Nagios Support Forum

Code: Select all

[root@iss-chi-nag05 ~]# bash setup-linux.sh -s xxxxxxxxx.com -p 5444 -f "/usr/local/nagiosxi/var/components/auditlog.log" -t XIAudit
Detected rsyslog 5.8.10
Detected rsyslog work directory /var/lib/rsyslog
Destination Log Server: xxxxxxxxxx.com:5444
Processing /usr/local/nagiosxi/var/components/auditlog.log file...
Creating /etc/rsyslog.d/90-nagioslogserver_usr_local_nagiosxi_var_components_auditlog.log.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Okay.
rsyslog is running with the new configuration.
Visit your Nagios Log Server dashboard to verify that logs are being received.

Code: Select all

tcpdump -n host <xi ip address> and dst port 5544

Code: Select all

cat /etc/rsyslog.d/90-nagioslogserver_usr_local_nagiosxi_var_components_auditlog.log.conf

Code: Select all

[root@iss-chi-nag05 components]# cat /etc/rsyslog.d/90-nagioslogserver_usr_local_nagiosxi_var_components_auditlog.log.conf
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/lib/rsyslog

# Input for XIAudit
$InputFileName /usr/local/nagiosxi/var/components/auditlog.log
$InputFileTag XIAudit:
$InputFileStateFile nls-state-usr_local_nagiosxi_var_components_auditlog.log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'XIAudit' then @@iss-chi-nag07.net.itciss.com:5544
if $programname == 'XIAudit' then ~