Re: Splunk Integration Question...
Sean Alderman <[email protected]> Tue, 10 Sep 2013 13:34:04 -0400
| Newsgroups | gmane.network.nagios.user |
|---|---|
| Message-ID | <CAN39mj0V=JY_MBenUHpH+MTKOwNzE8eBdR7CTrkUo5iL+8F2iw@mail.gmail.com> |
--===============8945831133389455554==
Content-Type: multipart/alternative; boundary=089e01229a58481f6704e60ae956
--089e01229a58481f6704e60ae956
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Just what's in the nagios doc on CGI.cfg. The doc is lacking about what it
does, so I guess I'm a little curious what that config is about.
- Sean Alderman
Senior Engineer, UDit Systems Integration
This message had been brought to you by Android Bionic.
On Sep 10, 2013 1:10 PM, "Frost, Mark {BIS}" <[email protected]>
wrote:
> Sean,****
>
> ** **
>
> Can you describe what you=92re doing for Splunk integration with Nagios?
> I=92ve used Splunk with Nagios in a couple different ways, but I=92m not =
aware
> of any single standard for doing so.****
>
> ** **
>
> Originally, I just had Splunk run a scheduled search, which would trigger
> a script which sent a passive check result back to a Nagios service via
> NSCA. That way =96 having Nagios process passive check results from Spl=
unk
> =96 was the only way I could see to do that.****
>
> ** **
>
> Recently, I played around a bit with writing scripts that made use of
> Splunk=92s REST API so the checks could be run as active checks from Nagi=
os.
> (I always prefer active checks). I set this up for only one check, but
> once I got it working it worked pretty well.****
>
> ** **
>
> As a side note, I=92m still a little on the fence about whether or not I
> really want to have Nagios find problems through Splunk and then alert on
> them or have Splunk find an alert on them directly without using Nagios a=
t
> all=85****
>
> ** **
>
> Are you referring to another way of making Splunk and Nagios talk togethe=
r?
> ****
>
> ** **
>
> Mark****
>
> ** **
>
> *From:* Sean Alderman [mailto:[email protected]]
> *Sent:* Monday, September 09, 2013 1:12 PM
> *To:* [email protected]
> *Subject:* [Nagios-users] Splunk Integration Question...****
>
> ** **
>
> Greetings,****
>
> I was hoping I might find someone who's got the splunk integration
> actively working. I'm running Nagios Core (via EPEL) and Splunk 5.0.3 on
> OracleLinux 6.4.****
>
> When I edit cgi.cfg and enable splunk integration, then set the splunk
> URL to https://<mysplunkserver>:8000/en-US/app/search/flastimeline, I
> notice the nagios URLs look like: https://
> <mysplunkserver>:8000/en-US/app/flashtimeline?q=3Dsearch%20test1.udayton.=
edu%20<nagios
> plugin check>. I have two questions...****
>
> **=B7 **Is there a way I can make nagios use the hostname only, n=
ot
> the FQDN? We use short names in splunk so we don't a mix of fqdn and sho=
rt
> names since we use both forwarders and syslog as input.****
>
> **=B7 **What data is this query looking for, is it expected that =
I
> should have my nagios log in splunk? The <nagios plugin check> in the
> query doesn't seem useful to me, unless there's splunk data specifically
> tied to that check, and I'm hoping someone could provide an example.
> ****
>
> Kind regards,****
>
> -- ****
>
> Sean M. Alderman
> Senior Engineer, UDit Systems Integration and Engineering
> University of Dayton****
>
>
> -------------------------------------------------------------------------=
-----
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=3D51271111&iu=3D/4140/ostg.=
clktrk
> _______________________________________________
> Nagios-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nagios-users
> ::: Please include Nagios version, plugin version (-v) and OS when
> reporting any issue.
> ::: Messages without supporting info will risk being sent to /dev/null
>
--089e01229a58481f6704e60ae956
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
<p dir=3D"ltr">Just what's in the nagios doc on CGI.cfg. The doc is lac=
king about what it does, so I guess I'm a little curious what that conf=
ig is about.</p>
<p dir=3D"ltr">- Sean Alderman <br>
Senior Engineer, UDit Systems Integration</p>
<p dir=3D"ltr">This message had been brought to you by Android Bionic.</p>
<div class=3D"gmail_quote">On Sep 10, 2013 1:10 PM, "Frost, Mark {BIS}=
" <<a href=3D"mailto:[email protected]">[email protected]=
om</a>> wrote:<br type=3D"attribution"><blockquote class=3D"gmail_quote"=
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Sean,<u></u><u></u></span=
></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Can you describe what you=
=92re doing for Splunk integration with Nagios?=A0=A0 I=92ve used Splunk wi=
th Nagios in a couple different ways, but I=92m not aware of any single
standard for doing so.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Originally, I just had Sp=
lunk run a scheduled search, which would trigger a script which sent a pass=
ive check result back to a Nagios service via NSCA.=A0=A0 That
way =96 having Nagios process passive check results from Splunk =96 was th=
e only way I could see to do that.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Recently, I played around=
a bit with writing scripts that made use of Splunk=92s REST API so the che=
cks could be run as active checks from Nagios.=A0 (I always
prefer active checks).=A0=A0 I set this up for only one check, but once I =
got it working it worked pretty well.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">As a side note, I=92m sti=
ll a little on the fence about whether or not I really want to have Nagios =
find problems through Splunk and then alert on them or have
Splunk find an alert on them directly without using Nagios at all=85<u></u=
><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Are you referring to anot=
her way of making Splunk and Nagios talk together?<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d">Mark<u></u><u></u></span>=
</p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri","sans-serif";color:#1f497d"><u></u>=A0<u></u></span><=
/p>
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><b><span style=3D"font-si=
ze:10.0pt;font-family:"Tahoma","sans-serif"">From:</spa=
n></b><span style=3D"font-size:10.0pt;font-family:"Tahoma","=
sans-serif""> Sean Alderman [mailto:<a href=3D"mailto:salderman1@udayt=
on.edu" target=3D"_blank">[email protected]</a>]
<br>
<b>Sent:</b> Monday, September 09, 2013 1:12 PM<br>
<b>To:</b> <a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a><br>
<b>Subject:</b> [Nagios-users] Splunk Integration Question...<u></u><u></u>=
</span></p>
<p class=3D"MsoNormal" style=3D"margin-left:.5in"><u></u>=A0<u></u></p>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in">Greetings,<u></u><u></u><=
/p>
</div>
<p class=3D"MsoNormal" style=3D"margin-right:0in;margin-bottom:12.0pt;margi=
n-left:.5in">
=A0 I was hoping I might find someone who's got the splunk integration =
actively working.=A0 I'm running Nagios Core (via EPEL) and Splunk 5.0.=
3 on OracleLinux 6.4.<u></u><u></u></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in">=A0=A0 When I edit cgi.cf=
g and enable splunk integration, then set the splunk URL to
<a href=3D"https://%3cmysplunkserver%3e:8000/en-US/app/search/flastimeline"=
target=3D"_blank">https://<mysplunkserver>:8000/en-US/app/search/fla=
stimeline</a>, I notice the nagios URLs look like: https://<mysplunkserv=
er>:8000/en-US/app/flashtimeline?q=3Dsearch%<a href=3D"http://20test1.ud=
ayton.edu" target=3D"_blank">20test1.udayton.edu</a>%20<nagios
plugin check>.=A0 I have two questions...<u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:1.0in">
<u></u><span style=3D"font-size:10.0pt;font-family:Symbol"><span>=B7<span s=
tyle=3D"font:7.0pt "Times New Roman"">=A0=A0=A0=A0=A0=A0=A0=A0
</span></span></span><u></u>Is there a way I can make nagios use the hostna=
me only, not the FQDN?=A0 We use short names in splunk so we don't a mi=
x of fqdn and short names since we use both forwarders and syslog as input.=
<u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:1.0in">
<u></u><span style=3D"font-size:10.0pt;font-family:Symbol"><span>=B7<span s=
tyle=3D"font:7.0pt "Times New Roman"">=A0=A0=A0=A0=A0=A0=A0=A0
</span></span></span><u></u>What data is this query looking for, is it expe=
cted that I should have my nagios log in splunk?=A0 The <nagios plugin c=
heck> in the query doesn't seem useful to me, unless there's spl=
unk data specifically tied to that check, and
I'm hoping someone could provide an example.<br clear=3D"all">
<u></u><u></u></p>
</div>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in">Kind regards,<u></u><u></=
u></p>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:.5in">-- <u></u><u></u></p>
<div>
<p class=3D"MsoNormal" style=3D"margin-right:0in;margin-bottom:12.0pt;margi=
n-left:.5in">
Sean M. Alderman<br>
Senior Engineer, UDit Systems Integration and Engineering<br>
University of Dayton<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>-----------------------------------------------------------------------=
-------<br>
How ServiceNow helps IT people transform IT departments:<br>
1. Consolidate legacy IT systems to a single system of record for IT<br>
2. Standardize and globalize service processes across IT<br>
3. Implement zero-touch automation to replace manual, redundant tasks<br>
<a href=3D"http://pubads.g.doubleclick.net/gampad/clk?id=3D51271111&iu=
=3D/4140/ostg.clktrk" target=3D"_blank">http://pubads.g.doubleclick.net/gam=
pad/clk?id=3D51271111&iu=3D/4140/ostg.clktrk</a><br>___________________=
____________________________<br>
Nagios-users mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]=
urceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/nagios-users" targe=
t=3D"_blank">https://lists.sourceforge.net/lists/listinfo/nagios-users</a><=
br>
::: Please include Nagios version, plugin version (-v) and OS when reportin=
g any issue.<br>
::: Messages without supporting info will risk being sent to /dev/null<br><=
/blockquote></div>
--089e01229a58481f6704e60ae956--
--===============8945831133389455554==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
--===============8945831133389455554==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Nagios-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue.
::: Messages without supporting info will risk being sent to /dev/null
--===============8945831133389455554==--