Issue with ccm_config.inc.php file in Nagios 5.5.9

[ddaluka]

Hi,

We are planning to use nagios version 5.5.9. After doing the fresh install, following file (/usr/local/nagiosxi/etc/components/ccm_config.inc.php ) is not generated anymore until somebody do a login using GUI or any of the nagios scripts are being used.

The issue is, when this file gets created for the first time after login, it gets created with 644 permission for apache:nagios and when we try to do any nagios activity from backend such as apply config, it complains about permission. (it is expecting 664 permission)

I checked, the permissions were correct in earlier versions because '/usr/local/nagiosxi/scripts/reset_config_perms.sh' gets executed while doing the installation which provides all the required permissions. but now, because ccm_config.inc.php is not existing anymore while doing the installation, its permissions are not getting corrected.

We have created a parent rpm which calls all the rpms required for nagios installation as a dependency and in that parent rpm spec, we also tried to add the blank file with correct permissions. After the installation, we are creating some hostgroups and adding them using reconfigure script but that fails because this file is not having any required DB information in it.

Can you please suggest if it is a regression bug and if there is a workaround available? We are using the automated process starting from nagios installation to applying the required configuration and do not want to introduce any manual intervention.

Please let me know if anymore information is needed.

[jomann]

Hello,

Yes you're right on install it does not run the reset_config_perms.sh script but it does run that script every time you apply configuration. So once you've applied configuration it will be the proper permissions. In the upcoming XI 5.6 the ccm_config.inc.php file is removed and the config.inc.php file is used for the database configuration for nagiosql.

[ddaluka]

Hi Jomann,

Thank you for your quick response. We are installing Nagios using RPM and then we have also created an RPM which is creating some generic hostgroups etc in nagios import directory and runs reconfigure script. Till this point , everything is working as expected.

After this, we execute a perl script which we have written to place nagios monitoring for different environments. This scripts reads the environment information from a source file. This script checks if environment specific hostgroups , contactgroups are existing and if not, then it creates the required objects and generates the final host and service configurations with all dependencies available.

To check if hostgroup, contactgroup, host is existing in nagios, we created some script similar to ccm_delete_object.php. Looks like I will have to update the script accordingly. I am not even sure now if this is the best approach.

I know that now there are rest APIs available to get the status of a hostgroup etc but it needs to know the api key. Can you please suggest me the best way to achieve this?

1. Can you bundle the scripts in nagios to check if certain objects exists? (From database)

2. Should I use rest APIs? In this case, how can I retrieve the api keys and is it secure to get it from database and use it in perl script?

3. Is it alright that we are writing our custom script to check object existence and its dependencies? In this case, how we can keep up with the changes Nagios is providing?

[jomann]

If you're checking on database information it would be easiest to do so with a php script, much like the ccm_delete_object.php you would be able to hook into the internal functions in XI to verify configuration in the database. That would require some custom coding on your part but is probably the most straightforward way of doing it.

The API is going to give you the currently applied hostgroups, etc but will not give you ones that have been added into the CCM and not applied yet. This may or may not be a problem for you with what you are doing.

1. We don't have any scripts that actually check if things exist, you'd have to write a php script to do database calls for this (the ccm scripts might be able to be cut up to make this happen)

2. If you can't use the script above, you could always just post the object you're trying to create with the API - it will overwrite the object if it already exists so you shouldn't have an issue just running it, it wouldn't break anything. To get the API key you'd need to do something like:

Code: Select all

mysql -pnagiosxi nagiosxi -N -B -e "SELECT api_key FROM xi_users WHERE username = 'nagiosadmin'"

3. You should be okay writing a custom script if it is checking things related to the database. We don't typically make large breaking changes to the database structure. We also try to keep things as backwards compatible as possible.

[ddaluka]

If you're checking on database information it would be easiest to do so with a php script, much like the ccm_delete_object.php you would be able to hook into the internal functions in XI to verify configuration in the database. That would require some custom coding on your part but is probably the most straightforward way of doing it.

The API is going to give you the currently applied hostgroups, etc but will not give you ones that have been added into the CCM and not applied yet. This may or may not be a problem for you with what you are doing.

1. We don't have any scripts that actually check if things exist, you'd have to write a php script to do database calls for this (the ccm scripts might be able to be cut up to make this happen)

2. If you can't use the script above, you could always just post the object you're trying to create with the API - it will overwrite the object if it already exists so you shouldn't have an issue just running it, it wouldn't break anything. To get the API key you'd need to do something like:

Code: Select all

mysql -pnagiosxi nagiosxi -N -B -e "SELECT api_key FROM xi_users WHERE username = 'nagiosadmin'"

3. You should be okay writing a custom script if it is checking things related to the database. We don't typically make large breaking changes to the database structure. We also try to keep things as backwards compatible as possible.

Hi Jomann,

Thanks again for your response. I finally decided to use rest API's so that I will be in sync with each nagios upgrade and do not need to change the custom scripts.

I also managed to get the api key for a user which is now being passed as an argument for the perl scripts.

Code: Select all

my $apiKey = `source /usr/local/nagiosxi/var/xi-sys.cfg; mysql -N -s -u \$cfg__db_info__nagiosxi__user -p\$cfg__db_info__nagiosxi__pwd \$cfg__db_info__nagiosxi__db  -e "select api_key from  xi_users  WHERE username=\'$cred\' and api_enabled='1'";`;

As you can see, it is not taking password in account and anybody can pass any user as an argument. To avoid that, I am first doing the authentication.

Code: Select all

sub validateNagiosUsername {

my(@cred) = @_;
$::log->info("Validating Username/Password......");
my $auth_json = `curl -XPOST -k "https://localhost/nagiosxi/api/v1/authenticate?pretty=1" -d "username=$cred[0]&password=$cred[1]"`;
my $obj = from_json( $auth_json );
  if (exists($obj->{'error'})) {
          $::log->error(" Authentication is not successful for user $cred[0] --- $obj->{'message'} \n");
          exit 1;
      }
  else {
      $::log->info("Nagios Authentication is successful for user $cred[0] \n");
  }
}

But I still have couple of questions which you can help with:

1. In our requirement, we want to have end to end activity done without any UI activity from nagios installation to applying nagios configuration from backend.

2. Even if I use the rest APIs, I need to do a login using GUI and set the nagiosadmin password and other config bits. May be I can use reset_nagiosadmin_password script for that purpose. I am not sure. But is there anything available to bootstrap nagios from backend without any need to open a UI and setting up the parameter?

3. I got rest API working where I am getting a list of hostgroup for a host.

Code: Select all

sub getHostGroupListForHost {
my ($hostName, $apiKey) = @_;
my @validationResult = ();

                $::log->info("Shared host for which hostgroup list is being extracted :  $hostName");
                my $hostgroup_json = `curl -XGET -k "https://localhost/nagiosxi/api/v1/objects/hostgroupmembers?apikey=$apiKey&pretty=1&host_name=$hostName"`;
                my $obj = from_json( $hostgroup_json );
                if ($obj->{'recordcount'} != "0") {
                    foreach my $hostgroup ( @{$obj->{hostgroup}}) {
                        my $hostgroupName = $hostgroup->{hostgroup_name};
                        $::log->debug("hostgroup for shared host $hostName is $hostgroupName ");
                        push @validationResult, $hostgroupName;
                    }
                }
                
                else {
                    $::log->info(" No Hostgroup added for host $hostName or $hostName host configuration doesn't exist in nagiosql database "); 
                }

return \@validationResult;

}

But I can't find a way to get the contactgroup list assigned for a host.

If bootstrapping is possible from backend, then ccm_config.inc.php will be created anyways and I can run reset perm script or reconfigure script to set the permission.

[jomann]

Good news on the top items there. As for the list you have of questions:

For number 1 & 2 we do not currently have a way to do the entire setup from the command line. This will also be something that will be added in future versions but I cannot guarantee it will be in 5.6 or 5.7 but it is coming. For right now your best bet is going to be updating the database with what you can.

3. As for the contact groups, you may have to get that data directly from the Nagios Core CGIs. I do believe it's being added into the XI API but currently the only way I know of grabbing it directly is through that, you can see more about it here: https://labs.nagios.com/2014/06/19/expl ... -7-part-1/

[ddaluka]

Good news on the top items there. As for the list you have of questions:

For number 1 & 2 we do not currently have a way to do the entire setup from the command line. This will also be something that will be added in future versions but I cannot guarantee it will be in 5.6 or 5.7 but it is coming. For right now your best bet is going to be updating the database with what you can.

3. As for the contact groups, you may have to get that data directly from the Nagios Core CGIs. I do believe it's being added into the XI API but currently the only way I know of grabbing it directly is through that, you can see more about it here: https://labs.nagios.com/2014/06/19/expl ... -7-part-1/

Hi jomann,

Thank you for your support.

[ssax]

Do you have any other related questions on this or are we okay to lock it up and mark it as resolved?

[ddaluka]

Do you have any other related questions on this or are we okay to lock it up and mark it as resolved?

Please mark it as resolved. Thank you for your support.

[scottwilkerson]

Do you have any other related questions on this or are we okay to lock it up and mark it as resolved?

Please mark it as resolved. Thank you for your support.

Great!

Locking thread