Nagios Log Server Data Sources: What Else Can You Feed It?

Most people point Nagios Log Server at Windows Event Logs and Linux syslog and move on, but Log Server data sources can include almost anything that produces text. So it’s fair to ask: What else can you feed it? Short answer: anything you can get flowing into an input, whether it’s a standard log source or some creatively repurposed feed. 

Options for Incoming Log Server Data Sources 

Event Logs 

Start with the obvious: Windows Event Logs (via NXLog), security events, and application event streams. These are the bread and butter of correlation and compliance, and they are the easiest win for alerting on specific event IDs. You can find more information in the Admin Guide:

Sending Windows Logs To Nagios Log Server 

System Logs 

Linux/UNIX syslog, network device logs from switches and firewalls, and OS-level messages. Pointing the rsyslog daemon at the Log Server TCP/UDP input is a one-line config change on the sending host. This section of the Admin Guide shows how to monitor a new log source:

Monitoring A New Log Source

Get Creative With Custom Feeds 

This is where thinking outside of the box comes in handy. Log Server data sources don’t have to be logs at all. You can use Log Server as a general-purpose event pipeline. Since Log Server indexes and stores any text that comes in, you can just script a small poller to pull RSS, HTTP, or JSON feeds and push them in as regular log events.

Install Logstash RSS Plugin

Before adding an RSS feed, install the Logstash RSS input plugin from shell:

sudo /usr/local/nagioslogserver/logstash/bin/logstash-plugin install logstash-input-rss logstash-filter-xml

sudo /usr/local/nagioslogserver/logstash/bin/logstash-plugin install logstash-input-rss logstash-filter-xml

Configure Input

Next, log in to your Log Server and go to Admin > Logstash Configuration > Global Config, click the Add Input button, and add a new input with the feed URL and polling interval. Click Verify then Save.

For detailed steps on configuring inputs, see Nagios Log Server Configuring Inputs.

Logstash Input:

rss {
    id => "noaa-weather-obs"
    url => "https://forecast.weather.gov/xml/current_obs/KSTP.rss"
    interval => 200
    tags => ["noaa", "weather", "data"]
  }

rss {
    id => "noaa-weather-obs"
    url => "https://forecast.weather.gov/xml/current_obs/KSTP.rss"
    interval => 200
    tags => ["noaa", "weather", "data"]
  }

interval sets how often, in seconds, Log Server checks the feed. tags labels the events so you can filter and search for them.

Configure Filter

Next, set up a filter to parse the log data and turn it into something structured and queryable.

For detailed steps on configuring filters, see Nagios Log Server Configuring Input Filters.

Logstash Filter:

mutate {
    gsub => [
      "message",
      '<img[^>]*>.*?<br\s*/?>\s*\n?',
      ''
    ]
  }

  grok {
    match => {
    "title" => "%{WORD:condition} and %{NUMBER:temperature} %{WORD:unit} at %{GREEDYDATA:location}"
  }
  }

mutate {
    gsub => [
      "message",
      '<img[^>]*>.*?<br\s*/?>\s*\n?',
      ''
    ]
  }

  grok {
    match => {
    "title" => "%{WORD:condition} and %{NUMBER:temperature} %{WORD:unit} at %{GREEDYDATA:location}"
  }
  }

Example Dashboard Results

Ideas to Poll and Why 

Conclusion

Your Log Server data sources don’t have to stop at syslog. Nagios Log Server is a general-purpose ingestion and indexing engine, so anything with a text representation, such as structured logs, JSON, or RSS and Atom feeds, can become a queryable, alertable, archived stream. Those creative feeds aren’t a gimmick; they prove the input layer is genuinely open. Found an unusual data source that works? Share it with the Nagios Community on r/nagios, or tag us on LinkedIn or Facebook.