This guide will walk you through configuring Arch Linux 2023 to forward logs using rsyslog, enabling seamless integration with Nagios Log Server for enhanced monitoring and troubleshooting.

Note: Arch Linux’s rolling-release model means no fixed “2023” version exists; this guide assumes a system updated to March 2025 packages.

Prerequisites

Before proceeding, ensure you have the following:

• Access to a Nagios Log Server instance (latest stable release recommended)
• A system running Arch Linux 2023
• Root or sudo privileges on your Arch machine
• Network connectivity between Arch Linux and Nagios Log Server (ensure port 5544 is open)

Step 1: Add a New Log Source in Nagios Log Server

1. Login to Nagios Log Server:
   • Open your web browser and navigate to your Nagios Log Server instance.
   • Log in using your administrator credentials.
2. Navigate to Log Source Setup:
   • On the Home page, locate the + button in the left sidebar .

3. click Click the + button in the left sidebar and the one at the bottom > select Linux.

Step 2: Configuring the Linux Log Source

1. Download and Run the Setup Script

The Linux Source Setup page provides a code block with a pre-configured command.

If curl is not installed, run:

sudo pacman -Syu curl

sudo pacman -Syu curl

Then, run the following command (replace <nagios-log-server-address> with your actual server IP or hostname):

curl -sS -O http://<nagios-log-server-address>/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s <nagios-log-server-address> -p 5544

curl -sS -O http://<nagios-log-server-address>/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s <nagios-log-server-address> -p 5544

• -s specifies the Log Server address
• -p 5544 is the default port for syslog ingestion

Example Output:

curl -sS -O http://192.168.0.123/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.123 -p 5544

curl -sS -O http://192.168.0.123/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.123 -p 5544

2. Verify the Script Execution

You should see an output like:

Detected rsyslog 8.2402.0
Detected rsyslog work directory /var/spool/rsyslog
Destination Log Server: 192.168.0.31:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
rsyslog configuration check passed.
Restarting rsyslog service...
rsyslog is running with the new configuration.
Check the Nagios Log Server dashboard to confirm logs.

Detected rsyslog 8.2402.0
Detected rsyslog work directory /var/spool/rsyslog
Destination Log Server: 192.168.0.31:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
rsyslog configuration check passed.
Restarting rsyslog service...
rsyslog is running with the new configuration.
Check the Nagios Log Server dashboard to confirm logs.

• Note: Arch uses /var/spool/rsyslog and systemctl, not service. SELinux is not present.
• If errors occur, verify connectivity and port 5544.
• Check the Nagios Log Server dashboard to confirm that logs are being received.

Step 3: Configure Firewall

Arch has no default firewall. If using iptables:

sudo pacman -S iptables
sudo iptables -I INPUT -p tcp --dport 5544 -j ACCEPT
sudo iptables-save > /etc/iptables/iptables.rules

sudo pacman -S iptables
sudo iptables -I INPUT -p tcp --dport 5544 -j ACCEPT
sudo iptables-save > /etc/iptables/iptables.rules

Or, if using ufw (optional):

sudo pacman -S ufw
sudo ufw allow 5544/tcp
sudo ufw enable

sudo pacman -S ufw
sudo ufw allow 5544/tcp
sudo ufw enable

Verify:

sudo iptables -L -n

sudo iptables -L -n

Step 4: Confirming Log Reception

1. In Nagios Log Server, go to Dashboards > Search.
2. In the Search panel, run a query for the new source IP:

host.ip:<Arch Linux 2023 IP>

host.ip:<Arch Linux 2023 IP>

3. Send a test log entry from the Linux machine:

logger "This is a test log entry"

logger "This is a test log entry"

If successful, the test entry will appear in the results.

Step 5: Accessing the Setup Script on the Server

The script is stored on the Nagios Log Server here:

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

This script can be accessed directly via a browser or edited via SSH for custom changes.

Step 6: Manual Setup (Optional)

If you prefer to configure manually:

1. Create a configuration file:

sudo nano /etc/rsyslog.conf

sudo nano /etc/rsyslog.conf

2. Add this line (replace with your Nagios Log Server IP):

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.113:5544
# ### end of the forwarding rule ###

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.113:5544
# ### end of the forwarding rule ###

3. Restart rsyslog:

sudo /etc/init.d/rsyslog restart

sudo /etc/init.d/rsyslog restart

Step 7: Adding More Log Sources

Use the + Add Log Source button to configure additional sources such as:

• Windows Event Logs
• Application Logs
• Archived Log Files

Both scripted and manual setup options are available. Manual setup allows for deeper customization by editing config files directly.

Troubleshooting Tips

1. Check rsyslog Status:

sudo systemctl status rsyslog

sudo systemctl status rsyslog

Start it if it’s not running:

sudo systemctl start rsyslog

sudo systemctl start rsyslog

2. Check Connectivity: Ensure port 5544 is open and reachable.
3. Check Firewall:

sudo ufw allow 5544/tcp

sudo ufw allow 5544/tcp

4. Review Logs:

cat /var/log/syslog | grep rsyslog

cat /var/log/syslog | grep rsyslog

On Nagios Log Server:

tail -f /var/log/logserver/nagios.log

tail -f /var/log/logserver/nagios.log

Conclusion

You’ve successfully configured Arch Linux 2023 to forward logs to Nagios Log Server 2024R2. This setup gives you real-time visibility into system logs, performance events, and security data—essential for proactive system administration.

Explore additional sources and alerting options in Nagios Log Server for an even more powerful monitoring setup.

For additional resources:

• Nagios Knowledgebase
• Nagios Support Forum
• Nagios Library

In this guide, we’ll walk you through the step-by-step process of installing and configuring SNMP on Arch Linux 2023, enabling seamless integration with Nagios XI for proactive monitoring and efficient system management.

Prerequisites

Before proceeding, ensure you have:

• A system running Arch Linux 2023 with root or sudo privileges.
• Nagios XI installed and accessible, with the SNMP Wizard enabled.
• A stable internet connection for package downloads.

Step 1: Install SNMP on Arch Linux 2023

To install SNMP and the required libraries, update the system first:

sudo pacman -Syu

sudo pacman -Syu

Then, install net-snmp:

sudo pacman -S net-snmp

sudo pacman -S net-snmp

Verify the installation:

snmpd -v

snmpd -v

This confirms that SNMP is correctly installed on the system.

Step 2: Configure SNMP Access

SNMP v2c Configuration

To configure SNMP v2c, create a backup of the existing configuration:

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

Now, edit the SNMP configuration file:

sudo nano /etc/snmp/snmpd.conf

sudo nano /etc/snmp/snmpd.conf

Find and modify the following line to define the community string and allow access from your Nagios XI server (replace Str0ngC0mmunity with your desired community string and 10.25.5.12 with your Nagios XI server’s IP address):

rocommunity Str0ngC0mmunity 10.25.5.12

rocommunity Str0ngC0mmunity 10.25.5.12

Save the file and restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

SNMP v3 Configuration (More Secure)

To configure SNMP v3, create an SNMP user with authentication and encryption:

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

• -a SHA → Specifies SHA for authentication (MD5 is also supported but less secure).
• -x AES → Enables AES encryption (DES is another option but less secure).

Restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Step 3: Configure Firewall Rules

Arch Linux lacks a default firewall. If using iptables:

sudo iptables -I INPUT -p udp --dport 161 -j ACCEPT
sudo iptables-save > /etc/iptables/iptables.rules

sudo iptables -I INPUT -p udp --dport 161 -j ACCEPT
sudo iptables-save > /etc/iptables/iptables.rules

For firewalld (optional, install with sudo pacman -S firewalld):

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

Confirm firewall rules:

sudo iptables -L -n

sudo iptables -L -n

Step 4: Enable SNMP Service on Boot

To ensure SNMP starts automatically at boot, run:

sudo systemctl enable snmpd.service

sudo systemctl enable snmpd.service

Step 5: Test SNMP Communication

To test if SNMP is responding correctly, run the following commands from your Nagios XI server.

For SNMP v2c:

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

For SNMP v3:

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

Expected Output (Example)

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 6.1.0-arch1-1 x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 6.1.0-arch1-1 x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

If the command does not return data, review SNMP configuration and firewall settings.

Step 6: Add Arch Linux 2023 Host to Nagios XI Using SNMP Wizard

1. Log in to Nagios XI.

2. Navigate to Configure > Run a configuring wizard.

3. Search for and select Linux SNMP wizard.

4. Enter the Arch Linux 2023 server’s IP address and SNMP credentials.

5. Click Next, select the system metrics to monitor (CPU, memory, disk, network traffic, etc.).

6. Apply the configuration and verify that Nagios XI is collecting SNMP data.

Common Issues & Fixes

SNMP Service is Not Running

Check logs for errors:

sudo journalctl -u snmpd --no-pager | tail -20

sudo journalctl -u snmpd --no-pager | tail -20

Restart SNMP if necessary:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Host Appears “Down” in Nagios XI

• Check firewall rules: sudo ufw status
• Ensure SNMP is running: sudo systemctl status snmpd
• Verify Nagios XI configuration

Incorrect SNMP Credentials Error

• Confirm the correct community string (SNMP v2c) or authentication details (SNMP v3).
• Restart the SNMP service after changes.

Conclusion

You have successfully installed and configured SNMP on Arch Linux 2023 for monitoring with Nagios XI. This setup provides a robust, agentless solution for tracking system performance metrics and ensuring proactive issue resolution.

For further assistance, refer to the Nagios Support Forum or the Nagios Knowledgebase.

This guide provides detailed instructions on how to install and configure NCPA on Arch Linux 2023, enabling you to monitor key system metrics, track resource usage, and resolve issues before they impact performance.

Note: NCPA lacks an official Arch Linux package. This guide adapts an RHEL-compatible RPM or source build, verified as of March 2025.

Prerequisite

Before proceeding, ensure you have:

• A system running Arch Linux 2023 with root or sudo privileges.
• Nagios XI installed and accessible, with the NCPA Wizard enabled.
• A stable internet connection for package downloads.

Step 1: Install Required Dependencies

NCPA requires Python and additional libraries. Install them:

sudo pacman -S python python-pip openssl base-devel
pip install requests pyOpenSSL --user

• base-devel: For building from source if needed.
• requests, pyOpenSSL: Python modules NCPA may require.

Step 2: Download and Install NCPA

Nagios doesn’t provide an Arch-specific NCPA package, so we’ll use an RHEL 8 RPM or build from source.

Option 1: Install via RPM (Recommended)

Download the latest EL8 RPM:

cd /tmp
wget https://assets.nagios.com/downloads/ncpa/ncpa-latest-1.x86_64.rpm

Convert and install with rpm2cpio and cpio (since Arch uses pacman, not rpm):

rpm2cpio ncpa-latest-1.x86_64.rpm | cpio -idmv
sudo cp -r usr/local/ncpa /usr/local/

Note: Check nagios.com/ncpa for the latest version (e.g., replace 3.1.1).

Option 2: Build from Source (Alternative)

If the RPM fails (e.g., due to library mismatches):

cd /tmp
git clone https://github.com/NagiosEnterprises/ncpa.git
cd ncpa
sudo ./build.sh install

This installs NCPA to /usr/local/ncpa.

Step 3: Configure NCPA

After installation, configure NCPA by editing its configuration file to set your API token:

sudo nano /usr/local/ncpa/etc/ncpa.cfg

Find the line:

community_string = mytoken

Replace mytoken with a secure API token of your choice.

Save the file (CTRL + X, then Y, and Enter).

Step 4: Enable and Start the NCPA Service

The RPM/source install doesn’t create a systemd service by default. Create one:

sudo nano /etc/systemd/system/ncpa.service

Add:

[Unit]
Description=Nagios Cross-Platform Agent
After=network.target

[Service]
ExecStart=/usr/local/ncpa/ncpa_listener --config /usr/local/ncpa/etc/ncpa.cfg
Restart=always

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable ncpa
sudo systemctl start ncpa

Verify:

sudo systemctl status ncpa

Step 5: Configure Firewall Rule

If UFW or another firewall is enabled on your system, allow traffic on port 5693 (default NCPA port):

sudo ufw allow 5693/tcp
sudo ufw reload

For iptables, run:

sudo iptables -I INPUT -p tcp --dport 5693 -j ACCEPT
sudo iptables-save > /etc/iptables/iptables.rules

Confirm firewall rules:

sudo iptables -L -n

Step 6: Test NCPA Installation

After configuring the firewall, confirm that NCPA is accessible by navigating to:

https://<NCPA_IP_Address>:5693/

Since NCPA uses a self-signed certificate, your browser may display a warning. Click Advanced > Proceed to continue.

You should see the NCPA login page. Enter the API token you configured earlier and click Log In.

Step 7: Add Arch Linux 2023 Host to Nagios XI Using NCPA Wizard

1. Log in to Nagios XI.

2. Navigate to Configure > Run a configuring wizard.

3. Search for and select NCPA.

4. Enter the Arch Linux 2023 server’s IP address and API token.

5. Click Next, select the system metrics to monitor (CPU, memory, disk, network traffic, etc.).

6. Apply the configuration and verify that Nagios XI is collecting data.

Common Issues & Fixes

NCPA Service is Not Running

Check logs for errors:

sudo journalctl -u ncpa --no-pager | tail -20

Restart NCPA if necessary:

sudo systemctl restart ncpa

Host Appears “Down” in Nagios XI

• Check firewall rules: sudo ufw status
• Ensure NCPA is running: sudo systemctl status ncpa
• Verify Nagios XI configuration

Incorrect API Token Error

• Confirm the correct API token is set in ncpa.cfg
• Restart the NCPA service after changes

Conclusion

You have successfully installed and configured NCPA on Arch Linux 2023 for monitoring with Nagios XI. This setup allows efficient tracking of system performance metrics and ensures proactive issue resolution.

For further assistance, refer to the Nagios Support Forum or the Nagios Knowledgebase.