Step 1: Add a New Log Source in Nagios Log Server

1. Log in to Nagios Log Server.
2. Click + Add Log Source or navigate to the Add a Log Source section.
3. Select Linux from the available source types.

Step 2: Run the Auto-Configuration Script on Ubuntu

1. On the Linux Source Setup page, copy the provided curl command.
2. SSH into your Ubuntu 20 machine as a root user.
3. Paste and execute the script:

curl -sS -O http://<NagiosLogServerIP>/nagioslogserver/scripts/setup-linux.sh sudo bash setup-linux.sh -s <NagiosLogServerIP> -p 5544

curl -sS -O http://<NagiosLogServerIP>/nagioslogserver/scripts/setup-linux.sh sudo bash setup-linux.sh -s <NagiosLogServerIP> -p 5544

This sets up rsyslog to forward logs to your Nagios Log Server.

Step 3: Verify Incoming Logs

• Use the Verify Incoming Logs field by entering the Ubuntu machine’s IP.
• Or navigate to Dashboards > Nagios Log Server Search and run:

host.ip:<Ubuntu-IP>

host.ip:<Ubuntu-IP>

• Test log submission with:

logger "This is a test log entry"

logger "This is a test log entry"

• Check if the test log appears in Nagios Log Server.

Step 4: Manually Configure rsyslog (Advanced Users)

If you prefer a manual setup:

1. Verify your rsyslog working directory:

ls -d /var/lib/rsyslog || ls -d /var/spool/rsyslog

ls -d /var/lib/rsyslog || ls -d /var/spool/rsyslog

2. Edit the config file:

sudo nano /etc/rsyslog.d/99-nagioslogserver.conf

sudo nano /etc/rsyslog.d/99-nagioslogserver.conf

Add the following line:

*.* @<NagiosLogServerIP>:5544;RSYSLOG_SyslogProtocol23Format

*.* @<NagiosLogServerIP>:5544;RSYSLOG_SyslogProtocol23Format

3. Restart rsyslog:

sudo systemctl restart rsyslog.service

sudo systemctl restart rsyslog.service

4. Confirm logs are reaching the server:

tail -f /var/log/syslog | grep rsyslog

tail -f /var/log/syslog | grep rsyslog

Step 5: Integrate Log Server with Nagios XI (Optional Alerting)

• Configure Nagios XI to receive alerts for specific log patterns from Nagios Log Server.
• Set up alert queries within Nagios Log Server to trigger notifications in XI.
• Use Event Handlers or the Nagios XI API for automated responses based on log events.

Troubleshooting Tips

• Ensure the Ubuntu system allows outbound traffic to Nagios Log Server on port 5544.
• Check /var/log/syslog for local log activity.
• Review /var/log/rsyslog.log for configuration errors.
• Run the following to confirm rsyslog is active:

sudo systemctl status rsyslog

sudo systemctl status rsyslog

• Use tcpdump to check if logs are sent to Nagios Log Server:

sudo tcpdump -i any port 5544

sudo tcpdump -i any port 5544

Final Notes

• Logs are forwarded over port 5544 by default.
• Use secure log transmission if required by enabling TLS in rsyslog.
• Regularly review log retention and indexing settings in Nagios Log Server.

References

• Nagios Forum
• Nagios XI Documentation

Prerequisites

Before proceeding, ensure you have:

• An Ubuntu 20.04 system with root or sudo access.
• A Nagios XI server with SNMP monitoring enabled.
• A valid SNMP community string (for SNMP v2c) or a secure SNMPv3 user.
• Open UDP port 161 for SNMP traffic.

Step 1: Install SNMP on Ubuntu 20.04

Update your package list and install the SNMP daemon:

sudo apt-get update
sudo apt-get install snmpd libsnmp-dev -y

sudo apt-get update
sudo apt-get install snmpd libsnmp-dev -y

Step 2: Configure SNMP v2c

1. Backup the default configuration:

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.bak

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.bak

2. Replace it with a new configuration:

 sudo sh -c "echo 'rocommunity Str0ngC0mmunity <Nagios-XI-IP> default' > /etc/snmp/snmpd.conf"

 sudo sh -c "echo 'rocommunity Str0ngC0mmunity <Nagios-XI-IP> default' > /etc/snmp/snmpd.conf"

Replace <Nagios-XI-IP> with the actual IP address of your Nagios XI server.

3. Restart the SNMP service:

sudo systemctl restart snmpd.service

sudo systemctl restart snmpd.service

4. Verify that SNMP is running:

sudo systemctl status snmpd

sudo systemctl status snmpd

:small_blue_diamond: Security Note: SNMP v2c does not support encryption. For better security, use SNMP v3, which includes authentication and encryption.

Step 3: Configure Firewall

To allow SNMP traffic through UFW (Uncomplicated Firewall), run:

sudo ufw allow 161/udp
sudo ufw reload
sudo ufw status | grep 161

sudo ufw allow 161/udp
sudo ufw reload
sudo ufw status | grep 161

Step 4: Enable SNMP on Boot

Ensure SNMP starts automatically after reboots:

sudo systemctl enable snmpd.service

sudo systemctl enable snmpd.service

Step 5: Test SNMP Communication

From your Nagios XI server, test if SNMP is responding:

snmpwalk -v2c -c Str0ngC0mmunity <Ubuntu-IP> system

snmpwalk -v2c -c Str0ngC0mmunity <Ubuntu-IP> system

Expected output:

SNMPv2-MIB::sysDescr.0 = STRING: Linux ubuntu20 5.4.0-91-generic x86_64

SNMPv2-MIB::sysDescr.0 = STRING: Linux ubuntu20 5.4.0-91-generic x86_64

:small_blue_diamond: Troubleshooting: If SNMP doesn’t respond, check logs:

sudo journalctl -u snmpd --no-pager | tail -20

sudo journalctl -u snmpd --no-pager | tail -20

Step 6: Integrate SNMP with Nagios XI

1. Log in to Nagios XI.
2. Go to Configure > Run a Configuration Wizard > Linux SNMP.
3. Enter the Ubuntu IP and SNMP community string (Str0ngC0mmunity).
4. Select SNMP v2c or SNMP v3 (recommended for security).
5. Choose the metrics you want to monitor (CPU, disk, processes, etc.).
6. Set warning/critical thresholds.
7. Finish the wizard and apply the configuration.

Troubleshooting & Common Issues

1. SNMP Service Not Responding

• Check if SNMP is running:

sudo systemctl status snmpd

sudo systemctl status snmpd

• Restart if needed:

sudo systemctl restart snmpd

sudo systemctl restart snmpd

2. SNMP Query Fails from Nagios XI

• Ensure port 161/UDP is open:

sudo netstat -tulnp | grep 161

sudo netstat -tulnp | grep 161

• If SNMP is not listening, restart the service.

3. Incorrect Community String

• Verify the correct community string in /etc/snmp/snmpd.conf:

cat /etc/snmp/snmpd.conf | grep rocommunity

cat /etc/snmp/snmpd.conf | grep rocommunity

4. Test from Nagios XI Server Run an SNMP check:

cd /usr/local/nagios/libexec
./check_snmp_storage.pl -H <Ubuntu-IP> -C Str0ngC0mmunity -m "^/$" -w 80 -c 90

cd /usr/local/nagios/libexec
./check_snmp_storage.pl -H <Ubuntu-IP> -C Str0ngC0mmunity -m "^/$" -w 80 -c 90

This checks disk usage, warning at 80% and critical at 90%.

Final Notes

• SNMP v2c is simple but lacks encryption. Use SNMP v3 for secure monitoring.
• Ensure port 161/UDP is open between Nagios XI and Ubuntu.
• Test SNMP connectivity before integrating with Nagios XI.
• For advanced monitoring, configure SNMP traps for event-based alerts.

For More Details

• Nagios XI Documentation
• Nagios Forum

Prerequisites

Before you begin, ensure you have:

• A system running Ubuntu 20.04 or newer with root/sudo access
• Nagios XI installed and accessible (with the NCPA wizard enabled)
• Network connectivity between the Ubuntu host and Nagios XI
• A stable internet connection for package installation

Step 1: Install the Nagios Repository

The recommended method is to install NCPA using the Nagios repository:

echo "deb https://repo.nagios.com/deb/$(lsb_release -cs) /" | sudo tee /etc/apt/sources.list.d/nagios.list
wget -qO - https://repo.nagios.com/GPG-KEY-NAGIOS-V3 | sudo apt-key add -
sudo apt update

echo "deb https://repo.nagios.com/deb/$(lsb_release -cs) /" | sudo tee /etc/apt/sources.list.d/nagios.list
wget -qO - https://repo.nagios.com/GPG-KEY-NAGIOS-V3 | sudo apt-key add -
sudo apt update

Step 2: Install NCPA on Ubuntu 20.04

Install the NCPA agent:

sudo apt install ncpa -y

sudo apt install ncpa -y

Alternatively, download and install the DEB package manually:

cd /tmp
wget https://assets.nagios.com/downloads/ncpa3/ncpa-latest.amd64.deb
sudo dpkg -i ncpa-latest.amd64.deb
sudo apt-get install -f

cd /tmp
wget https://assets.nagios.com/downloads/ncpa3/ncpa-latest.amd64.deb
sudo dpkg -i ncpa-latest.amd64.deb
sudo apt-get install -f

Verify installation:

ncpa --version

ncpa --version

Step 3: Configure NCPA

Set your API token by editing the config file:

sudo nano /usr/local/ncpa/etc/ncpa.cfg

sudo nano /usr/local/ncpa/etc/ncpa.cfg

Find the line:

community_string = mytoken

community_string = mytoken

Replace mytoken with a strong, unique token (e.g., K9pL3mX7vR2tQ8nJ). Save and close.

Step 4: Enable and Start the NCPA Service

Ensure NCPA runs at boot and is currently active:

sudo systemctl enable ncpa
sudo systemctl restart ncpa
sudo systemctl status ncpa

sudo systemctl enable ncpa
sudo systemctl restart ncpa
sudo systemctl status ncpa

Check for active (running) status.

Step 5: Configure Firewall Rules

If using UFW, open port 5693:

sudo ufw allow 5693/tcp
sudo ufw reload
sudo ufw status

sudo ufw allow 5693/tcp
sudo ufw reload
sudo ufw status

Step 6: Test NCPA Installation

Visit the NCPA interface in your browser:

https://<Ubuntu-IP>:5693/

https://<Ubuntu-IP>:5693/

Accept the browser’s self-signed certificate warning. Enter your token and verify the dashboard loads.

Step 7: Add Ubuntu Host to Nagios XI Using NCPA Wizard

1. Log into Nagios XI.

2. Navigate to Configure > Configuration Wizards.

3. Select NCPA.

4. Enter the Ubuntu system’s IP address and API token.

5. Choose which services to monitor (CPU, memory, disk, etc.).

6. Apply configuration and confirm data collection.

Common Issues & Fixes

NCPA Service Not Running

• Check logs: sudo journalctl -u ncpa --no-pager | tail -20
• Restart service: sudo systemctl restart ncpa

Host Appears “Down” in Nagios XI

• Confirm the firewall is open on port 5693
• Verify NCPA is running
• Recheck Nagios XI host and service definitions

Incorrect API Token

• Ensure the correct token is set in ncpa.cfg
• Restart NCPA after updating the token: sudo systemctl restart ncpa

Conclusion

You have now installed and configured NCPA on Ubuntu 20.04 and integrated it with Nagios XI for comprehensive system monitoring. This setup provides a secure and powerful way to track server performance and gain operational visibility.

For Additional Help

• Nagios Support Forum
• Nagios Knowledgebase
• NCPA Downloads