldn't need to keep maintaining the contact group, it would flow from AD.