Nagios xi displaying exessive hostgroups information

TSCAdmin · Post by **TSCAdmin** » Tue Jan 17, 2012 6:22 am

Dear Support team,

I have added a user to a bunch of hosts. When I login as that user and click "Hostgroup Summary" in Nagios xi I see the following screen

nagios_xi.PNG

Now, when I login as same user and click "Host Groups" in Nagios Core, I see the following screen

nagios_core.PNG

Clearly it is showing more than enough information (hostgroups) in Nagios xi. Is there a way to suppress that?

Thanks

Post by **lmiltchev** » Tue Jan 17, 2012 12:06 pm

Can you elaborate a little bit more on "I have added a user to a bunch of hosts"?
Did you add this user to the hosts, members of "DR Servers..." hostgroup only, or you also added this user to OTHER hosts?
Are members of "DR Servers..." hostgroup are ALSO members of other hostsgroups?

Did you use:
Core Config Nanager->Monitoring->Hosts->Modify->Common Settings->Host groups->Modify to add each individual host to a hostgroup
or
Core Config Nanager->Monitoring->Host Groups->Modify->Members->Modify and added all of the members of this particular hostgroup?

What are the security settings/authorization level for this user? Do you have any checkboxes selected under Admin->Users->Manage Users->Edit?

Can you describe in more details the steps you took, so we ca recreate the problem and try to troubleshoot it?

Make sure you don't have multiple instances of Nagios, running on your server. Have you tried restarting the Nagios server?

TSCAdmin · Post by **TSCAdmin** » Tue Jan 17, 2012 3:27 pm

Very sorry for not including this information in the first post.

I used CCM to edit each host manually and add the user in Alerts section. Now it looks like this:

Code: Select all

define host{
	host_name	server-x
	contacts	user-007
	....
}

Apart from this I have made no changes anywhere besides, obviously, creating this user "user-007".

There are no checkboxes selected under Admin->Users->Manage Users and the user is created as User, not Admin.

I do not have multiple instances of Nagios running. Yes it did restart the Nagios server after applying the configuration.

Please let me know if any more information is required. Thanks.

Post by **lmiltchev** » Tue Jan 17, 2012 4:37 pm

When you were manually adding the user to each host, did you add it also to hosts, that are not members of the "DR Servers..." hostgroup? What contact groups this user is a member of?

This user may be able to see all of these hosts, not because of a direct relationship (notification contact for these hosts), but because of an indirect relationship (being a member of a different contact group).

Please, review our documentation on multi-tenancy and see if this applies to your type of setup.

http://assets.nagios.com/downloads/nagi ... enancy.pdf

TSCAdmin · Post by **TSCAdmin** » Thu Jan 19, 2012 1:44 am

Could you please re-read my first post? I have attached a screenshot from Nagios xi and Nagios Core.

I understand your answer but what I don't understand is - why is there a difference between what is displayed in Nagios Core and Nagios xi for the same configuration when logged in as a specific user?

For my setup Nagios xi is displaying all the hostgroups that are associated with the host members of dr-servers hostgroup. However, when I login as same user in Nagios Core it would display only "dr-servers" hostgroup.

Does that help?

Thanks

mguthrie · Post by **mguthrie** » Thu Jan 19, 2012 10:30 am

I understand your answer but what I don't understand is - why is there a difference between what is displayed in Nagios Core and Nagios xi for the same configuration when logged in as a specific user?

Indeed, this is the mystery on this thread. There's not a simple answer as to what might cause this, but it's possible something got out of sync with the ndoutils backend. Do you see any recent errors in the /usr/local/nagios/var/nagios.log file related to ndo2db or ndoutils?

Is this user supposed to be able to view the hosts that are in the unauthorized hostgroups?

Were you at any time using a RAM disk for the status.dat or objects.cache file? If so, can you verify that those locations match the /usr/local/nagios/etc/nagios.cfg file?

TSCAdmin · Post by **TSCAdmin** » Tue Jan 24, 2012 4:15 am

Hello Mike,

Thank you for the pointers, they might come in handy sometime.

mguthrie wrote:Indeed, this is the mystery on this thread. There's not a simple answer as to what might cause this, but it's possible something got out of sync with the ndoutils backend. Do you see any recent errors in the /usr/local/nagios/var/nagios.log file related to ndo2db or ndoutils?

I just did a tail -f nagios.log and restarted ndo2db daemon and got the following in the logs

Code: Select all

[1327394222] ndomod: Error writing to data sink!  Some output may get lost...
[1327394222] ndomod: Please check remote ndo2db log, database connection or SSL Parameters
[1327394238] ndomod: Successfully reconnected to data sink!  0 items lost, 2193 queued items to flush.
[1327394238] ndomod: Successfully flushed 2193 queued items to data sink

mguthrie wrote:Is this user supposed to be able to view the hosts that are in the unauthorized hostgroups?

No, this user can see only a few hosts which have this user as a contact and nothing else. I have verified this by logging in as this user in Nagios Core and xi.

mguthrie wrote:Were you at any time using a RAM disk for the status.dat or objects.cache file? If so, can you verify that those locations match the /usr/local/nagios/etc/nagios.cfg file?

I don't think we were ever using RAM disk for either of these files. I have the following entries in nagios.cfg

Code: Select all

status_file=/usr/local/nagios/var/status.dat
object_cache_file=/usr/local/nagios/var/objects.cache

In the ndo2db I have the following entries:

Code: Select all

ndo2db_user=nagios
ndo2db_group=nagios

db_name=nagios
db_prefix=nagios_

db_user=ndoutils
db_pass=****

But when I login to MySQL as user ndoutils I can see only information_schema and nagios databases not nagiosql. Is that a normal behaviour?

scottwilkerson · Post by **scottwilkerson** » Tue Jan 24, 2012 12:51 pm

TSCAdmin wrote:But when I login to MySQL as user ndoutils I can see only information_schema and nagios databases not nagiosql. Is that a normal behaviour?

This is normal behavior, the ndoutils user only act on the nagios database.

Is your MySQL db on the same machine or have you offloaded it to another server?

mguthrie · Post by **mguthrie** » Wed Jan 25, 2012 12:28 pm

Based on reports from a few different users now, there maybe a logical bug somewhere in the permissions logic for xi. If you come across a simple way to reproduce this issue, go ahead and post it. It may save us some time as we investigate this.

mguthrie · Post by **mguthrie** » Wed Jan 25, 2012 3:54 pm

Ok, so I did some digging on this, and here's what I found. Let me know if you're seeing other issues.

- With Nagios Core, and the "Unified" Hostgroups pages in xi, hostgroups are only visible for a contact if they are authorized for *all* hosts in that hostgroup.

- With xi's hostgroup pages, hostgroups are visible if the user has *any* authorized hosts in that group, but it will only show authorized hosts.

I discussed this with our senior developer, and he's going to look into changing this logic for Core, since we both felt the more "expected" behavior would be to see the group if it has *any* members.

Nagios Support Forum

Nagios xi displaying exessive hostgroups information

Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information

Re: Nagios xi displaying exessive hostgroups information