2024R2.0.1 most annoying bugs.

[[email protected]]

Hi to everyone.

I gather some most anoying bugs in 2024R2.0.1 nagios syslog server. Some of them has been mentioned there: viewtopic.php?t=76252, but i want to add some more info.

Dashboard:

1. You cannot add "description" for search same like old nagiosLS:


2. You cannot create "advanced" filter:


3. in create filters menu, if you want find "event.id" as exapmle, you got this:

instead of this:


4. Icon for filtering in Histogram sometimes showing outside the view:


5. If you make a change in search, you must hit "ENTER", every time, if you don't, the changes are not provide.
If you save and load the dashboard,without "ENTER" hits, the changes are not saved and rolled back.


6. FIXED - its not possible set columns order of table.

7. UPDATED - When Non-admin user open public dashboard, after few seconds page refresh to blank. Tested on two accounts.
After change rights to administrator, page works properly.

System:

8. I tried import data from 2024R1.3.1,import hang without any error information.
I tried restart process many times, close and open indexes on source server with same result.

9. UPDATED - Some of password txt dialogs make text visible. (Add domain user as example)

10. If you fill in proxy server and use HTTP tunel, most part of web gui stop working, because proxy exception for localhost and 127.0.0.1 is missing. I will appreciate, if text box for exceptions, will be added.

11. System status card have problem with SSL, monitor NCPA card, have problem with ssl.
[ SSL: no alternative certificate subject name matches target host name '10.X.X.X' ]
I can solve with ad SAN to certificate, but someone with DHCP address, could have problem.

12. If you want to use two factor, please use https://github.com/dochne/google-authenticator, instead of e-mail.
If you want to investigate some disaster, the e-mail could be dead. After that the logserver could be useless.


13. In some cases, if you edit "Global Config" > Input, filters, output, you can fail like this:
1. the configuration check is good, but restart of services failed.
2. the check is good, restart is success, but all listening ports disappear. You can see in log file, the service is running but listening port bindings got error.

If i find something new, i will try to update this topic

Best Regards.

[[email protected]]

Hi.

After some working with system, i highly suggest to read https://assets.nagios.com/downloads/nag ... 2024R2.pdf especially page 10 and 11. It could save big headache.

On RedHat derivated systems i suggest copy root certificate to "Known ROOT" certificates repository:
# sudo cp /usr/local/nagioslogserver/opensearch/config/root-ca.pem /etc/pki/ca-trust/source/anchors/
and rebuild list:
update-ca-trust

you can stop using -k for opensearch curl commnands.


Next portion of bugs, that i discover:

14. On configuration page list of listening ports disappeared, but system is running and gathering a logs.

15. Dasboard text field is wraping text after 65 chars. Its independent on width of screen.

16. FIXED - Dashboard map field do not accept source.geo.city_name as prew. version. Is documentation for this somewhare ?
source.geo.location is right parameter.

17. FIXED - If you click on host in Unique hots, search not work...
Search set link on //syslog/nagioslogserver/dashboard#/dashboard/script/logserver.js?query=host:%22192.168.1.1%22
But search accept something like this: //syslog/nagioslogserver/dashboard?searchQuery=host.ip%3A192.168.1.1

18. FIXED - backups in Command Subsystem doesnot work correctly, beacuse /store/backups/nagioslogserver is empty, but command list says SUCCESS.
if i run #/usr/local/nagioslogserver/scripts/create_backup.sh as nagios user from commndline, backup file is appear correctly.


BR

[jmichaelson]

Thanks for the feedback! We'll get those recorded in the system and get back to you with issue numbers to track in the changelogs!

[[email protected]]

Hi.

Its any progress on these bugs ?

BR

[jmichaelson]

I've got a bit of a list, and some questions for you before i can finish writing all the issues:

1. The attachment looks like its missing.

• There are two dropdowns in the add filter template dialog. The first is for the field, the second is for what to do with it (must, must not, etc.). Is this the advanced filtering you're asking for?

• NLS#526

• I can't reproduce this. It looks like you've got something wider than what I'm seeing. Can you send me the actual json from the log entry that's making it stretch out that wide?

• NLS#623.

• NLS#517.

• I'm unable to reproduce using the global dashboards we supplied. Are these dashboards that you created?

• The migration script logs to the syslog with Migration in the message. You can search on that to get a better diagnostic idea, and then let us know what's going on with that.

• The AD/LDAP page issue is NLS#569. If you come across more pages where the password is visible, let us know!

• NLS#381

• NLS#530

• NLS#626

• NLS#573

• NLS#573

• I'm not sure what this means; can you attach a screen shot?

• NLS#625

• NLS#513

• NLS#611

[[email protected]]

Hi jmichaelson.

1. In old version of nagios you can fill in legend to Query

NG1.PNG

. This legends shows in all graphs as bar description.

2. Yes i know, there is a dropdowns for filter editing, but you cant use in them operands like "AND OR" or you cant use REGULAR like "*\$*".
You can write fiters without error, but they are not working. In older version of Nagios Syslog you can use them as i sent as image.

4. As you can see on images:

NG9.PNG

NG10.PNG

7. It happens in all dashboards, accounts are migrated from previous server. I try to do more investigation.

8. I understand, i try to do more investigation.

15. In dashboard text panel, the text is wrapped out after 65 characters and rest of field is empty.

NG11.PNG

if i moddified CSS of page :
.prose {
color: var(--tw-prose-body);
/* max-width: 65ch; */
}
The text is look better:

NG12.PNG

BR.

Karel Novák

[[email protected]]

Hi jmichaelson.

I try to investigate some information about mirgation process (8).
But i do not have any succes.
When i start migration, i see log with information about start... But after some time migration stops, in general between 60-80% and no information in logs appeard. No success, no errors, nothing..

Best Regards

Karel Novák

[[email protected]]

Hi to everyone.

I have additional information for bug no 7:

7. When Non-admin user open public dashboard, after few seconds page refresh to blank. Tested on two accounts.
After change rights to administrator, page works properly.

First of all, this bug is not related to dashboards but to accounts. And its not problem in rights, its problem with accounts in general.
This bug affected accounts imported from AD.

If you create user account by "import from AD", every dashboards for this user shows blank after refresh.
You can fix this issue by edit the account and save it. I usually change rights from "user to admin" and back as workaround. Or vice versa.

These issues starts to be very annoying. Is it somewhere information about time schedule to fix these ?
With our syslog works non IT people also. It's very frustrating, explain "its still broken" every time, when they wants to use log server.


Best Regards

Karel Novák

[[email protected]]

Hi, i want to add new issue.

14. It not possible disable admin account. You can only delete account.
If you have security issue caused by user account, you must delete this account, which is clumsy.

Best Regards

Karel Novák

[[email protected]]

Hi to everyone.

I discovered new issue.

We have over 150 logging devices, which sends 15GB logs to log server every day.
So our dedicated log server have almost 20TB disk space and nearly 1TB of ram.

I noticed today the income of devices logs stopped on midnight.
In logstash-plain.log appears this error: Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [998]/[1000] maximum shards open;

It means, you do not have "enough memory space" for shards (if i understand right,opensearch databases uses shards instead of index)

In general you can have 1000 shards per 16GB of memory. If you have more or less you must change no of shards.
Some explanation you can find https://forum.opensearch.org/t/max-shar ... tion/23777

I our scenario we want 3000 shards, because we want to be below maximum 4000 shard per node.

you could use this command from command line:
curl -H 'Content-Type: application/json' -X PUT -d '{"persistent":{"cluster.max_shards_per_node": 3000 }}' "https://localhost:9200/_cluster/settings" -ku nagioslogserver:*********

Next catch is Java Heap memory.
Someone, i dont know why, set hard limit of Java Heap memory to 32GB.

So, you must edit /etc/sysconfig/opensearch and find:

# Heap Size (defaults to 256m min, 1g max)
# Nagios Log Server Default to 0.5 physical Memory
ES_HEAP_SIZE=$(expr $(free -m|awk '/^Mem:/{print $2}') / 2 )
if [ $ES_HEAP_SIZE -gt 32000 ] ; then
ES_HEAP_SIZE=32000
fi

chage 32000 to reasonable big value, you must keep some resources for other processes.
In my case, i set 256000, which is more then enough for our shards.
If the system will be slow, we would add more

BR


KN.