Date: Thu, 28 Mar 2024 12:27:23 +0000 (UTC) Message-ID: <413347658.3870.1711628843166@skald.opmantek.com> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_3869_892511283.1711628843166" ------=_Part_3869_892511283.1711628843166 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html
opHA provides multi-server polling with a central dashboard provided by = the Primary. It does NOT handle the escalation of real time events of the p= ollers. Escalations are handled on each Poller server; emails, etc are sent= from the poller. For more information on configuring escalation: NMIS8 Configuration
The typical solution here is to have the poller send NMIS events using s= yslog to the Primary which are stored in poller_event.log, then opEvents pr= ocesses this event log instead of the local event.log and opEvents on a sin= gle server can handle the events for all pollers. The nodes from the = remote pollers will need to be added to opEvents so it knows what to do wit= h them.
With opEvents, any event can be handled from any source, and include esc= alations, etc. (opEvents running on a Primary will carry out all actions as= the Primary not as the poller)
Step 1 - Enable opHA Primary to receive syslogs<=
br>
a. Open /etc/rsyslog.conf
b. Verify you have these modules
# Provides UDP sy= slog reception $ModLoad imudp.so $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp.so $InputTCPServerRun 514
c. We need to add a section to tell the NMIS Primary to receive the even= t log form the poller and where to store it. Under this section add:
#poller NMIS serv= ers use local1 by default, capture that into poller_event.log local1.* /usr/local/nmis8/logs/poller_event.log
d. Save the changes made to rsyslog.conf
e. Open /etc/sysconfig/rsyslog
f. Find the entry: SYSLOGD_OPTIONS=3D"-c 5" and change SYSLOGD_OPTIONS=3D"-=
c 4"
g. Restart the syslog service
service rsyslogd = restart
h. Add the file poller_event.log to be processed by opEvents. Update <= ;omk>/conf/opCommon.nmis:
'opevents_logs' = =3D> { ... 'nmis_pollerlog' =3D> [ ## Note - earlier versions used nmis_sl= avelog=20 '<nmis9_logs>/poller_event.log' ] }
This completes setup on the Primary opHA Server.
Step=
2 - Changes to the opHA POLLER to send the syslog
a. Open /usr/local/nmis8/conf/Config.nmis
b. Locate this entry:
'syslog' =3D> = { 'syslog_events' =3D> 'true', 'syslog_facility' =3D> 'local1', 'syslog_server' =3D> 'YOURIPADDRESS:tcp:514', 'syslog_use_escalation' =3D> 'false'
c. Modify YOURIPADDRESS in 'syslog_server' to point to the Primary opHA = server.
d. Save changes to Config.nmis
e. Restart the syslog service
service rsyslogd = restart
f. Test transmission of the syslog from the poller to the Primary
/usr/local/nmis8/= admin/testsyslog.pl