This guide will walk you through the step-by-step process of configuring RHEL 8 to send logs to Nagios Log Server 2024R2 using rsyslog. By the end, your system will be fully integrated with Nagios Log Server, enabling efficient and centralized log monitoring.

Prerequisites

Before proceeding, ensure you have the following:

• A running Nagios Log Server 2024R2 instance.
• A RHEL 8 system (updated; e.g., `sudo dnf update`) with root or `sudo` privileges.
• Network connectivity between RHEL 8 and Nagios Log Server (ensure firewall rules allow communication on port 5544).
• `rsyslog` installed (default; verify with `rsyslogd -v`, expecting 8.1911.0 or later).

Step 1: Add a New Log Source in Nagios Log Server

1. Login to Nagios Log Server:
   • Open your web browser and navigate to your Nagios Log Server instance.
   • Log in using your administrator credentials.
2. Navigate to Log Source Setup:
   • On the Home page, locate the + Linux button at the top right.

3. Alternatively, click + Add Log Source in the navigation bar and select Linux.

Step 2: Configuring the RHEL 8 Log Source

1. Download and Run the Setup Script

• The Linux Source Setup page provides a pre-configured command.
• Copy the command and paste it into the RHEL 8 terminal.

If curl is not installed, install it first:

sudo dnf install -y curl

sudo dnf install -y curl

Then, execute the following command to download and run the setup script:

curl -sS -O http://your-nagios-log-server-address/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s your-nagios-log-server-address -p 5544

curl -sS -O http://your-nagios-log-server-address/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s your-nagios-log-server-address -p 5544

Replace your-nagios-log-server-address with the actual IP address or hostname of your Nagios Log Server.

• The -s flag specifies the Nagios Log Server address.
• The -p 5544 specifies the port for log transmission (default is 5544).

Example Output:

curl -sS -O http://192.168.0.65/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.65 -p 5544

curl -sS -O http://192.168.0.65/nagioslogserver/scripts/setup-linux.sh
sudo bash setup-linux.sh -s 192.168.0.65 -p 5544

2. Verify the Script Execution

After running the script, you should see a confirmation message:

Detected rsyslog 8.1901.0
Detected rsyslog work directory /var/lib/rsyslog
Destination Log Server: 192.168.0.65:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
Redirecting to /bin/systemctl restart rsyslog.service
Okay.
rsyslog is running with the new configuration.
Visit your Nagios Log Server dashboard to verify that logs are being received.

Detected rsyslog 8.1901.0
Detected rsyslog work directory /var/lib/rsyslog
Destination Log Server: 192.168.0.65:5544
Creating /etc/rsyslog.d/99-nagioslogserver.conf...
SELinux is disabled.
rsyslog configuration check passed.
Restarting rsyslog service with 'service'...
Redirecting to /bin/systemctl restart rsyslog.service
Okay.
rsyslog is running with the new configuration.
Visit your Nagios Log Server dashboard to verify that logs are being received.

• If you encounter any errors, check the script logs.
• Ensure that the Nagios Log Server is reachable and that port 5544 is open.

Step 3: Confirming Log Reception

1. Navigate to Dashboards in Nagios Log Server:
   • Go to the Dashboards section.
   • Perform a query using the IP address of the RHEL 8 machine to confirm logs are being received.
2. Send a Test Log Entry:

logger "This is a test log entry"

logger "This is a test log entry"

3. Refresh the Nagios Log Server dashboard:
   • If successful, you should see the test log entry listed in the dashboard.

Step 4: Accessing the Setup Script on Nagios Log Server

The setup script is located on the Nagios Log Server instance at:

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

/var/www/html/nagioslogserver/www/scripts/setup-linux.sh

You can access it directly via a browser or SSH if you need to make manual adjustments.

Step 5: Manual Setup (Optional)

For more customization, use the manual configuration method instead of the script:

1. Edit the rsyslog configuration:

sudo nano /etc/rsyslog.d/.conf

sudo nano /etc/rsyslog.d/.conf

2. Add the following lines at the begin forwarding rule section:

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.123:5544
# ### end of the forwarding rule ###

# ### begin forwarding rule ### NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@192.168.1.123:5544
# ### end of the forwarding rule ###

Replace /var/lib/rsyslog with the correct path if different, and 192.168.1.123 with the IP address of your Nagios Log Server.

3. Restart rsyslog:

sudo /etc/init.d/rsyslog restart

sudo /etc/init.d/rsyslog restart

Step 6: Adding More Log Sources

Use the + Add Log Source button to configure additional sources, such as:

• Windows event logs
• Application logs
• Archived log files

Some log sources offer both scripted and manual setup options.

• The manual method provides more customization by allowing direct configuration file edits.

Troubleshooting Tips

1. Check rsyslog Status

Ensure that rsyslog is installed and running:

systemctl status rsyslog

systemctl status rsyslog

If the service is not running, start it:

sudo systemctl start rsyslog

sudo systemctl start rsyslog

2. Verify Network Connectivity

Ensure that the RHEL 8 machine can communicate with Nagios Log Server on port 5544.

• Check for network restrictions such as firewalls or proxy settings.

3. Check Firewall Settings

If you’re using firewalld, allow traffic on port 5544:

sudo firewall-cmd --zone=public --add-port=5544/tcp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=5544/tcp --permanent
sudo firewall-cmd --reload

Also, check if there are any firewall rules on the Nagios Log Server that might block incoming log data.

4. Review Log Files

If the above steps don’t resolve the issue, review the log files:

• On RHEL 8: sudo cat /var/log/messages | grep rsyslog
• On Nagios Log Server: tail -f /var/log/logserver/nagios.log

Video Tutorial

Enhance your understanding with this step-by-step walkthrough:

Conclusion

By following this guide, you have successfully configured your RHEL 8 machine to send logs to Nagios Log Server 2024R2 for centralized monitoring. This setup allows you to efficiently monitor system logs and gain insights into potential issues in real-time.

For troubleshooting or further assistance, visit the Nagios Knowledgebase or check the Nagios Support Forums.

In this guide, we’ll walk you through the step-by-step process of installing and configuring SNMP on RHEL 8, enabling seamless integration with Nagios XI for real-time system monitoring and proactive issue detection.

Prerequisites

Before proceeding, ensure the following:

• A RHEL 8 system with root or sudo privileges.
• Nagios XI installed and accessible, with the SNMP Wizard enabled.
• A stable internet connection for package downloads.

Step 1: Install SNMP on RHEL 8

1. To install SNMP and the required libraries, run:

sudo dnf install net-snmp net-snmp-utils -y

sudo dnf install net-snmp net-snmp-utils -y

2. After installation, verify the installed version:

snmpd -v

snmpd -v

This ensures that SNMP is correctly installed on the system.

Step 2: Configure SNMP Access

SNMP v2c Configuration

1. To configure SNMP v2c, create a backup of the existing configuration:

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

2. Now, edit the SNMP configuration file:

sudo nano /etc/snmp/snmpd.conf

sudo nano /etc/snmp/snmpd.conf

3. Find and modify the following line to define the community string and allow access from your Nagios XI server (replace Str0ngC0mmunity with your desired community string and 10.25.5.12 with your Nagios XI server’s IP address):

rocommunity Str0ngC0mmunity 10.25.5.12

rocommunity Str0ngC0mmunity 10.25.5.12

4. Save the file and restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

SNMP v3 Configuration (More Secure)

1. Stop the SNMP service temporarily:

sudo systemctl stop snmpd.service

sudo systemctl stop snmpd.service

2. To configure SNMP v3, create an SNMP user with authentication and encryption:

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

sudo net-snmp-create-v3-user -ro -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy nagios

• -a SHA → Specifies SHA for authentication (MD5 is also supported but less secure).
• -x AES → Enables AES encryption (DES is another option but less secure).

3. Restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Step 3: Configure Firewall Rules

1. If firewalld is active (check with sudo systemctl status firewalld), allow SNMP traffic on UDP port 161:

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=161/udp --permanent
sudo firewall-cmd --reload

2. Confirm firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

Step 4: Enable SNMP Service on Boot

To ensure SNMP starts automatically at boot, run:

sudo systemctl enable snmpd.service

sudo systemctl enable snmpd.service

Step 5: Test SNMP Communication

To test if SNMP is responding correctly, run the following commands from your Nagios XI server.

For SNMP v2c:

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

snmpwalk -v2c -c Str0ngC0mmunity 10.25.5.12

For SNMP v3:

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

snmpwalk -v3 -u nagios -l authPriv -a SHA -A Str0ng@uth3ntic@ti0n -x AES -X Str0ngPriv@cy 10.25.5.12

Expected Output (Example)

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 4.18.0-305.19.1.el8.x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

iso.3.6.1.2.1.1.1.0 = STRING: "Linux myserver 4.18.0-305.19.1.el8.x86_64"
iso.3.6.1.2.1.1.3.0 = Timeticks: (100032) 0:16:40.32

If the command does not return data, review SNMP configuration and firewall settings.

Step 6: Add RHEL 8 Host to Nagios XI Using SNMP Wizard

1. Log in to Nagios XI.

2. Navigate to Configure > Run a configuring wizard.

3. Search for and select Linux SNMP wizard.

4. Enter the RHEL 8 server’s IP address and SNMP credentials.

4. Click Next, select the system metrics to monitor (CPU, memory, disk, network traffic, etc.).

5. Apply the configuration and verify that Nagios XI is collecting SNMP data.

Common Issues & Fixes

SNMP Service is Not Running

Check logs for errors:

sudo journalctl -u snmpd --no-pager | tail -20

sudo journalctl -u snmpd --no-pager | tail -20

Restart SNMP if necessary:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

Host Appears “Down” in Nagios XI

• Check firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

• Ensure SNMP is running:

sudo systemctl status snmpd

sudo systemctl status snmpd

• Verify Nagios XI configuration

Incorrect SNMP Credentials Error

• Confirm the correct community string (SNMP v2c) or authentication details (SNMP v3).
• Restart the SNMP service after changes.

Conclusion

You’ve successfully configured SNMP on RHEL 8 for agentless monitoring with Nagios XI, providing real-time system insights. For advanced setups, explore custom SNMP OIDs or additional Nagios XI plugins. For support, visit the Nagios Support Forum or the Nagios Knowledgebase.

Prerequisites

Before proceeding, ensure you have:

• A RHEL 8 system with root or sudo privileges.
• Nagios XI installed and accessible, with the NCPA Wizard enabled.
• A stable internet connection for package downloads.
• SELinux set to `enforcing` or `permissive` (check with `getenforce`; adjust if needed).

Step 1: Install the Nagios Repository

The recommended method for installing NCPA on RHEL 8 is using the Nagios repository. To add the repository, run:

sudo rpm -Uvh https://repo.nagios.com/nagios/8/nagios-repo-8-2.el8.noarch.rpm
yum update

sudo rpm -Uvh https://repo.nagios.com/nagios/8/nagios-repo-8-2.el8.noarch.rpm
yum update

After adding the repository, update your package list:

sudo dnf clean all
sudo dnf update -y

sudo dnf clean all
sudo dnf update -y

Step 2: Install NCPA on RHEL 8

Once the repository is configured, install the NCPA agent using:

sudo dnf install ncpa -y

sudo dnf install ncpa -y

Verify the installation:

rpm -q ncpa

rpm -q ncpa

Expected output: ncpa-<version>.el8.x86_64 (e.g., ncpa-3.1.1-1.el8.x86_64).

Step 3: Configure NCPA

After installation, configure NCPA by editing its configuration file to set your API token:

sudo nano /usr/local/ncpa/etc/ncpa.cfg

sudo nano /usr/local/ncpa/etc/ncpa.cfg

Find the line:

community_string = mytoken

community_string = mytoken

Replace mytoken with a strong, unique token (e.g., K9pL3mX7vR2tQ8nJ), avoiding predictable values for security.

Save the file (CTRL + X, then Y, and Enter).

Step 4: Enable and Start the NCPA Service

To ensure NCPA runs automatically at boot and starts immediately, run:

sudo systemctl enable ncpa
sudo systemctl start ncpa

sudo systemctl enable ncpa
sudo systemctl start ncpa

Check if the service is running:

sudo systemctl status ncpa

sudo systemctl status ncpa

Confirm Active: active (running) appears in the output.

Step 5: Configure Firewall Rules

If firewalld is active (check with sudo systemctl status firewalld), allow NCPA traffic on port 5693:

sudo firewall-cmd --zone=public --add-port=5693/tcp --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --zone=public --add-port=5693/tcp --permanent
sudo firewall-cmd --reload

Confirm firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

Step 6: Test NCPA Installation

After configuring the firewall, confirm that NCPA is accessible by navigating to:

https://<NCPA_IP_Address>:5693/

https://<NCPA_IP_Address>:5693/

Since NCPA uses a self-signed certificate, your browser may display a warning. Click Advanced > Proceed to continue.

You should see the NCPA login page. Enter the API token you configured earlier and click Log In.

Step 7: Add RHEL 8 Host to Nagios XI Using NCPA Wizard

1. Log in to Nagios XI.

2. Navigate to Configure > Configuring wizard.

3. Search for and select NCPA.

4. Enter the RHEL 8 server’s IP address and API token.

5. Click Next, select the system metrics to monitor (CPU, memory, disk, network traffic, etc.).

6. Apply the configuration and verify that Nagios XI is collecting data.

Common Issues & Fixes

NCPA Service is Not Running

Check logs for errors:

sudo journalctl -u ncpa --no-pager | tail -20

sudo journalctl -u ncpa --no-pager | tail -20

Restart NCPA if necessary:

sudo systemctl restart ncpa

sudo systemctl restart ncpa

Host Appears “Down” in Nagios XI

• Check firewall rules:

sudo firewall-cmd --list-ports

sudo firewall-cmd --list-ports

• Ensure NCPA is running:

sudo systemctl status ncpa

sudo systemctl status ncpa

• Verify Nagios XI configuration

Incorrect API Token Error

• Confirm the correct API token is set in ncpa.cfg
• Restart the NCPA service after changes

Conclusion

You have successfully installed and configured NCPA on RHEL 8 for monitoring with Nagios XI. This setup allows efficient tracking of system performance metrics and ensures proactive issue resolution.

For further assistance, refer to the Nagios Support Forum or the Nagios Knowledgebase.