All Apps and Add-ons

Nagios Performance Graphs not showing up

lovespie
New Member

CPU Usage, Load Average, Memory Usage, Swap Usage, Total Processes, and Zombie Processes are not showing up in the Nagios Performance Graphs. In its place is just "No results found. Inspect ..."

Warning and Critical Alerts, and Top 10 Service Notifications are working so I don't think the problem is MK Livestatus.

I think it has something to do with what I'm naming the service description but I don't know what the name should be or which file or tag to edit. I've tried renaming the service description to "Memory Usage", "Memory usage", "mem_used", and "mem_total", but every time the result is the same.

For now the plugin used is check_mem.pl

From service-perfdata:
1377833717 src_host="localhost" perfdata="SERVICEPERFDATA" name="Memory Usage" severity="CRITICAL" attempt="3" statetype="HARD" executiontime="0.032" latency="0.186" reason="CRITICAL - 96.7% (588532 kB) used!" result="TOTAL=608480KB;;;; USED=588532KB;;;; FREE=19948KB;;;; CACHES=419540KB;;;;"

From props.conf
EXTRACT-mem_used = Memory usage=(?\d+.\d+)Mb;
EXTRACT-mem_total = Memory usage=\d+.\d+Mb;\d+.\d+;\d+.\d+;\d+.\d+;(?[^;]*)(?=)

0 Karma

cvervais
Path Finder

I'm running into the same thing and I'm wondering if it's because of the src_host= field. On my install it's localhost as well. So, looking at the graphs it seems to be expecting the name of the host there that you're trying to view data for.

For example, for CPU usage for one of my hosts it's using this search query:

index=nagios (sourcetype="nagioshostperf" OR sourcetype="nagiosserviceperf") src_host="wp-admin-prod" | bin span=5m _time | table *

But, since there are no events in my nagios index where src_host="wp-admin-prod", no results are going to be found. In all my events the value for src_host is localhost.

Here are the command definitions I used in my nagios commands.cfg file:

'nagios-process-host-perfdata' command definition

define command{
command_name nagios-process-host-perfdata
command_line /usr/bin/printf "%b" "$TIMET$ src_host=\"$HOSTNAME$\" perfdata=\"HOSTPERFDATA\" hoststate=\"$HOSTSTATE$\" attempt=\"$HOSTATTEMPT$\" statetype=\"$HOSTSTATETYPE$\" executiontime=\"$HOSTEXECUTIONTIME$\" reason=\"$HOSTOUTPUT$\" result=\"$HOSTPERFDATA$\"\n" >> /usr/local/nagios/var/host-perfdata
}

'nagios-process-service-perfdata' command definition

define command{
command_name nagios-process-service-perfdata
command_line /usr/bin/printf "%b" "$TIMET$ src_host=\"$HOSTNAME$\" perfdata=\"SERVICEPERFDATA\" name=\"$SERVICEDESC$\" severity=\"$SERVICESTATE$\" attempt=\"$SERVICEATTEMPT$\" statetype=\"$SERVICESTATETYPE$\" executiontime=\"$SERVICEEXECUTIONTIME$\" latency=\"$SERVICELATENCY$\" reason=\"$SERVICEOUTPUT$\" result=\"$SERVICEPERFDATA$\"\n" >> /usr/local/nagios/var/service-perfdata
}

So, it's likely got to do with $HOSTNAME$ macro not being set properly by nagios but, I'm at a loss to get any further.

0 Karma

cvervais
Path Finder

Figured it out, it was a rookie mistake on my part. In the nagios.cfg I had host_perfdata_command and service_perfdata_command set incorrectly. The values were process-host-perfdata and process-service-perfdata which were defaults. The command definitions for those in the commands.cfg file don't print out the right hostname and aren't the right commands to be running anyways.

Per the documentation (Yeah I didn't RTFM carefully) the commands the instructions specify are nagios-process-host-perfdata and nagios-process-service-perfdata respectively. Once I updated nagios.cfg to these all is well

0 Karma

lukeh
Contributor

Hi 🙂

I have removed the name field as a requirement from the dashboard in Splunk for Nagios version 3.0.0, please upgrade and let me know how you go 🙂

All the best,

Luke 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...