This guide will take you through the step-by-step process of configuring Fedora 40 to forward its logs using rsyslog, ensuring seamless integration with Nagios Log Server for enhanced monitoring and real-time log analysis.

Prerequisites

Before proceeding, ensure you have the following:

• A running Nagios Log Server 2024R2 instance.
• A system running Fedora 40
• Root or sudo privileges on your Fedora machine
• Network connectivity between Fedora and Nagios Log Server (ensure port 5544 is open)

Step 1: Add a New Log Source in Nagios Log Server

1. Login to Nagios Log Server:
   • Open your web browser and navigate to your Nagios Log Server instance.
   • Log in using your administrator credentials.
2. Navigate to Log Source Setup:
   • On the Home page, locate the + button in the left sidebar, the one at the bottom.

3. Click the + button in the left sidebar and select Linux.

Step 2: Configuring the Linux Log Source

1. Download and Run the Setup Script

The Linux Source Setup page provides a code block with a pre-configured command.

If curl is not installed, run:

sudo dnf install -y curl

sudo dnf install -y curl

Then, run the following command (replace <nagios-log-server-address> with your actual server IP or hostname):

curl -sS -O http://<nagios-log-server-address>/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s <nagios-log-server-address> -p 5544

curl -sS -O http://<nagios-log-server-address>/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s <nagios-log-server-address> -p 5544

• -s specifies the Log Server address
• -p 5544 is the default port for syslog ingestion

Example output:

curl -sS -O http://192.168.0.31/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.31 -p 5544

curl -sS -O http://192.168.0.31/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.31 -p 5544

2. Verify the Script Execution

You should see an output like:

Detected rsyslog 8.x
Detected rsyslog work directory /var/lib/rsyslog
Destination Log Server: 192.168.0.31:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
rsyslog is running with the new configuration.

Detected rsyslog 8.x
Detected rsyslog work directory /var/lib/rsyslog
Destination Log Server: 192.168.0.31:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
rsyslog is running with the new configuration.

Check the Nagios Log Server dashboard to confirm that logs are being received.

Step 3: Confirming Log Reception

1. Navigate to the Dashboards section in Nagios Log Server.
2. In the Search panel, run a query for the new source IP:

host.ip:<Fedora 40 IP>

host.ip:<Fedora 40 IP>

3. Send a test log entry from the Linux machine:

logger "This is a test log entry"

logger "This is a test log entry"

If successful, the test entry will appear in the results.

Step 4: Accessing the Setup Script on the Server

The script is stored on the Nagios Log Server here:

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

This script can be accessed directly via a browser or edited via SSH for custom changes.

Step 5: Manual Setup (Optional)

If you prefer to configure manually:

1. Create a configuration file:

sudo nano /etc/rsyslog.conf

sudo nano /etc/rsyslog.conf

2. Add this line (replace with your Nagios Log Server IP):

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.113:5544
# ### end of the forwarding rule ###

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.113:5544
# ### end of the forwarding rule ###

3. Restart rsyslog:

sudo /etc/init.d/rsyslog restart

sudo /etc/init.d/rsyslog restart

Video Tutorial

Enhance your understanding with this step-by-step walkthrough:

Step 6: Adding More Log Sources

Use the + Add Log Source button to configure additional sources such as:

• Windows Event Logs
• Application Logs
• Archived Log Files

Both scripted and manual setup options are available. Manual setup allows for deeper customization by editing config files directly.

Troubleshooting Tips

1. Check rsyslog Status:

sudo systemctl status rsyslog

sudo systemctl status rsyslog

Start it if it’s not running:

sudo systemctl start rsyslog

sudo systemctl start rsyslog

2. Check Connectivity: Ensure port 5544 is open and reachable.
3. Check Firewall:

sudo firewall-cmd --zone=public --add-port=5544/tcp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=5544/tcp --permanent
sudo firewall-cmd --reload

4. Review Logs:

cat /var/log/messages | grep rsyslog

cat /var/log/messages | grep rsyslog

On Nagios Log Server:

tail -f /var/log/logserver/nagios.log

tail -f /var/log/logserver/nagios.log

Conclusion

You’ve successfully configured Fedora 40 to forward logs to Nagios Log Server 2024R2. This setup gives you real-time visibility into system logs, performance events, and security data—essential for proactive system administration.

Explore additional sources and alerting options in Nagios Log Server for an even more powerful monitoring setup.

For additional resources:

• Nagios Knowledgebase
• Nagios Support Forum
• Nagios Library

In this guide, we’ll walk you through the step-by-step process of installing and configuring SNMP on Fedora 40, ensuring smooth integration with Nagios XI for seamless system monitoring and proactive issue detection.

Prerequisites

Before proceeding, ensure you have:

• A Fedora 40 system with root or sudo privileges.
• Nagios XI installed and accessible, with the SNMP Wizard enabled.
• A stable internet connection for package downloads.

Step 1: Install SNMP on Fedora 40

To install SNMP and the required libraries, run:

sudo dnf install net-snmp net-snmp-utils -y

sudo dnf install net-snmp net-snmp-utils -y

After installation, verify the installed version:

snmpd -v

snmpd -v

This ensures that SNMP is correctly installed on the system.

Step 2: Configure SNMP Access

SNMP v2c Configuration

To configure SNMP v2c, create a backup of the existing configuration:

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

Now, edit the SNMP configuration file:

sudo nano /etc/snmp/snmpd.conf

sudo nano /etc/snmp/snmpd.conf

Find and modify the following line to define the community string and allow access from your Nagios XI server (replace Str0ngC0mmunity with your desired community string and 10.25.5.12 with your Nagios XI server’s IP address):

rocommunity Str0ngC0mmunity 10.25.5.12

rocommunity Str0ngC0mmunity 10.25.5.12

Save the file and restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

SNMP v3 Configuration (More Secure)

To configure SNMP v3, create an SNMP user with authentication and encryption:

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

• -a SHA → Specifies SHA for authentication (MD5 is also supported but less secure).
• -x AES → Enables AES encryption (DES is another option but less secure).

Restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Step 3: Configure Firewall Rules

If firewalld is enabled on your system, allow SNMP traffic on UDP port 161:

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

Confirm firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

Step 4: Enable SNMP Service on Boot

To ensure SNMP starts automatically at boot, run:

sudo systemctl enable snmpd.service

sudo systemctl enable snmpd.service

Step 5: Test SNMP Communication

To test if SNMP is responding correctly, run the following commands from your Nagios XI server.

For SNMP v2c:

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

For SNMP v3:

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

Expected Output (Example)

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 6.5.0-10.fc40.x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 6.5.0-10.fc40.x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

If the command does not return data, review SNMP configuration and firewall settings.

Step 6: Add Fedora 40 Host to Nagios XI Using SNMP Wizard

1. Log in to Nagios XI.

2. Navigate to Configure > Run a configuring wizard.

3. Search for and select Linux SNMP wizard.

4. Enter the Fedora 40 server’s IP address and SNMP credentials.

5. Click Next, select the system metrics to monitor (CPU, memory, disk, network traffic, etc.).

6. Apply the configuration and verify that Nagios XI is collecting SNMP data.

Common Issues & Fixes

SNMP Service is Not Running

Check logs for errors:

sudo journalctl -u snmpd --no-pager | tail -20

sudo journalctl -u snmpd --no-pager | tail -20

Restart SNMP if necessary:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Host Appears “Down” in Nagios XI

• Check firewall rules: sudo firewall-cmd --list-ports
• Ensure SNMP is running: sudo systemctl status snmpd
• Verify Nagios XI configuration

Incorrect SNMP Credentials Error

• Confirm the correct community string (SNMP v2c) or authentication details (SNMP v3).
• Restart the SNMP service after changes.

Conclusion

You have successfully installed and configured SNMP on Fedora 40 for monitoring with Nagios XI. This setup provides a robust, agentless solution for tracking system performance metrics and ensuring proactive issue resolution.

For further assistance, refer to the Nagios Support Forum or the Nagios Knowledgebase.

In this guide, we’ll walk you through the step-by-step installation and configuration of NCPA on Fedora 40, enabling efficient and comprehensive monitoring through Nagios XI.

Step 1: Installing NCPA on Fedora 40

Since Fedora 40 is not explicitly listed in the official NCPA documentation, we will install NCPA manually using the latest available RPM package.

1.1 Download the NCPA RPM Package

Start by downloading the latest NCPA package for Fedora-compatible systems.

cd /tmp
wget https://assets.nagios.com/downloads/ncpa3/ncpa-latest.el7.x86_64.rpm

cd /tmp
wget https://assets.nagios.com/downloads/ncpa3/ncpa-latest.el7.x86_64.rpm

1.2 Install the RPM Package

Use the dnf package manager to install the downloaded package.

sudo dnf install ./ncpa-latest.el7.x86_64.rpm -y

sudo dnf install ./ncpa-latest.el7.x86_64.rpm -y

1.3 Verify Installation

Check the installed version:

rpm -q ncpa

rpm -q ncpa

Expected output: ncpa-3.1.1-1.el8.x86_64.

1.4 Start and Enable NCPA Service

Once installed, start the NCPA Listener service and enable it to run at boot.

sudo systemctl start ncpa_listener
sudo systemctl enable ncpa_listener

sudo systemctl start ncpa_listener
sudo systemctl enable ncpa_listener

Note: The service is typically ncpa, not ncpa_listener. Verify with systemctl list-units | grep ncpa.

Step 2: Configuring NCPA

After installation, configure NCPA to allow Nagios XI to communicate with it.

2.1 Set Up Authentication Token

Edit the NCPA configuration file to define an authentication token.

sudo nano /usr/local/ncpa/etc/ncpa.cfg

sudo nano /usr/local/ncpa/etc/ncpa.cfg

Locate the following line:

community_string = mytoken

community_string = mytoken

Replace with a strong, unique token (e.g., K9pL3mX7vR2tQ8nJ):

community_string = K9pL3mX7vR2tQ8nJ

community_string = K9pL3mX7vR2tQ8nJ

Save and exit (Ctrl+O, Enter, Ctrl+X).

2.2 Restart NCPA for Changes to Take Effect

sudo systemctl restart ncpa_listener

sudo systemctl restart ncpa_listener

2.3 Configure Firewall Rules

Allow Nagios XI to communicate with NCPA over port 5693.

sudo firewall-cmd --zone=public --add-port=5693/tcp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=5693/tcp --permanent
sudo firewall-cmd --reload

Verify:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

Step 3: Adding Fedora 40 to Nagios XI

Now that NCPA is set up, integrate it with Nagios XI for active monitoring.

3.1 Access Nagios XI

1. Log in to Nagios XI.
2. Navigate to Configure → Configuration Wizards.
3. Search for and select NCPA.

3.2 Add Fedora 40 Host

1. Enter the hostname or IP address of your Fedora 40 machine.
2. Provide the NCPA authentication token (Str0ngT0k3n).
3. Click Next.

3.3 Define Monitoring Checks

• Select system metrics like CPU Usage, Memory Usage, Disk Space, Network Usage.
• Configure thresholds for warning and critical alerts.

3.4 Save and Apply Configuration

• Click Finish to add the host.
• Apply the configuration to start monitoring.

Step 4: Verify Monitoring

4.1 Check NCPA Web Interface

Open a browser and visit:

https://<Fedora40-IP>:5693/

https://<Fedora40-IP>:5693/

Log in using the authentication token to confirm NCPA is running.

4.2 View Host Status in Nagios XI

1. Go to Home → Service Status.
2. Locate your Fedora 40 host.
3. Ensure checks return valid results.

Step 5: Common Issues & Fixes

NCPA Service is Not Running

Check logs for errors:

sudo journalctl -u ncpa --no-pager | tail -20

sudo journalctl -u ncpa --no-pager | tail -20

Restart NCPA if necessary:

sudo systemctl restart ncpa

sudo systemctl restart ncpa

Host Appears “Down” in Nagios XI

Check firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

Ensure NCPA is running:

sudo systemctl status ncpa

sudo systemctl status ncpa

Verify Nagios XI configuration.

Incorrect API Token Error

Confirm the correct API token is set in ncpa.cfg.

Restart the NCPA service after changes:

sudo systemctl restart ncpa

sudo systemctl restart ncpa

Conclusion

By installing and configuring NCPA, Fedora 40 is now actively monitored in Nagios XI. This setup enables real-time insights and proactive issue resolution for your system. You can further enhance monitoring by creating custom checks using NCPA’s API.

For further assistance, refer to the Nagios Support Forum or the Nagios Knowledgebase.