In message
<CA+=j5hXYw4YChb=shj_rjwtao_ar90p6p1v2_bq4zdvtmpn...@mail.gmail.com> ,
Joe Prosser writes:
>I've done it on the same system, but not remotely through NSCA.
I just fire an ssh session in a shellcmd action:
echo "message in form of nagios passive check result" | ssh nagios@nagioshost
using a public key with a forced command for the nagios user on the
nagios host that reads stdin, validates the input and forwards it to
the local nagios input command pipe.
So ~nagios/.ssh/authorized_keys entry like:
from="*.example.com,192.168.",command="/usr/lib/nagios/addons/accept_alert
nagioshost
/var/spool/nagios/nagios.cmd",no-agent-forwarding,no-X11-forwarding,no-port-forwarding
ssh-rsa ....
and accept_alert is:
============
#! /usr/bin/perl -T
use strict;
my $cmdpipefh; # file handle for command pipe
my $cmdpipe; # command pipe name
my $message; # the mesage
my $max_cmd_length = 510; # max length of message
$cmdpipe = $1 if $ARGV[1] =~ m@^(/[\w/.]*)$@;
open ($cmdpipefh, "> $cmdpipe") or die "Unable to open command pipe $cmdpipe";
# Make it flush immediately. Will write one line at a time to make
# writes atomic.
select($cmdpipefh); $|=1;
print STDOUT "$ARGV[0]:accept_alert - connected to $cmdpipe, ready\n";
while (<STDIN>) {
$message = '';
# clear all eol characters to normalize later
chomp($_);
# required message format
# [<timestamp>]
PROCESS_SERVICE_CHECK_RESULT;<host_name>;<description>;<return_code>;<plugin_output>
$message = $1 if $_ =~ m/^(\[[0-9]+\]
PROCESS_SERVICE_CHECK_RESULT;[\w.-]+;[\w]*;\d*;.*)$/;
if ($message) {
if (length($message) < $max_cmd_length ) {
print $cmdpipefh $message . "\n";
} else {
print $cmdpipefh substr($message,0,$max_cmd_length) . "\n";
print $cmdpipefh substr(make_warning("Needed to truncate passive
result from $ENV{SSH_CLIENT}: $_"), 0, $max_cmd_length) . "\n";
}
} elsif ( $_ ) { # if $_ is not empty, then we have an error
print $cmdpipefh substr(make_warning("Bad passive result from
$ENV{SSH_CLIENT}: $_"), 0, $max_cmd_length) . "\n";
}
}
close($cmdpipefh);
sub make_warning {
return "[" . time() . "]
PROCESS_SERVICE_CHECK_RESULT;$ARGV[0];NagiosPassiveAlertError;1;$_[0]";
}
==================
This can be used for single shot alerts (using an action of shellcmd
echo ....| ssh), or you can use a spawn command to fire up a:
tail -F /var/spool/nagios/nagios_alerts | ssh -i sec_nagios_key_rsa
nagios@nagioshost
and use actions of
write /var/spool/nagios/nagios_alerts nagios_format_message
to generate the alerts into nagios.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
