Nagios Incident Manager - How To Integrate Incident Manager With Nagios XI

Purpose

This document describes how to integrate Nagios XI events with Nagios Incident Manager. Integrating these two products will automatically create and manage Nagios XI incidents in Nagios Incident Manager allowing teams and individuals to track and solve problems faster.

Target Audience

This document is intended for use by Administrators who wish to automatically create and manage Nagios XI incidents in Nagios Incident Manager. This document assumes the reader has both Nagios XI and Nagios Incident Manager installations already completed.

Overview

The Nagios Incident Manager Integration Component forwards events for Hard state changes for hosts and services that are in problem states, and can be customized to allow for selected events to be forwarded to Nagios Incident Manager as new incidents. This component also allows Nagios Incident Manager to respond back to Nagios XI with Acknowledgments and Comments for incidents that receive updates in Nagios Incident Manager.

Setting Up Incident Manager

Nagios Incident Manager requires both a user account and an incident type to be specified in order to successfully integrate with Nagios XI. Let's start by creating a new account specifically for Nagios XI in the Incident Manager.

After logging into Incident Manager, access the 'Administration → Manage Users' page, and click the 'New User' button.
For demonstration purposes, we'll create a username“nagiosxi”, and this user needs to be assigned the Role of Administrator from the drop-down.

The actual username can vary, but it is recommend to keep this account separate from normal user accounts for security purposes. Continue filling out the required fields as indicated with a * next to the field name with valid data.

Set the user account as Active and click the Save User button.Once the user is created, click on the user's hyperlink to access the user's details, and scroll down to locate the users API Key.

This key will be the authentication token that Nagios XI and Nagios Incident Manager use to communicate with each other, and this value will be needed to configure the Nagios XI component.

Next we'll create a new Incident Type by accessing the 'Administration → Manage Incident Types' page.

Click the New Type button. Use whatever name seems appropriate for your environment (in this example we used XI Incident), and click 'Save Type'.

Once your incident type is created, make note of the Alias for the incident type, as this will be needed by the Nagios XI component.

Setting Up The Nagios XI Component

Starting with Nagios XI 2012 all existing components and wizards come pre-packaged with Nagios XI. You will only need to do this step if you are running an earlier version of Nagios XI.

The Nagios Incident Manager Integration Component component can be downloaded from the following URL, and installed through Nagios XI's 'Admin → Manage Components' page.

Nagios Incident Manager Integration Component
http://assets.nagios.com/downloads/nagiosxi/components/nagiosim.zip

Once the component is installed, the Nagios Incident Manager component will be listed on the Manage Components page and can be accessed by clicking the 'Edit Settings' icon.

Component Configuration

The Nagios Incident Manager Component has several configuration options to allow for flexibility in how new incidents are created.

However, there are also multiple configuration options that are required for the component to work properly. Lets examine the different options available.

Enable Nagios Incident Manager Sender: This checkbox enables or disables the integration between Nagios XI and Nagios Incident Manager.
Incident Manager Public URL: This is the external URL for Incident Manager that Nagios XI will use to access the API. This address must be accessible by the Nagios XI server.
User API Key: This is the user-specific API key that was created with the Incident Manager user account earlier in this documentation.
Auto Resolve Incidents: Automatically mark incidents as resolved in Nagios Incident Manager upon host or service recovery.
Incident Type: This is the Alias of the incident type that we created in Incident Manager earlier in this documentation.
Callback Registration Status: Once the public URL and the API Key are saved in Nagios XI, Nagios XI will attempt to register a new Callback function that will forward incident changes back to Nagios XI as acknowledgments or comments.
Max Age: Nagios XI will store any open incidents in a local cache until this threshold is exceeded. This value prevents Nagios from sending multiple new incidents per day for the same host or service if several hard stage changes are detected. Note: Any incident that is marked as Closed or Resolved in the Incident Manager will be removed from Nagios XI's cache as well, which allows for a new incident to be created by Nagios XI.
Forwarding Threshold (optional): This option allows a delay to be specified after a hard state change. If a value greater than 0 is entered here, Nagios XI will wait X amount of minutes, recheck the host or service state, and then forward the incident if the problem still persists.
Incident Title and Incident Message: This is the format for the incident title and message that will be created in Incident Manager. Acceptable macros are:
- %type%: “host” or “service”
- %event_time%: A formatted date string
- %host%: Host name
- %service%: Service Description
- %status%: The host or service state
- %output%: Plugin output from the Nagios check, truncated to 255 characters
- %xiserverurl%: Nagios XI's external URL
Incident Manager Users (optional): A comma delineated list of Nagios Incident Manager usernames to automatically assign incidents to within Nagios Incident Manger.
Incident Manager Teams (optional): A comma delineated list of Nagios Incident Manager teams to automatically assign incidents to within Nagios Incident Manager.
Use Proxy (optional): This is an experimental feature of this component, and can be used for users who need to forward http requests through a proxy in order to communicate with the Nagios Incident Manager server. Note: This will require the Proxy Component for Nagios XI.
Hostgroups and Servicegroups Filtering (optional): Filtering can be enabled to allow only events from selected hostgroups or servicegroups to be forwarded to Incident Manager. Note: If any hostgroups OR servicegroups are selected, Nagios XI will only forward events for selected groups. Group filtering is considered to be either “on” or “off”.
Strict Mode (Optional): You can optionally filter strictly by Hostgroups, or strictly by Servicegroups. This means that if you select a Hostgroup, only Hosts within that Hostgroup will be forwarded and incidents created. Their services will be ignored, unless the service is in a selected Servicegroup. The same goes for selecting Servicegroups, as their Hosts will be ignored unless their host is in a selected Hostgroup.

Component Configuration

If callback registration is successful, Nagios Incident Manager should automatically update hosts and services in Nagios XI with comments and acknowledgments from Incident Manager.

For an acknowledgment to be submitted to Nagios XI, an incident must either be Closed, Resolved, or Acknowledged. If an incident is either Confirmed or the incident details are updated, Nagios Incident Manager will submit a Comment for that host or service.

To update, remove, or modify the Nagios Incident Manager callback function, access the 'Administration → Manage

API Callbacks' page in Nagios Incident Manager.

Finishing Up

This should complete the process for integrating Nagios XI and Nagios Incident Manager software. For support related questions please visit us at the Nagios Support Forums:
http://support.nagios.com/forum

Article ID: 107
Created On: Mon, Jul 13, 2015 at 2:24 PM
Last Updated On: Wed, Feb 10, 2016 at 10:53 PM
Authored by: jolson

Online URL: https://support.nagios.com/kb/secure/nagios-incident-manager-how-to-integrate-incident-manager-with-nagios-xi-107.html