Page 1 of 1

Nagios Log Server and Nagios XI integration

Posted: Wed May 02, 2018 1:43 pm
by emarmonti
I have a question about the integration between NLS and XI.

I'm aware of the NLS Wizard you can add into XI and it's okay - but how can I get more useful information out of it besides simply "X matching entries found"? Or maybe, is there a way to send the search results as an attachment from the Alerts section of NLS (and then I wouldn't bother going through XI at all)?

We have multiple checks setup like this and it's becoming tedious to dig into the issues for more information, especially considering that product owners receive some of these alerts, it's often confusing. We switched to NLS from Splunk, which was very good at emailing out all of the search result details - I hope there is a way to do something similar?

If there's a way to do this via XI, I simply want search results to be displayed after the "CRITICAL: 1 matching entries found" message. I looked closely at check_nagioslogserver.php and it doesn't look like the functionality is there. So I'm wondering, is there an existing solution that can give me what I'm looking for to alert us without being forced to log into NLS to see results everytime?



Thanks!

Re: Nagios Log Server and Nagios XI integration

Posted: Wed May 02, 2018 4:08 pm
by cdienger
An email template can be setup and use the %lastalertlog% or %last10alertlogs% macros to print out the details of the last event or last 10 events that caused an alert. https://assets.nagios.com/downloads/nag ... Server.pdf covers how to set this up in a bit more detail.

Re: Nagios Log Server and Nagios XI integration

Posted: Thu May 03, 2018 3:23 pm
by emarmonti
Thanks, that might solve my issue. Although it looks like the alerts only allow you to the email addresses of registered NLS users. Is there a way to send the alert to adhoc emails? Like a distribution list, or a slack email address?

Re: Nagios Log Server and Nagios XI integration

Posted: Fri May 04, 2018 11:59 am
by cdienger
Unfortunately not but I can file a feature request for it.