I have setup Nagios on one of my VM.
I receive the first alert when a service is Critical. But I do not receive the subsequent alert/email.
Host template config
define host {
name host-template
alias Default server template
check_command check_dummy!0!!!!!!!
max_check_attempts 10
check_interval 5
retry_interval 1
check_period 24x7
event_handler notify-host-by-email
event_handler_enabled 1
process_perf_data 1
contacts user1
notification_interval 10
notification_period 24x7
first_notification_delay 0
notification_options d,u,s,
notifications_enabled 1
_LTERM_LOAD_C 10
_LTERM_LOAD_W 5
_USED_MEM_C 30
_USED_MEM_W 20
_USED_SPACE_C 40
_USED_SPACE_W 30
register 0
}
Host config:
define host {
host_name aaaaa
use bbbbb
alias DEV
display_name DEV
address 11.111.111.111
_KEY xx
_SERVERPORT xx:8082
_SERVERPORTLFAT xx:443
_URL xx:8082
_USER test01
register 1
}
notification_interval is enabled but still i don't see any notifications.
I'm unsure if there is anything that is overriding it.
Because of this:
max_check_attempts 10
Nagios will try 10 more times before send you notification. Try to comment it and check again
I want to implement login to my vpn service with password + google_otp. freeradius as auth server and ldap as backend_database.
I have completed the following work:
enable pam Authentication Module in /etc/raddb/sites-enabled/default
add a line "DEFAULT Auth-Type := PAM" to /etc/raddb/users
enable ldap module and add ldap site to freeradis, I confirm that raidus use ldap database is working properly.
Overwrite the contents of /etc/pam.d/radiusd
auth requisite pam_google_authenticator.so secret=/tmp/.google_authenticator user=root forward_pass
auth required pam_unix.so use_first_pass
run test cmd:(testpa is my password,271082 is otp)
radtest perlingzhao testpa271082 localhost 1812 testing123
radius log:
(0) [pap] = noop
(0) } # authorize = updated
(0) Found Auth-Type = pam
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) authenticate {
(0) pam: Using pamauth string "radiusd" for pam.conf lookup
(0) pam: ERROR: pam_authenticate failed: User not known to the underlying authentication module
(0) [pam] = reject
(0) } # authenticate = reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
log in /var/log/secure:
radiusd(pam_google_authenticator)[11728]: Accepted google_authenticator for perlingzhao
pam_unix(radiusd:auth): check pass; user unknown
pam_unix(radiusd:auth): authentication failure; logname=root uid=0 euid=0 tty= ruser= rhost=
I know this is because there is no local user, user info is in ldap.
anyone can help me , tell me how to config can solve this problem, thanks.
I can suggest using a PHP script for OTP validation instead of PAM modules, it does not create real local users but only verifies the TOTP itself. PHP has LDAP functions as well.
authorize{
update control {
Auth-Type := `/usr/bin/php -f /etc/raddb/yourscript.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'`
}
There is a commercial product that appears to fully meet your requirements.
P.S. I am affiliated with #1
How shall I see all the status messages of a service in nagios xi. I send multiple status messages and the latest message is displayed in the dashboard UI. From where shall I retrieve all the previous messages?
You need define stalking_options directive in your services/hosts definition.
Example:
define service {
service_description Users count
host_name myhost1
use service_standard
check_command check_nrpe_custom!-H myhost1 -c check_user
stalking_options c,w,o,u
}
More info about stalking_options can be found here.
I have a filter (light-weight filter, LWF) driver that captures the packets from all the adapters. The FilterClass is compression, the same with official ndislwf example. This setting will bind the filter above Native Wifi Filter.
However, this FilterClass can only capture Ethernet packets on wireless adapters. So I want it to be able to capture the raw 802.11 packets on wireless adapters. So I need to specify FilterClass as ms_medium_converter_128 in the INF. This setting will bind the filter below Native Wifi Filter.
So I need to have two drivers now. One is compression and another is ms_medium_converter_128. But I don't want to maintain two drivers's code and let my users install two drivers. Is there a way to mix two LWFs into one binary (and only needs one install)? Or is there a way to let one LWF be able to bind above and below Native Wifi Filter at the same time? Thanks!
Here's my whole INF with compression FilterClass:
;-------------------------------------------------------------------------
; NPF.INF -- Npcap NDIS 6.x LightWeight Filter Driver
;
; Copyright (c) 2015, Insecure.Com LLC. All rights reserved.
;------------------------------------------------------------------------
[version]
Signature = "$Windows NT$"
Class = NetService
ClassGUID = {4D36E974-E325-11CE-BFC1-08002BE10318}
CatalogFile = %NPF_DriverName%.cat
Provider = %Insecure%
DriverVer=05/20/2016,15.54.30.752
[Manufacturer]
%Insecure%=Insecure,NTx86,NTia64,NTamd64
[Insecure.NTx86]
%NPF_Desc%=Install, INSECURE_NPF
[Insecure.NTia64]
%NPF_Desc%=Install, INSECURE_NPF
[Insecure.NTamd64]
%NPF_Desc%=Install, INSECURE_NPF
;-------------------------------------------------------------------------
; Installation Section
;-------------------------------------------------------------------------
[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{7daf2ac8-e9f6-4765-a842-f1f5d2501340}"
Copyfiles = npf.copyfiles.sys
[SourceDisksNames]
1=%NPF_Desc%,"",,
[SourceDisksFiles]
npf.sys=1
[DestinationDirs]
DefaultDestDir=12
npf.copyfiles.sys=12
[npf.copyfiles.sys]
%NPF_DriverName%.sys,,,2
;-------------------------------------------------------------------------
; Ndi installation support
;-------------------------------------------------------------------------
[Inst_Ndi]
HKR, Ndi,Service,,%NPF_DriverName%
HKR, Ndi,CoServices,0x00010000,%NPF_DriverName%
HKR, Ndi,HelpText,,%NPF_HelpText%
HKR, Ndi,FilterClass,, compression
; For a Monitoring filter, use this:
; HKR, Ndi,FilterType,0x00010001, 1 ; Monitoring filter
; For a Modifying filter, use this:
; HKR, Ndi,FilterType,0x00010001, 2 ; Modifying filter
HKR, Ndi,FilterType,0x00010001,2
HKR, Ndi\Interfaces,UpperRange, , noupper
HKR, Ndi\Interfaces,LowerRange, , "ndis5,ndis4"
; TODO: Ensure that the list of media types below is correct. Typically,
; filters include "ethernet". Filters may also include "ppip" to include
; native WWAN stacks, but you must be prepared to handle the packet framing.
; Possible values are listed on MSDN, but common values include:
; ethernet, wan, ppip, wlan
HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet, fddi, wan, ppip, wlan, bluetooth, ndis5, vwifi, flpp4, flpp6, vchannel, nolower"
; For a Mandatory filter, use this:
; HKR, Ndi,FilterRunType,0x00010001, 1 ; Mandatory filter
; For an Optional filter, use this:
; HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter
HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter
; By default, Mandatory filters unbind all protocols when they are
; installed/uninstalled, while Optional filters merely pause the stack. If you
; would like to override this behavior, you can include these options. These
; options only take effect with 6.30 filters on Windows "8" or later.
; To prevent a full unbind, and merely pause/restart protocols:
; HKR, Ndi,UnbindOnAttach,0x00010001, 0 ; Do not unbind during FilterAttach
; HKR, Ndi,UnbindOnDetach,0x00010001, 0 ; Do not unbind during FilterDetach
; To force a full unbind/bind (which includes pause/restart, of course):
; HKR, Ndi,UnbindOnAttach,0x00010001, 1 ; Unbind during FilterAttach
; HKR, Ndi,UnbindOnDetach,0x00010001, 1 ; Unbind during FilterDetach
;
;-------------------------------------------------------------------------
; Service installation support
;-------------------------------------------------------------------------
[Install.Services]
AddService=%NPF_DriverName%,,NPF_Service_Inst
[NPF_Service_Inst]
DisplayName = %NPF_Desc%
ServiceType = 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1 ;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\%NPF_DriverName%.sys
LoadOrderGroup = NDIS
Description = %NPF_Desc%
AddReg = Common.Params.reg, NdisImPlatformBindingOptions.reg
[Install.Remove.Services]
DelService=%NPF_DriverName%,0x200 ; SPSVCINST_STOPSERVICE
[Common.Params.reg]
[NdisImPlatformBindingOptions.reg]
; By default, when an LBFO team or Bridge is created, all filters will be
; unbound from the underlying members and bound to the TNic(s). This keyword
; allows a component to opt out of the default behavior
; To prevent binding this filter to the TNic(s):
; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,1 ; Do not bind to TNic
; To prevent unbinding this filter from underlying members:
; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,2 ; Do not unbind from Members
; To prevent both binding to TNic and unbinding from members:
; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,3 ; Do not bind to TNic or unbind from Members
HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,0 ; Subscribe to default behavior
[Strings]
NPF_DriverName = "npf"
Insecure = "Nmap Project"
NPF_Desc = "Npcap Packet Driver (NPCAP)"
NPF_HelpText = "A NDIS 6 filter driver & WFP callout driver to support packet capturing and sending under Windows 7, 8 & 10"
A service definition for a host looks like:
service{
name host_1_svc
....
check_command check_xyz!abc
}
A similar check needs to be performed on host2, except that the parameter to the check_command is lmn.
So I have to define:
service{
name host_2_svc
....
check_command check_xyz!lmn
}
What is the general convenient practice to avoid having to define the service over and over again with only a minor change?
Thanks,
Yash
You can define a custom host variable in each of the hosts:
define host{
use generic-host
host_name host1
address 10.0.0.1
_chk_value abc
}
define host{
use generic-host
host_name host2
address 10.0.0.2
_chk_value lmn
}
define service{
use generic-service
name host_chk_svc
host_name host1,host2
check_command check_abc!$_HOSTCHK_VALUE$
}
Note the underscore before the custom variable in the host definition (this defines it as custom), and then underscore at the beginning of the macro, but not in the middle of it ($_HOSTCUSTOM$ rather than $HOST_CUSTOM$).
http://nagios.sourceforge.net/docs/3_0/customobjectvars.html
Define a host group, then add that host to the group and you only need to define the service once.
the relationship between hosts and host groups and services and service groups can be hard to visualise, especially if you don't have a consistent naming scheme for the files in your nagios /etc folder.
Here are two charts i've found which help make sense of it:
a slideshow about vaious network monitoring options: http://www.semintelligent.com/talks/chuug/network-monitoring/#%2827%29
a short but helpful page about Nagios setup: http://www.the-tech-tutorial.com/?p=1433