icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Analytics for Nagios
SHA256 checksum (analytics-for-nagios_400.tgz) 6142935437fbc89d0908437fd7e5914869b8a981d62b510816395592fd10e5de SHA256 checksum (analytics-for-nagios_300.tgz) 0d2454884523d74eebba3c2a969a52038fe3a5b34a372c6f42362bfa103137e7 SHA256 checksum (analytics-for-nagios_201.tgz) 4faff37784458fe842990405ff78938c146327940c62a8085f9ba5402f5a3f27 SHA256 checksum (analytics-for-nagios_20.tgz) 1cfbb14f887e90f2749393d7952c9ce88436ef19d4304a79a3fa3888572a4d8e SHA256 checksum (analytics-for-nagios_111.tgz) cb2be5239e4eae1c2e33d5b81aa904d7178414b5cd0b21dbec7c1d3dc4ceee4e SHA256 checksum (analytics-for-nagios_10.tgz) 848307d921e063243c60d6a1a20053a204269566ee610d69ef0504c7ad2a34cb
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Analytics for Nagios

Overview
Details
Analytics for Nagios version 4 integrates the monitoring solution "Nagios" with Splunk.
The app now leverages inputs from the Splunk Supported "Splunk Add-on for Nagios Core" and it has been tested successfully with Nagios XI and Nagios Core 4.x.
Features:
* Schedule Saved Searches in Splunk to send alerts to Nagios
* Status Dashboard feat. recent Alerts and Notifications
* Overview dashboard featuring Alerts & Notifications over time
* Recurring Alerts dashboard
* Gearman Workers dashboard
* Calendar Heatmap dashboard (D3)
* Network Map (D3)
* Host Availability Dashboard & Top 100 Alerts
* Host Dashboards with Graphs of metal level metrics (CPU, Memory, Swap, Load, Disk Usage, Network Interface Utilization, Processes, etc) sourced from Nagios Plugin Performance Data
* Integration with MK Livestatus - feat. various dashboards updated with live status data from Nagios
* Acknowledge Host & Service Alerts and Schedule Host & Service Downtime in Nagios directly from Splunk (via MK Livestatus)
* CMDB report

Analytics for Nagios

Overview

Analytics for Nagios (formerly known as Splunk for Nagios) includes a major re-write of all dashboards using Simple XML and it leverages inputs from the Splunk Supported "Splunk Add-on for Nagios Core". It has been tested successfully with Nagios XI and Nagios Core 4.

Important: use Splunk for Nagios version 3 with Nagios 3.x, and Analytics for Nagios version 4 with Nagios Core 4.x or Nagios XI.

New dashboards:

  • Overview dashboard featuring Alerts & Notifications over time
  • Recurring Alerts dashboard
  • Gearman Workers dashboard
  • Calendar Heatmap dashboard (D3)
  • Network Map (D3)

MK Livestatus Dashboards:

  • Livestatus Network Health
  • Livestatus Service Alerts
  • Livestatus Host SLA
  • Livestatus Service SLA
  • Livestatus Host Groups
  • Livestatus Service Groups
  • Livestatus Host and Service Acknowledgement
  • Livestatus Host and Service Downtime

Very powerful dashboards:

  • Host Availability
  • Top 100 Alerts

Now you can monitor, manage and troubleshoot all your devices from one single pane of glass with Analytics for Nagios.

Get out of the 1980's and replace Cacti, Munin, MRTG, Orca, etc. with Analytics for Nagios... no more rrd configuration and no more agents to install.

Why poll for data twice? Analytics for Nagios creates the performance graphs automatically!

Analytics for Nagios also has another huge advantage over rrd based graphing solutions, and that is you can graph performance and capacity metrics with full fidelity, ie. no more 'averaged out' rrd based graphs.

  • Supported on Linux/Unix Splunk servers only.
  • Any feedback, including requests for enhancement are most welcome.

Analytics for Nagios is hosted at GitHub

Setup Analytics for Nagios

Distributed Deployment

  • Install the Splunk Supported "Splunk Add-on for Nagios Core" on the Universal Forwarders, Search Heads, Indexers/Peer Nodes, and Heavy Forwarders.
  • Install "Analytics for Nagios" on your Search Head/s

Add an Index to Splunk

  • Create an index called nagios on your Indexers/Peer Nodes.

Install and Configure a 'Universal Forwarder' on the Nagios server/s

Install the Splunk Supported "Splunk Add-on for Nagios Core"
https://splunkbase.splunk.com/app/2703/

Follow the Setup Instructions as per Splunk's official documentation:
http://docs.splunk.com/Documentation/AddOns/latest/NagiosCore/Setup

Note: Do not set the following configurations in $NAGIOS_HOME/etc/nagios.cfg if you are running Nagios XI.
e.g. /usr/local/nagios/etc/nagios.cfg

#service_perfdata_command=...
#host_perfdata_command=...

If they are commented, keep them commented. If they are set, remove or comment the options. If these lines are set, the field extractions in the add-on may fail.

Do not change the perfdata file templates as the data is also used by PNP in Nagios XI:

service_perfdata_file_template=DATATYPE::SERVICEPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tSERVICEDESC::$SERVICEDESC$\tSERVICEPERFDATA::$SERVICEPERFDATA$\tSERVICECHECKCOMMAND::$SERVICECHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$\tSERVICESTATE::$SERVICESTATE$\tSERVICESTATETYPE::$SERVICESTATETYPE$\tSERVICEOUTPUT::$SERVICEOUTPUT$

host_perfdata_file_template=DATATYPE::HOSTPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tHOSTPERFDATA::$HOSTPERFDATA$\tHOSTCHECKCOMMAND::$HOSTCHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$\tHOSTOUTPUT::$HOSTOUTPUT$

Update the sourcetypes in inputs.conf if you are running Nagios XI:

[monitor:///usr/local/nagios/var/nagios.log]
disabled = 0
sourcetype = nagios:core
index = nagios

[monitor:///usr/local/nagios/var/host-perfdata]
disabled = 0
sourcetype = nagios:core:hostperfxi
index = nagios

[monitor:///usr/local/nagios/var/service-perfdata]
disabled = 0
sourcetype = nagios:core:serviceperfxi
index = nagios

Update the sourcetypes in inputs.conf if you are running Nagios Core 4.x:

[monitor:///usr/local/nagios/var/nagios.log]
disabled = 0
sourcetype = nagios:core
index = nagios

[monitor:///usr/local/nagios/var/host-perfdata]
disabled = 0
sourcetype = nagios:core:hostperf
index = nagios

[monitor:///usr/local/nagios/var/service-perfdata]
disabled = 0
sourcetype = nagios:core:serviceperf
index = nagios

Configure Analytics for Nagios on your Search Head/s

All of the dashboards and saved searches in Analytics for Nagios use searches based on index=nagios

  • Update the nagios_index macro in Analytics for Nagios if you use a different index

Update the following macros in Analytics for Nagios if you are running Nagios Core 4.x:

  • nagios_core_hostperf
    • change from 'nagios:core:hostperfxi' to 'nagios:core:hostperf'
  • nagios_core_serviceperf
    • change from 'nagios:core:serviceperfxi' to 'nagios:core:serviceperf'

MK Livestatus Integration

  • Livestatus makes use of the Nagios Event Broker API for accessing status and object data. It opens a socket by which data can be retrieved on demand. The socket allows you to send a request for hosts, services or other pieces of data and get an immediate answer. The data is directly read from Nagios' internal data structures.
  • Version 4 of Analytics for Nagios includes external scripts for livestatus integration that must be updated for your nagios environment:
  • Edit the following python script using your favourite text editor and replace the Hostnames and Port number with your Nagios server/s that are running MK Livestatus:
    $SPLUNK_HOME/etc/apps/SplunkForNagios/bin/mklivestatus.py
  • Optionally, you can test connectivity to your MK Livestatus server/s by running the following script from the command line on your Splunk Search Head/s:
    $SPLUNK_HOME/etc/apps/SplunkForNagios/bin/test-mklivestatus.py

REQUIRED:

  • The Livestatus dashboards and the new reports will NOT work if you do not edit the script as instructed above.
  • You must ensure that the ip address of your Splunk Search Head/s is listed next to "only_from" in /etc/xinetd.d/livestatus on your Nagios server.
  • mk-livestatus v1.2.6p5 or greater required!

Reference:

https://mathias-kettner.de/checkmk_livestatus.html

Nagios Plugins supported by Analytics for Nagios

How To Send Alerts From Splunk To Nagios

Configure a Scheduled Saved Search in Splunk to send alerts to Nagios:

  • Prerequisites:
    • send_nsca: must be installed on the *nix Splunk server
    • nsca: must be listening on the Nagios server
  • The name of the Saved Search must begin with the corresponding hostname defined in Nagios followed by a hyphen then the name of the Service defined in Nagios, eg.
    • server01 - XYZ Alert
  • Time range:
    • Start time = -5m@m
    • Finish time = now
  • Schedule and alert:
    • tick "Schedule this search"
  • Schedule type = Basic
    • Run every = 5 minutes
  • Alert conditions:
    • Perform actions = if number of events
    • is greater than 0 (ie. if an alert is to be generated when a given event does occur)
      • or
    • is equal to 0 (ie. if an alert is to be generated when a given event does not occur)
  • Alert actions:
    • tick Trigger shell script
    • Filename of shell script to execute = splunk-nagios.sh
  • Click Save

REQUIRED:

  • Edit the script located at $SPLUNK_HOME/etc/apps/SplunkForNagios/bin/scripts/splunk-nagios.sh and change the following variables so that they are relevant to your environment:
    • SPLUNKSERVER=splunk01 (ie. hostname of the splunk server)
    • WWW=splunk (ie. the hostname of the splunk search head)
    • NSCABIN=/usr/lib/nagios/plugins (ie. location of send_nsca on your splunk server)
    • NSCACFG=$NSCABIN (ie. location of send_nsca.cfg on your splunk server)
    • NSCAHOST=nagios.abc.com.au (ie. Fully Qualified Domain Name of your Nagios server)
    • NSCAPORT=5667 (ie. port number of the nsca daemon on your Nagios server)

Thank You

  • Tim Hartmann for Livestatus assistance
  • Stephen Ho for dashboard optimizations
  • Wil Cooley for additional field extractions

Road Map

  • 4.1
    • Performance Charts by Host or Service Group
    • Alerts by Host or Service Group
    • Availability Reports for Host and Service Groups

Disclaimer

  • This app has been created to work with Nagios Core version 4 and Nagios XI and it may or may not suit your specific purposes.

Copyright (c) 2015 Luke Harris. All Rights Reserved.

License

  • GNU GENERAL PUBLIC LICENSE Version 3

Older Versions

v3.0.0

  • Added Livestatus dashboards
  • Added Service Acknowledgement
  • Added Host and Service Downtime integration

v2.0.1

  • fixed bug in Livestatus Alerts Dashboard
  • added check_splunk_license script and new dashboard: Nagios Splunk License Usage Graph

v2.0

  • added external lookup scripts for integration with MK Livestatus
  • added 2 dashboards updated with live status data from Nagios
  • added a CMDB Report and Service Alerts by Service Group
  • added 5 Cisco Network Dashboards with Graphs of Network Interface Utilization, CPU, Memory, Temperature and Gateway Usage sourced from Nagios Plugin Performance Data
  • added AIX Filesystem Usage Graphs
  • added BSD specific Host Dashboard

v1.1.1

  • added 2 NAS Dashboards with Graphs of Storage Usage, Quota Usage, SAVVOL Usage, Connections by Protocol, etc (EMC Isilon and Celerra)

v1.1

v1.0

  • initial release

Release Notes

Version 4.0.0
July 30, 2015

Major re-write of all dashboards using Simple XML, leveraging inputs from the Splunk Supported "Splunk Add-on for Nagios Core" and tested successfully with Nagios XI.
Major rewrite of all custom python search commands for integration with the latest version of MK Livestatus
Added new dashboards:
* Overview dashboard featuring Alerts & Notifications over time
* Recurring Alerts dashboard
* Gearman Workers dashboard
* Calendar Heatmap dashboard (D3)
* Network Map (D3)
Added the ability to acknowledge Host alerts via MK Livestatus

Version 3.0.0
Sept. 27, 2013

All of the external lookup scripts for MK Livestatus have been updated with support for multiple MK Livestatus servers.
A number of field extractions have been updated, as well as additional macros and a new event type.
I have also added several very powerful dashboards:
Livestatus Network Health
Livestatus Service Alerts
Livestatus Host SLA
Livestatus Service SLA
Livestatus Host Groups
Livestatus Service Groups
Livestatus Service Acknowledgement
Livestatus Host and Service Downtime
Host Availability
Top 100 Alerts
All dashboards are now configured to use JSChart (JavaScript instead of Flash)

Version 2.0.1
Sept. 22, 2011

fixed bug in Livestatus Alerts Dashboard; added check_splunk_license script and new dashboard: Nagios Splunk License Usage Graph

Version 2.0
Sept. 19, 2011

added external lookup scripts for integration with MK Livestatus; added 2 dashboards updated with live status data from Nagios; added a CMDB Report and Service Alerts by Service Group; added 5 Cisco Network Dashboards with Graphs of Network Interface Utilization, CPU, Memory, Temperature and Gateway Usage; added AIX Filesystem Usage Graphs; added BSD specific Host Dashboard

Version 1.1.1
May 22, 2011

v1.1.1
------
- added 2 NAS Dashboards with Graphs of Storage Usage, Quota Usage, SAVVOL Usage, Connections by Protocol, etc (EMC Isilon and Celerra)

v1.1
----
- added 4 all new Powerful Views with Graphs of metal level metrics sourced from Nagios Plugin Performance Data
- added Nagios Alerts Form Search with an auto-populating drop-down list of all device names to easily display relevant alert history
- added 5 all new field extractions for CIM compliance: http://www.splunk.com/base/Documentation/latest/Knowledge/UnderstandandusetheCommonInformationModel

Version 1.0
July 19, 2010

472
Installs
15,004
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.