Matejunkie » icinga

howto: Let nginx serve the Nagios web-interface

Mike Adolphs — Thu, 21 May 2009 15:33:45 +0000

For serving the Nagios web-interface it’s not necessary to run an Apache webserver. It also works quite well with others like lighttpd or nginx. Here’s how to configure nginx with basic auth so that Nagios knows who you are.

Prerequisites

Almost any package management system like apt pulls the Apache webserver as a dependency. I therefore strongly suggest you to compile and install Nagios manually since then you’ve got way more options to play with. Stick to the official documentation if you consider to do so. The following config files are all based on Nagios’ default configure options.

Get CGI going

nginx isn’t capable to serve dynamic content by default. You have to send this through a wrapper like we did in the last howto to get PHP and Passenger going. Therefore download a copy of the lighttpd source, unpack, configure and make it. Then copy the spawn-fcgi from the src directory to a local directory, e.g. /usr/bin:

user@host ~ $ wget http://www.lighttpd.net/download/lighttpd-1.4.18.tar.bz2
user@host ~ $ tar xvjf lighttpd-1.4.18.tar.bz2
user@host ~ $ cd lighttpd-1.4.18/
user@host ~/lighttpd-1.4.18 $ ./configure
user@host ~/lighttpd-1.4.18 $ make
user@host ~/lighttpd-1.4.18 $ sudo cp src/spawn-fcgi /usr/bin/spawn-fcgi

Then download the actual fcgiwrapper from github, unpack and make it. Afterwards copy the binary to a local directory, e.g. /usr/bin, as well:

user@host ~ $ wget http://github.com/gnosek/fcgiwrap/tarball/master
user@host ~ $ tar xzf gnosek-fcgiwrap-cdd6b8475744989940f9ce8322999e9ed4f0a6ec.tar.gz
user@host ~ $ cd gnosek-fcgiwrap-cdd6b8475744989940f9ce8322999e9ed4f0a6ec/
user@host ~ $ make
user@host ~ $ sudo mv fcgiwrap /usr/bin/
user@host ~ $ sudo chown root:root /usr/bin/fcgiwrap

Create a wrapper script to let the spawn-fcgi binary run a fcgiwrap instance and make it executable.

/usr/bin/c-fcgi.sh

#!/bin/sh
/usr/bin/spawn-fcgi -f /usr/bin/fcgiwrap -a 127.0.0.1 -p 49233 -P /var/run/fastcgi-c.pid -u www-data -g www-data

user@host: ~ $ sudo chmod +x /usr/bin/c-fcgi.sh

You may also create an init script to let the spawner run the fcgiwrap instance during boot.

/etc/init.d/c-fcgi

#!/bin/bash
C_SCRIPT=/usr/bin/c-fcgi
RETVAL=0
case "$1" in
	start)
		echo "Starting fastcgi"
		$C_SCRIPT
		RETVAL=$?
  ;;
	stop)
		echo "Stopping fastcgi"
		killall -9 fcgiwrap
		RETVAL=$?
  ;;
	restart)
		echo "Restarting fastcgi"
		killall -9 fcgiwrap
		$C_SCRIPT
		RETVAL=$?
  ;;
	*)
		echo "Usage: c-fastcgi {start|stop|restart}"
		exit 1
  ;;
esac
exit $RETVAL

Then start the spawner and put it in the default runlevel:

user@host ~ $ sudo update-rc.d c-fcgi defaults
user@host ~ $ sudo /etc/init.d/c-fcgi start

Configuring nginx

Assuming Nagios’ static html files reside in /usr/local/nagios/share and its cgi’s in /usr/local/nagios/sbin the configuration for an nginx vhost looks like the following:

server {
	listen   80;
	server_name  www.example.com;
 
	access_log  /var/www/example.com/logs/access.log;
 
	location / {
		root   /usr/local/nagios/share;
		index  index.html;
 
		rewrite	^/nagios/images/(.*)\.png /images/$1.png break;
 
		auth_basic		"Restricted";
		auth_basic_user_file	conf/htpasswd;
	}
 
	location ~ \.cgi$ {
		root	/usr/local/nagios/sbin;
		rewrite	^/nagios/cgi-bin/(.*)\.cgi /$1.cgi break;
 
		include /etc/nginx/fastcgi_params;
 
        	fastcgi_pass   127.0.0.1:49233;
	        fastcgi_param  SCRIPT_FILENAME  /usr/local/nagios$fastcgi_script_name;  # same path as above
 
		auth_basic		"Restricted";
		auth_basic_user_file	conf/htpasswd;
 
		fastcgi_param  AUTH_USER          $remote_user;
		fastcgi_param  REMOTE_USER	  $remote_user;
	}
}

Be sure to have the following fastcgi parameters configured in /etc/nginx/fastcgi_params.

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;
 
fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
 
fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
 
fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;
 
# PHP only, required if PHP was built with --enable-force-cgi-redirect
#fastcgi_param  REDIRECT_STATUS    200;

Configuring Nagios

In /usr/local/nagios/etc/cgi.cfg you should turn use_authentication on:

use_authentication=1

Almost finished

After starting Nagios via its init script and a reload of your nginx webserver. it should show you an authentification dialogue window when you point your browser to the server’s url. To get authentication going, you need to provide credentials in /etc/nginx/conf/htpasswd in the following format:

user:password

Note that the password must be encrypted, plain text in this file wouldn’t work (for good reasons). You may want to have an Apache webserver around to use the htpasswd binary for that or you could use a solution from the web like the htpasswd generator, but keep in mind that using a service in the web may cause security troubles.

That should do the job. You’re now able to access your Nagios web-interface via nginx with proper authentication.

This guide also works for Icinga, a nice and shiny Nagios fork which came up two weeks ago. Simply change all names from nagios to icinga and you’re good to go.

Update 1.1: UDP Packet Loss Check Plugin for Nagios

Mike Adolphs — Mon, 11 May 2009 09:36:39 +0000

I’ve changed the small UDP packet loss script yesterday so that it’s now showing the total requests, requests sent to an unknown port and receive errors per check interval. That means, if you’d choose a check interval of 5 minutes, the script shows the amount of the previous mentioned for this time frame. It now creates two temporary files in a directory which you may define via -t/–path-tmp. The file is automatically deleted when it’s size got over 32Kb.
Feel free to grab it from MonitoringExchange (they’ve changed their name due to legal problems with Nagios Enterprises and because of Nagios’ new fork Icinga), via svn or copy’n'paste below.

user@host ~ $ svn co https://svn.matejunkie.com/svn/nagios-plugins/stable/check_udp-packet-loss/ check_udp-packet-loss/

#!/bin/sh
 
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, write to the Free Software
#   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
PROGNAME=`basename $0`
VERSION="Version 1.1,"
AUTHOR="2009, Mike Adolphs (http://www.matejunkie.com/)"
 
ST_OK=0
ST_WR=1
ST_CR=2
ST_UK=3
 
path_tmp="/tmp"
 
print_version() {
    echo "$VERSION $AUTHOR"
}
 
print_help() {
    print_version $PROGNAME $VERSION
    echo ""
    echo "$PROGNAME is a Nagios plugin to monitor the UDP packet"
    echo "loss via netstat. It writes a temporary file to a configurable"
	echo "directory and compares it's values against the ones from the check"
	echo "before."
	echo "That means the actual result shows the amount of overall packets,"
	echo "received, receive errors and/or packets recieved to unknown port"
	echo "for the last check interval you've chosen."
    echo ""
    echo "$PROGNAME check_udp-packet-loss.sh"
    echo ""
    echo "Options:"
    echo "  --warning|-w)"
    echo "    Sets a warning level for packet receive errors. Default is:"
    echo "    off"
    echo "  --critical|-c)"
    echo "    Sets a critical level for packet receive errors. Default is:"
    echo "    off"
    echo "  --path-tmp|-t)"
    echo "    Sets the path for the temporary file. Default is: /tmp"
    exit $ST_UK
}
 
while test -n "$1"; do
    case "$1" in
        --help|-h)
            print_help
            exit $ST_UK
            ;;
        --version|-v)
            print_version $PROGNAME $VERSION
            exit $ST_UK
            ;;
        --path-tmp|-t)
            path_tmp=$2
            shift
            ;;
        --warning|-w)
            warn=$2
            shift
            ;;
        --critical|-c)
            crit=$2
            shift
            ;;
        *)
            echo "Unknown argument: $1"
            print_help
            exit $ST_UK
            ;;
    esac
    shift
done
 
check_filesize() {
    if [ -f $path_tmp/udp-errors.log ]
    then
        size=`du $path_tmp/udp-errors.log | awk '{print $1}'`
	if [ $size -gt 32 ]
        then
            rm $path_tmp/udp-errors.log
            touch $path_tmp/udp-errors.log
        fi
    else
        touch $path_tmp/udp-errors.log
    fi   
}
 
get_packet_loss() {
	date_beg=`date`
	echo "+++ $date_beg +++" >> $path_tmp/udp-errors.log
    netstat -us|grep 'packets received' >> $path_tmp/udp-errors.log
    netstat -us|grep 'to unknown port' >> $path_tmp/udp-errors.log
    netstat -us|grep 'packet receive errors' >> $path_tmp/udp-errors.log
	date_end=`date`
	echo "--- $date_end ---" >> $path_tmp/udp-errors.log
	tac /tmp/udp-errors.log | awk '/---/{p=1} p{print} /+++/{p=0;if \
(count++==1) exit}' > $path_tmp/udp-errors.log.tmp
}
 
chk_packet_loss() {
	p_receive_1st=`tac $path_tmp/udp-errors.log.tmp | grep -m1 'packets \
received' | awk '{print $1}'`
	p_receive_2nd=`tac $path_tmp/udp-errors.log.tmp | grep 'packets \
received' | sort -r | grep -m1 'packets received' | awk '{print $1}'`
	p_unknown_1st=`tac $path_tmp/udp-errors.log.tmp | grep -m1 'to unknown \
port' | awk '{print $1}'`
	p_unknown_2nd=`tac $path_tmp/udp-errors.log.tmp | grep 'to unknown \
port' | sort -r | grep -m1 'to unknown port' | awk '{print $1}'`
	p_errors_1st=`tac $path_tmp/udp-errors.log.tmp | grep -m1 'receive \
errors' | awk '{print $1}'`
	p_errors_2nd=`tac $path_tmp/udp-errors.log.tmp | grep 'receive errors' \
| sort -r | grep -m1 'receive errors' | awk '{print $1}'`
 
	if [ ! $p_receive_2nd = 0 ]
	then
		p_receive=`expr $p_receive_2nd - $p_receive_1st`
	else
		p_receive=0
	fi
 
	if [ ! "$p_unknown_2nd" = 0 ]
	then
		p_unknown=`expr $p_unknown_2nd - $p_unknown_1st`
	else
		p_unknown=0
	fi
 
	if [ ! "$p_errors_2nd" = 0 ]
	then
		p_errors=`expr $p_errors_2nd - $p_errors_1st`
	else
		p_errors=0
	fi
}
 
val_wcdiff() {
    if [ ${warn} -gt ${crit} ]
    then
        wcdiff=1
    fi
}
 
check_filesize
get_packet_loss
chk_packet_loss
 
if [ -n "$warn" -a -n "$crit" ]
then
    val_wcdiff
    if [ "$wcdiff" = 1 ]
    then
        echo "The warning level should be lower than the critical level. \
Please adjust them."
        exit $ST_UK
    fi
fi
 
if [ -n "$warn" -a -n "$crit" ]
then
    if [ "$p_unknown" -ge "$warn" -a "$p_unknown" -lt "$crit" ]
    then
        echo "WARNING - $p_receive total packets received, $p_unknown \ 
went to unknown port, $p_errors receive errors! | \
'received'=$p_receive 'unknown_port'=$p_unknown 'errors'=$p_errors"
        exit $ST_WR
    elif [ "$p_unknown" -ge "$crit" ]
    then
        echo "CRITICAL - $p_receive total packets received, $p_unknown \
went to unknown port, $p_errors receive errors! | \
'received'=$p_receive 'unknown_port'=$p_unknown 'errors'=$p_errors"
        exit $ST_CR
    else
        echo "OK - $p_receive total packets received, $p_unknown \
went to unknown port, $p_errors receive errors! | \
'received'=$p_receive 'unknown_port'=$p_unknown 'errors'=$p_errors"
        exit $ST_OK
    fi
else
    echo "OK - $p_receive total packets received, $p_unknown went to unknown \
port, $p_errors receive errors! | 'received'=$p_receive \
'unknown_port'=$p_unknown 'errors'=$p_errors"
    exit $ST_OK
fi