Configure your Nagios Core instance for the Splunk Add-on for Nagios Core

To use the Splunk Add-on for Nagios Core, you must prepare your Nagios Core instance by enabling logs and log items and updating configurations.

In all of the following configuration instructions and examples, replace $NAGIOS_HOME with your Nagios folder. For example, /usr/local/nagios.

Enable main log and log items

Enable main log and log items in $NAGIOS_HOME/etc/nagios.cfg as shown.

log_file=/usr/local/nagios/var/nagios.log
log_notifications=1
log_service_retries=1
log_host_retries=1
log_event_handlers=1
log_initial_states=1
log_current_states=1
log_external_commands=1
log_passive_checks=1

Update configurations in nagios.cfg

If you want to monitor performance information, update the following configurations in $NAGIOS_HOME/etc/nagios.cfg.

process_performance_data=1
host_perfdata_file_mode=a
service_perfdata_file_mode=a
host_perfdata_file_processing_interval=86400
service_perfdata_file_processing_interval=86400
service_perfdata_file=$NAGIOS_HOME/var/service-perfdata
host_perfdata_file=$NAGIOS_HOME/var/host-perfdata

Do not set the following configurations in $NAGIOS_HOME/etc/nagios.cfg.

#service_perfdata_command=...
#host_perfdata_command=...
#service_perfdata_file_template=...
#host_perfdata_file_template=...

If they are commented, keep them commented. If they are set, remove or comment the options. If these lines are set, the field extractions in the add-on might fail.

Update configurations in templates.cfg

Update the following configuration in $NAGIOS_HOME/etc/objects/templates.cfg for both host and service templates.

process_perf_data 1 ; Process performance data

Validate configuration files

Run the following command to check your Nagios configuration file for errors.

$NAGIOS_HOME/bin/nagios -v $NAGIOS_HOME/etc/nagios.cfg

If your config file is valid, reload Nagios with the following command.

/etc/init.d/nagios reload