multiple error on nagioslogserver

[camieg]

Hello everyone, to begin with after a complete installation from a centos 9 machine, I observe errors in some menus:

OS : CentOS Stram 9 - 5.14.0-480.el9 x86_64
Nagios log server version : 2024R1.1

----------------------------------------------------------------------------------------------------------------------------
- configure -> per instance (advanced) :
The instance reports that it's local Logstash is not running. You will not be able to collect logs on this instance until you start Logstash.

a "systemctl status logstash.service" indicates that the service is working correctly and without errors

-----------------------------------------------------------------------------------------------------------------------------
- Admin -> System status :
I see two warnings

(Elasticsearch database : could not authenticate. invalid token given)
(Logstash Collector : could not authenticate. invalid token given)

-----------------------------------------------------------------------------------------------------------------------------
- Admin -> NCPA :
i see two warnings

NCPA Active Check Listener : could not authenticate. invalid token given)
NCPA Passive Check Listener : could not authenticate. invalid token given)

-----------------------------------------------------------------------------------------------------------------------------
- Admin -> mail :
I get an SSL error when sending an email with -> SMTP SERVER -> TLS or STARTTLS
yet with exactly the same configurations on a less recent server nagios version 2024R1.0.1, it works well
------------------------------------------------------------------------------------------------------------------------------

despite all these errors the logs are well received

[jmichaelson]

I'll take these and create internal issues where appropriate. Thanks much!

[camieg]

post to delete

[camieg]

how can i debug the tokens used by logstash and elasticsearch in order to investigate.
the monitor backen (ncpa) page also indicates ncpa active and passive with the error "could not authenticate : invalid token given"
however when i open the NCPA interface and connect with the NCPA API TOKEN the connection works fine

[camieg]

I was able to resolve the error in configure -> per instance by disabling the sudoers options that had been applied by the ANSSI BP intermediary security profile:
require tty
use_pty

the errors in admin -> system status and monitor backend are still present

[camieg]

I reinstalled nagios log server on fresh centos 9 stream without any security profile installed and just minimal install and still the same problem.
in :
admin -> NCPA :
NCPA active check listener : Could not authenticate. Invalid token given.
NCPA Passive check Sender : Could not authenticate. Invalid token given.
the restart and stop buttons are not visible

admin -> system status
Elasticsearch Database : Could not authenticate. Invalid token given.
Logstash Collector : Could not authenticate. Invalid token given.


I use a 30 day trial license

if you need log files let me know

[jmichaelson]

After doing a bit of digging into this, I've got an idea. For right now I'd like you to go into your user profile (click your user name in the upper right hand corner), and click generate new api key. Let's see if that resolves your problem. If not, go to the status pages you mentioned, hit the f12 key to open the developer tools pane, and click on network. Refresh the page. Look in the list of url's requested for check_system_status. the token in the payload there should be matching the api access token on your profile.

[ssunga]

some logging info would be good here

[camieg]

After doing a bit of digging into this, I've got an idea. For right now I'd like you to go into your user profile (click your user name in the upper right hand corner), and click generate new api key. Let's see if that resolves your problem. If not, go to the status pages you mentioned, hit the f12 key to open the developer tools pane, and click on network. Refresh the page. Look in the list of url's requested for check_system_status. the token in the payload there should be matching the api access token on your profile.

Hello, first thank you for the answer,
after generating a new API token via the user menu and restarting the server this does not resolve the problem.

when I look at the different queries in the development tools I don't see "check_system_status" I only see:
- "system_service_status"
- "check_node_status"

in both cases I do not see the correct token sent as payload

[camieg]

some logging info would be good here

Hello, can you tell me which logs you want?