Nagios Log files to integrate with external application

[bsivavani]

Hi,

In my environment, client have Splunk tool and recently we have integrated Nagios with Splunk by installing Splunk forwarder on Nagios server.

We would like to see the Nagios data in Splunk UI. Can you suggest what are the log files that can used to forward Nagios data to Splunk.

Kindly advice ?

[mcapra]

The most recent Nagios log file can be found here:

Code: Select all

/usr/local/nagios/var/nagios.log

Which should contain check results, notifications, worker timeouts, configuration warnings, etc. You may need to do some clever parsing of this file depending on your specific use case.

The historical/archival logs, which you may or may not want, can be found here:

Code: Select all

/usr/local/nagios/var/archives

[bsivavani]

Hi,

Will nagios.log file give performance data and maintenance mode related logs ?

[dwasswa]

Hi @bsivavani,

Performance data is stored or located in the following files:

Host Performance Data File

Code: Select all

/usr/local/nagios/var/host-perfdata.dat

Service Performance Data File

Code: Select all

/usr/local/nagios/var/service-perfdata.dat

If you want to do some bulk modification,please follow the guide below:
https://support.nagios.com/kb/article/n ... -tool.html

[bsivavani]

Hi,

Can you let us know where maintenance mode related logs will get store ?

[dwasswa]

Could you please be more specific so that i can provided you with the information you need?

[mcapra]

Scheduled downtime shows up in nagios.log like so:

Code: Select all

[1508782896] EXTERNAL COMMAND: SCHEDULE_SVC_DOWNTIME;esprod00;Memory Usage;1508782890;1508782950;1;0;7200;Nagios Admin;test
[1508782896] SERVICE DOWNTIME ALERT: esprod00;Memory Usage;STARTED; Service has entered a period of scheduled downtime
[1508782950] SERVICE DOWNTIME ALERT: esprod00;Memory Usage;STOPPED; Service has exited from a period of scheduled downtime

[dwasswa]

Thanks @mcapra.