Nagios Core 4 installation and configuration
The monitoring of essential servers and services is an important part of system administration. This guide walks through how to install and configure Nagios Core 4 for availability monitoring.
The example in this guide uses two servers with hostnames: server01 and server02.
Server01 will be configured with Nagios to monitor services on itself and on server02, while server02 will be configured to send data to server01.
Two users will be created: nagiosadmin with full administrative access, and user nagiosuser with viewing access only.
Installation
Installing nagios core 4 on server01
On server01, install the nagios 4 package and NRPE plugin, by entering the following command into your terminal:
sudo apt install nagios4 nagios-nrpe-plugin
Notes: package will install Postfix by default. You will be prompted for mail server information. If you don’t have a FQDN mail server or want to do the configuration at a later time, you can choose the “No configuration” option, from the Postfix Configuration dialog. See documentation on how to install and configure Postfix. It is also recommended that server01 is setup with a fully qualified domain name (FQDN). Refer to the documentation on how to install and configure DNS. The NRPE plugin package will be used to collect data from server02.
Creating a user for accessing the Nagios web interface
After installation of Nagios 4 on server01, create the nagiosadmin user:
On server01, enter into the terminal:
sudo htdigest -c /etc/nagios4/htdigest.users "Nagios4" nagiosadmin
Notes: the htdigest tool is installed by default by nagios 4 core package. “Nagios4” here is the realm argument provided in directive AuthName in the /etc/nagios4/apache2.conf file. More information on this will be provided later when we configure the nagios server on server01. Use the -c only when creating the user for the first time. For more information on the htdigest tool see Nagios CGI security documentation.
Moving on to server02.
Installing nagios-nrpe-server on server02
Next, on server02 install the nagios-nrpe-server package. From a terminal on server02 enter:
sudo apt install nagios-nrpe-server
Notes: NRPE allows you to execute local checks on remote hosts. There are other ways of accomplishing this through other Nagios plugins, as well as other checks.
Back on server01.
Configuring the Nagios server.
Configuration overview
Before starting to configure the Nagios server it is important to understand the location of directories containing Nagios configuration and check files.
Nagios.
/etc/nagios4: Contains configuration files for the operation of the Nagios daemon. Most of the maintenance of the Nagios server will be performed at this location. This directory contains user authentication file htdigest.users, custom configuration directory conf.d and objects directory.
/etc/nagios-plugins/config: Contains configuration files for the service checks.
/etc/nagios: On the remote host, contains the nagios-nrpe-server configuration files.
Apache.
Apache files are located in /etc/apache2 directory.
Configuration Steps
Enabling authentication
As a first step in the configuration, on Server01, to use digest authentication, use_authentication default setting must be changed. Edit file /etc/nagios4/cgi.cfg and change directive
use_authentication=0
to
use_authentication=1
Save file and close.
Apache configuration for nagios
The Apache configuration for Nagios involves editing the default configuration apache2.conf file provide in /etc/nagios4, and enabling the web interface in Apache2. It is a good idea to create a copy of this file before working on it, so you can have the original file saved for reference. You can achieve this on server01, by running from terminal:
sudo cp /etc/nagios4/apache2.conf /etc/nagios4/apache2.conf.orig
On the next step, edit /etc/nagios4/apache2.conf to complete the digest authentication configuration for the Nagios web interface. Edit file /etc/nagios4/apache2.conf file, and change the following lines:
Comment out the Require ip directive (add a # in front of it):
#Require ip ::1/128 fc00::/7 fe80::/10 10.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16
This line was enabled by default, to only allow private IP addresses access. If that is what you need, then leave un-commented.
Inside the <Files "cmd.cgi">
block, change or add the Require all granted and Require valid-user directives. Comment out the Require all granted directive and un-comment Require valid-user. This directive forces user authentication; which is necessary to issue commands, such as silence notifications.
<Files "cmd.cgi">
Options ExecCGI
AuthDigestDomain "Nagios4"
AuthDigestProvider file
AuthUserFile "/etc/nagios4/htdigest.users"
AuthGroupFile "/etc/group"
AuthName "Nagios4"
AuthType Digest
#Require all granted
Require valid-user
</Files>
Forcing All users to authenticate.
The next step is going to force ALL users to authenticate.
Comment out the following two lines:
#<Files "cgi.cmd">
and its closing bracket:
#</Files>
This has the effect of moving all directives that were inside the <Files>
block, to the <DirectoryMatch>
block and therefore, enforcing all users to authenticate against the matched directories paths expressed in the regex pattern.
Apache configuration file for Nagios is now configured.
Save and close the file.
Notes: the Alias /nagios4, in directive Alias /nagios4 /usr/share/nagios4/htdocs
can be changed to be anything you need. This is how you would reach the nagios interface from the browser. In this setup, you would enter into the browser: server01/nagios4. For more information on the topic of authentication and authorization, see both, Apache’s documentation and Nagios’s documentation. If you need granulated access for users, use the /etc/nagios4/cgi.cfg file to define the access the user is authorized for.
Nagios Web Interface
At this point, the web interface is not working as intended.
Still working on server01, copy the /etc/nagios4/apache2.conf file to the /etc/apache2/sites-available directory. From the terminal run:
sudo cp /etc/nagios4/apache2.conf /etc/apache2/sites-available/nagios4.conf
Then enable the configuration. From terminal enter:
sudo a2ensite nagios4.conf
Nagios web interface apache site is now enabled. It is time to reload both Apache2 and Nagios to apply configuration changes. From terminal enter:
sudo systemctl reload apache2
then enter:
sudo systemctl reload nagios4
Check the status of Nagios and Apache2. Examine output for any errors. From terminal run:
sudo systemctl status apache2
then run:
sudo systemctl status nagios4
If both are active(running) and no errors are reported, then the web interface can be tested.
Notes: For information on how to configure Apache2, please refer to the how-to configure Apache2 documentation.
Modifying the Nagios Apache site
At this point, the Nagios site can be tested. From a browser enter: server01/nagios4 and press Enter. Alternatively, if the hostname does not resolve to DNS, enter the ip address: 172.10.100.1/nagios4. Replace the ip address, with the ip address of your Nagios server. You will asked to authenticate. Login as the user nagiosadmin that was created earlier. You will notice that under hosts, only the localhost is being monitored. More on working with objects later.
To illustrate making modifications to the Nagios site, landing server01/nagios4 is going to be changed to server01/nagios.
On server01, edit file /etc/nagios4/apache2.conf. Change the line:
Alias /nagios4 /usr/share/nagios4/htdocs
to
Alias /nagios /usr/share/nagios4/htdocs
Save file and quit.
To activate change, disable the nagios4 site first. Enter into terminal:
sudo a2dissite nagios4
Then copy the /etc/nagios4/apache2.conf file to the /etc/apache2/sites-available directory. From the terminal run:
sudo cp /etc/nagios4/apache2.conf /etc/apache2/sites-available/nagios4.conf
Enable the configuration. From terminal enter:
sudo a2ensite nagios4.conf
And reload Apache2:
sudo systemctl reload apache2
To test the change, enter into a browser: server01/nagios.
Notes: you can directly edit the /etc/apache2/sites-enabled/nagios4.conf file and then reload Apache2, without disabling the site first, but this makes it harder to keep track of changes and restoring to a working state, in case something goes wrong. It is a good idea to always backup the file before making any changes, so you can quickly restore from it, in case of issues.
Working with Nagios users
So far, the only user with access to nagios is nagiosadmin. In the next steps, a nagiosuser will be created and configured to have viewing access to nagios. On server01, enter in the terminal:
sudo htdigest -c /etc/nagios4/htdigest.users "Nagios4" nagiosuser
At this point, nagiosuser is created but no access has been defined. To define access, edit file /etc/nagios4/cgi.cfg and change the following line:
authorized_for_system_information=nagiosadmin
to
authorized_for_system_information=nagiosadmin, nagiosuser
To allow user to view global hosts and services, define access by changing these lines:
authorized_for_all_services=nagiosadmin
authorized_for_hosts=nagiosadmin
to
authorized_for_all_services=nagiosadmin, nagiosuser
authorized_for_all_hosts=nagiosadmin, nagiosuser
Save file and quit.
Reload the nagios configuration:
sudo systemctl reload nagios4
To test, navigate in a browser to server01/nagios and login as user nagiosuser. Click on Hosts, Services links. You should be able to view both. Then look for System, Configuration links. When trying to access the Configuration, a no permission to view information message should be displayed.
Notes: When using the htdigest utility, use the -c only when first creating a user. Omit the -c to change password afterwards. The /etc/nagios4/cgi.cfg has many options. Review file for usage.
Working with resource objects
Objects are definitions files for each one of the resources available in Nagios. Files are located in the /etc/nagios4/objects directory.
By default, the Nagios 4 package installs the standard nagios monitoring plugins. These are located in directory /usr/lib/nagios/plugins. So far, the checks defined for the localhost in file /etc/nagios4/objects/localhost.cfg, make use of these plugins. By default, Nagios is configured to check HTTP, disk space, SSH, current users, processes, and load on the localhost; as well as ping check the gateway.
Creating host config file for server02
To create host config file for server02, on server01, type into terminal:
sudo cp /etc/nagios4/objects/localhost.cfg /etc/nagios4/conf.d/server02.cfg
Then, edit file /etc/nagios4/conf.d/server02.cfg. Change the host definition. Replace address with the ip address of server02. On existing definitions, replace host_name with server02.
define host {
use generic-host ;Name of host template to use
host_name server02 ;This host definition will inherit all variables that are defined
alias server 02 ;in (or inherited by) the linux-server host template definition.
address 172.10.100.2
}
Also add a DNS check service definition. Add these lines:
# Define a DNS check service on server02
define service {
use local-service
host_name server02
service_description DNS
check_command check_dns
notification_enabled 0
}
Save the file and exit.
Notes: when copying resource files to use as templates, be aware that this can create duplicate definitions. When you run a pre-flight check described in next section, errors and warnings will be reported. To avoid this, comment out the duplicate definitions.
Before restarting the Nagios server, test the configuration.
Testing the Nagios configuration and troubleshooting
When you make changes to the Nagios configuration, you can test the configuration before it is enabled. This way you can make the necessary changes, in case of errors, before restarting the Nagios server.
Still on server01, enter into the terminal:
sudo nagios4 -v /etc/nagios4/nagios.cfg
If no errors are found, restart the nagios server. In the terminal enter:
sudo systemctl restart nagios4
Hostgroup definitions
Now create a hostgroup definition, which is used to group one or more hosts together for easier configuration. In this step you will create a service definition for the MySQL check and a MySQL hostgroup definition. To install the MySQL server, you can run into a terminal:
sudo apt install mysql-server
Notes: For instructions on installing MySQL see MySQL documentation. See also useful MYSQL tutorial by tutorials24x7.com. Check as well MySQL website documentation. Also check the man pages for MySQL. For the purpose of this guide, MySQL server has been installed on server02.
Add a service definition for the MySQL check and the hostgroup mysql-servers definition
Add a service definition to the file /etc/nagios4/conf.d/services_nagios2.cfg:
#check MySQL servers
define service {
hostgroup_name mysql-servers
service_description MySQL
check_command check_mysql_cmdlinecred!nagios!secret!$HOSTADRESS
use generic-service
notification_interval 0; set > 0 to be re-notified
}
Add the mysql-servers definition. Edit /etc/nagios4/conf.d/hostgroups_nagios2.cfg:
#MySQL group definition
define hostgroup {
hostgroup_name mysql-servers
alias MySQL servers
members localhost, server02
}
Nagios user authentication to MySQL
The Nagios check needs to authenticate to MySQL. Add a nagios user to MySQL. On server02, enter into the terminal:
mysql -u root -p -e "create user nagios identified by 'secret';"
Alternatively, you can login to MySQL and create the nagios user. Replace secret with a password.
sudo mysql -u root -p
mysql> CREATE USER 'nagios' IDENTIFIED BY 'secret';
mysql> flush privileges;
mysql> exit
Notes: The nagios user will need to be added to all hosts in the mysql-servers hostgroup.
Restart nagios to start checking the MySQL servers. On server01, enter into the terminal:
sudo systemctl restart nagios4
NRPE Configuration
As a last step, configure NRPE to check disk space on server02.
On server01, add the service check to /etc/nagios4/conf.d/server02.cfg:
#NRPE disk check
define service {
use generic-service
host_name server02
server_description nrpe-disk-check
check_command check_nrpe_1arg!check_all_disks!172.10.100.2
}
On server02, edit /etc/nagios/nrpe.cfg changing:
allowed_hosts=172.10.100.1
Below, in the command definition area, add:
command[check_all_disks]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -e
While on server02, restart nagios-nrpe-server:
sudo systemctl restart nagios-nrpe-server.service
Finally, on server01 restart Nagios:
sudo systemctl restart nagios4
Further reading and research
This guide was meant to serve as a stepping stone into Nagios Core 4. There are many more Nagios’ features and uses not covered here. There are many resources and tutorials available online. Some are listed below. This guide made usage of previous installation instructions for Nagios Core 3 for guidance to match format. Research links are listed below.
- For more information about Nagios and its features, visit the Nagios website.
- Also the Nagios Core Documentation and Nagios Core 4 Documentation.
- Nagios website also offers a list of books related to Nagios, its administration and monitoring.