Syslog - Nagios?

[James Turnbull]

Mike Koponick wrote:
>
> I would like to send Syslog information from a remote Nagios sensor to 
> the Central Server via NSCA, since it’s already in place.
>
> I’m trying to see if there is a feasible way to parse out the 
> information I need, using something like SWATCH and send it to the 
> Central Server, who should be able to send it to a MySQL server.
>
> I was thinking that I might be able to write the parsed out 
> information to the Nagios command file, but I don’t think that would 
> work. My thinking is that if it was written to the Nagios command file 
> that I would be able to send it the parsed out information via the 
> Nagios process, but I might be WAY off base.
>
> Has anyone ever done anything like this before?
>
> Thanks in advance,
>
> Mike
>
Yes - it's pretty easy. With syslog-NG you can write template output 
something like:

destination d_facility_crit { pipe("/var/run/nagios.pipe" 
template("$HOST,$FACILITY,2,'$MSG'\n") template_escape(no)); };

The template being the data in a form that NSCA can read. The 
destination is a named pipe. Then echo the contents of the pipe into the 
send_nsca binary.

Regards

James Turnbull

-- 
James Turnbull <james at lovedthanlost.net>
---
Author of Pro Nagios 2.0
(http://www.amazon.com/gp/product/1590596099/)

Hardening Linux
(http://www.amazon.com/gp/product/1590594444/)
---
PGP Key (http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0C42DF40)



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null