We have 3 clustered search heads with 5 clustered indexers. We deployed the app to each search head to /opt/splunk/etc/shcluster/apps/SplunkForNagio
For the directions below, we placed the send_nsca and send_nsca.cfg (got these from our Nagios XI server) here:
* NSCABIN=/usr/lib/nagios/plugins (ie. location of send_nsca on your splunk server)
NSCABIN=/opt/splunk/etc/shcluster/apps/SplunkForNagios/bin/scripts/
* NSCACFG=$NSCABIN (ie. location of send_nsca.cfg on your splunk server)
NSCACFG=/opt/splunk/etc/shcluster/apps/SplunkForNagios/bin/scripts/
--------------------------
We kicked off an alert per the documentation, but we aren't able to see the alerts in Nagios XI for a known host for unconfigured objects. We've verified port 5667 is open on to communicate out of on each search head. I'm not comfortable with where we put the send_ncsa and the send_ncsa.cfg. Any help would be appreciated.
↧