Nagios Support Forum

Howdy!

I'm currently running nagios logserver with approximately 100 hosts. I love the fact that I can see what hosts are reporting and which stop reporting. However, we're moving to a 2 instance cluster and directing our logs through a F5 load balancer. The problem is, now the unique host report is only showing that the F5 is reporting.

I was curious if there is a way to generate a new report, or modify the existing one, that is based off of hostname rather than host ip since the hostnames seem to be passing through the logs.

Thanks!

I'll file a feature request to make this an option, but a quick hack that seems to work:

Edit /var/www/html/nagioslogserver/application/helpers/data_helper.php and change line 391 from:

$json = '{"query":{"filtered":{"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1,"to":1}}}]}}}},"aggs":{"hosts":{"terms":{"field":"host.raw", "size":9999}}}}';

to:

$json = '{"query":{"filtered":{"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1,"to":1}}}]}}}},"aggs":{"hosts":{"terms":{"field":"logsource.raw", "size":9999}}}}';

This should have an immediate impact to the unique hosts table. The Not Sending table will likely need to be cleared and allowed to repopulate as devices stop sending.

The field names can be adjusted by editing /var/www/html/nagioslogserver/application/views/reports/hosts.php and making changes to lines 17 & 51:

<th><?php echo _("IP (Hostname)"); ?></th>

to:

<th><?php echo _("Hostname (IP)"); ?></th>

24 & 58:

$hostname = gethostbyaddr($host);

to:

$hostname = gethostbyname($host);

and 33 & 67:

<td><a href="<?php echo site_url('dashboard#/dashboard/script/logserver.js?query=host:'.urlencode($query)); ?>"><?php echo $display; ?></a></td>

to:

<td><a href="<?php echo site_url('dashboard#/dashboard/script/logserver.js?query=logsource:'.urlencode($query)); ?>"><?php echo $display; ?></a></td>

Make sure you make copies of the files first before making any change in case you need to revert back.