John Murphy's presentation on well designed Nagios configurations. The presentation was given during the Nagios World Conference North America held Sept 25-28th, 2012 in Saint Paul, MN. For more information on the conference (including photos and videos), visit: http://go.nagios.com/nwcna

1. Rational Configuration Design
To Prevent Irrational Problem Solving
John Murphy

2. Introduction
Basic Advanced
Contacts Parents and
dependencies
Managing exceptions
Hosts Automation
Services
2012 2

3. Our Scenario
2012 3

4. Contacts

5. Contacts
Contact User
Contact address for Login account for an
support. actual user.
Email, SMS, No contact
Ticketing, etc. information.
2012 5

6. Contacts
Contact Definition
define contact { define contact {
contact_name cu-contact name contact-user
contactgroups cg-main host_notifications_enabled 1
email servers@domain.com service_notifications_enabled 1
use contact-user host_notification_period 24x7
} service_notification_period 24x7
host_notification_options d,u
define contactgroup { service_notification_options c
contactgroup_name cg-main host_notification_commands notify-h-email
alias Kmart Contact service_notification_commands notify-s-email
contactgroup_membersvg-team register 0
} }
2012 6

7. Contacts
User Definition
define contact { define contact {
contact_name vu-jsmurphy name read-contact
contactgroups vg-team host_notifications_enabled 0
use read-contact service_notifications_enabled 0
} host_notification_period none
service_notification_period none
define contactgroup { host_notification_options n
contactgroup_name vg-team service_notification_options n
alias Kmart Team host_notification_commands check_none
} service_notification_commands check_none
register 0
define contactgroup { }
contactgroup_name cg-main
alias Kmart Contact
contactgroup_membersvg-team
}
2012 7

8. Contacts
LDAP/AD For Nagios Core
ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"
<Directory "/usr/local/nagios/sbin">
SetEnv TZ "Australia/Melbourne"
Options ExecCGI
AllowOverride None
Order allow,deny
Allow from all
AuthName "Nagios Core"
AuthType Basic
# AuthUserFile /usr/local/nagios/etc/htpasswd.users
# Require valid-user
AuthBasicProvider ldap
AuthName “Nagios server"
AuthzLDAPAuthoritative off
AuthLDAPBindDN "CN=bindAccount,OU=User,DC=domain,DC=com"
AuthLDAPBindPassword xxxxxxxxx
AuthLDAPURL ldaps://domain.com/OU=User,DC=Domain,DC=com?sAMAccountName?sub?
(objectClass=user)
AuthLDAPGroupAttribute member
AuthLDAPGroupAttributeIsDN on
Require ldap-group CN=NagiosAccessGroup,OU=Groups,DC=domain,DC=com
</Directory>
2012 8

9. Contacts Summary
Distinguish between your users and your
contacts.
Use an existing authentication source for your
user logins.
Consider the end-user experience… try to
ensure it’s easy to get the information they
need.
2012 9

10. Hosts

11. Hosts
Focus on minimizing host configuration to
make automation easier.
Use templates to assign user view information.
Create host groups based on shared
monitoring profiles.
2012 11

12. Hosts
Host Definitions
define host { define host {
host_name exchange01 name srv-template
use srv-template alias Server host template
alias Exchange server check_command check_icmp!250.0,60%!
address exchange01 500.0,80%
parents switch001,switch002 max_check_attempts 3
hostgroups srv-exchange, srv-windows check_interval 10
icon_image exchange.png retry_interval 2
register 1 check_period 24x7
} contact_groups cg-main
notification_interval 60
notification_period 24x7
define hostgroup { notification_options d,f
hostgroup_name srv-windows notifications_enabled 1
alias Windows group register 0
} }
2012 12

13. Hosts Summary
Minimize configuration in host objects to make
automation easier.
Hostnames allow for easier maintenance than
IP addresses.
Create logical host-groupings that will make
service assignment easier e.g. OS type,
Location, Applications it serves.
2012 13

14. Services

15. Services
Keep services as generic as possible to
prevent the need for duplicate services.
Minimizing service templates allows for easier
management and baseline changes.
Use service groups for applications.
2012 15

16. Services
Service Definitions
define service { define service {
service_description Windows C: usage name main-service-template
use main-service-template service_description main service template
hostgroup_name srv-windows,srv-v-windows max_check_attempts 3
check_command check_interval 10
check_nt!USEDDISKSPACE!-w 80 -c 90 retry_interval 2
contact_groups cg-main,cg-main-SMS check_period 24x7
register 1 notification_interval 60
} notification_period 24x7
notification_options c
register 0
}
2012 16

17. The puzzle completed
2012 17

18. Services Summary
Strike a balance between your service-
templates and your service definitions.
Service groups are a very useful feature when
used appropriately, used inappropriately they
are an administrative burden.
Device life-cycle happens, ensure your
configuration isn’t burdened by over-
complexity.
2012 18

19. Advanced

20. Good Parenting (or how to not get woken up 20 times at ~3am)
Parenting Service Dependencies
Use host parenting. Parent indirectly
Use host parenting. monitored services
with service
Use host parenting. dependencies.
2012 20

21. Indirect Services
…And the art of dependencies
A typical ESX
monitoring setup…
Q. But what happens
when the vSphere
server fails?
2012 21

22. Indirect Services
…And the art of dependencies
A. Something like this
2012 22

23. Indirect Services
…And the art of dependencies
define service { define servicedependency {
host_name vSphereServer dependent_hostgroup_name srv-v-windows
service_description Ping dependency dependent_service_description CPU Usage
use main-service-template host_name vSphereServer
check_command check_ping!100,80%!200,90% service_description Ping dependency
register 1 inherits_parent 1
} execution_failure_criteria w,u,c,p
notification_failure_criteria w,u,c
define service { dependency_period 24x7
service_description CPU Usage }
use main-service-template
hostgroup_name srv-v-windows
check_command check_esx!CPU
contact_groups cg-main
register 1
}
2012 23

24. Managing Exceptions
Clearly label
exceptions in your
config.
Make sure you can
use the same solution
again if necessary.
Image by Mike Bade:
http://robotseatingpies.blogspot.com.au/2011/06/robots-dont-have-feelings_16.html
2012 24

25. Automation (or intrapreneurship ideas for the lazy)
Every piece of infrastructure is a potential data
source… make use of it!
AD/LDAP Servers.
Virtual infrastructure API’s.
Patching systems.
Asset databases.
Network management platforms.
Network LLDP/CDP tables.
SNMP enabled servers.
Help I’m running out of space!
2012 25

26. Q&A

27. Thanks For Listening!