Creating an Event Handler for the Nagios Server

Create a configuration file.

sudo touch /usr/local/nagios/etc/objects/Linux-FTP-Server.cfg

Edit the configuration file.

sudo vim /usr/local/nagios/etc/objects/Linux-FTP-Server.cfg

Add the following lines to the file. The LINUXCLIENT_IP_ADDRESS can be found on the hands-on lab page. Note that event_handler is disabled at a later step in the video.

define host {
    use             linux-sever
    host_name       linux-ftp-server
    alias           ftpSrv
    address         LINUXCLIENT_IP_ADDRESS
}

define hostgroup {
    hostgroup_name      linux-ftp-servers
    alias               linux FTP Servers
    members             linux-ftp-server
}

define service {
    use                     generic-service
    host_name               linux-ftp-server
    service_description     ftp server check
    check_command           ftp_server_check
    check_interval          1
    max_check_attempts      2
 #   event_handler           restart_ftp_server
}

Save your changes and exit the editor.

Edit the commands configuration file.

sudo vim /usr/local/nagios/etc/objects/commands.cfg

Add the following lines to the file.

define command {
    command_name        ftp_server_check
    command_line        /usr/local/nagios/libexec/check_ftp -H $HOSTADDRESS$
}

Save your changes and exit the editor.

Edit the Nagios configuration file.

sudo vim /usr/local/nagios/etc/nagios.cfg

Add the following lines to the file.

#My files
cfg_file=/usr/local/nagios/etc/objects/Linux-FTP-Server.cfg

Save your changes and exit the editor.

Check to make sure you don't have any errors.

sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Restart Nagios.

sudo systemctl restart nagios

In a new terminal, log in to the Linux Client using SSH using the credentials found on the hands-on lab page.

ssh cloud_user@LINUXCLIENT_IP_ADDRESS

Install vsftpd.

sudo yum install vsftpd

Start vsftpd.

sudo systemctl start vsftpd

Verify vsftpd is running.

sudo systemctl status vsftpd

Open a firewall port.

sudo firewall-cmd --permanent --add-port=21/tcp

Reload the firewall.

sudo firewall-cmd --reload

Back in the server terminal, change the user to nagios.

sudo su nagios

Transfer to the nagios directory.

cd ../nagios

Generate a key pair. Press enter for all of the options to create a default pair.

ssh-keygen

Open the key file.

vim .ssh/id_rsa.pub

Select the entire key and copy it.

Exit the editor.

Back in the client terminal, transfer to being the super user.

sudo su

Edit the authorized keys.

vim /root/.ssh/authorized_keys

Paste the key from the server to the end of the file.

Save your changes and exit the editor.

Back in the server terminal, SSH into the client.

ssh root@LINUXCLIENT_IP_ADDRESS

Make sure you are in the server, and then install mlocate.

sudo yum install mlocate

Find the eventhandler directory for Nagios.

locate -i eventhandler

Copy the default Nagios directory for event handlers. This is the base directory.

Edit the commands configuration file.

sudo vim /usr/local/nagios/etc/objects/commands.cfg

Add the following lines to the file. Make sure to paste the directory from the previous steps as the EVENT_HANDLER_DIRECTORY.

define command {
    command_name        restart_ftp_server
    command_line        EVENT_HANDLER_DIRECTORY/restart_ftp_server.sh $SERVICESTATE$ $HOSTADDRESS$
}

Copy the full path and file name for restart_ftp_server.sh above.

Save your changes and exit the editor.

Create and edit the restart_ftp_server.sh file.

sudo vim EVENT_HANDLER_DIRECTORY/restart_ftp_server.sh

Paste the following text into the file.

#!/bin/bash

if [[ $1 == "CRITICAL" ]]; then
    ssh root@$2 "systemctl restart vsftpd"
fi

Save your changes and exit the editor.

Change ownership and permissions of the file.

sudo chown nagios:nagios EVENT_HANDLER_DIRECTORY/restart_ftp_server.sh
sudo chmod +x EVENT_HANDLER_DIRECTORY/restart_ftp_server.sh

Edit the configuration file.

sudo vim /usr/local/nagios/etc/objects/Linux-FTP-Server.cfg

Uncomment the line for event_handler by removing the # character.

Save your changes and exit the editor.

Check to make sure you don't have any errors.

sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Restart Nagios.

sudo systemctl restart nagios

Verify the status of Nagios.

sudo systemctrl status nagios

Transfer to the client terminal and verify the status of vsftpd.

systemctl status vsftpd

Open a browser to the public IP address of the server running Nagios. Use the address SERVER_PUBLIC_IP/nagios.

Log in with the username "nagiosadmin" and the password "BlaBla321", without quotes.

Click on Services from the left-hand menu.

In the server terminal, check the log file.

sudo tail -f /var/log/messages

Do the same thing in the client terminal.

sudo tail -f /var/log/messages

Exit the log reporting.

Stop vsftpd.

sudo systemctl stop vsftpd

Verify vsftpd was stopped.

sudo tail -f /var/log/messages

Wait and watch the logs. Verify that the client is eventually restarted.