Application Real-Time Monitoring Service:Integrate Nagios with ARMS

Create the alert notification script

1. Log on to the Nagios server and go to the plugins directory:

   cd /usr/local/nagios/libexec/

2. Create a file named nagios-alert.py with the following content:

   Important

   Replace <your-integration-url> with the integration address you copied in Step 1.

   #!/usr/bin/python
   # -*- coding: utf-8 -*-
   
   import requests
   import json
   import sys
   import os
   
   headers = {'Content-Type': 'application/json;charset=utf-8'}
   api_url = "<your-integration-url>"  # Replace with the integration address from Step 1
   
   def parse(sys):
       object_type = str(sys.argv[1])
       notification_type = str(sys.argv[2])
       host_name = str(sys.argv[3])
       host_ip = str(sys.argv[4])
       state = str(sys.argv[5])
       time = str(sys.argv[6])
       info = str(sys.argv[7])
   
       if object_type == 'host':
           description = "[{}] {} alert: {} is {}".format(notification_type, object_type, host_name, state)
           service = ""
       else:
           service = str(sys.argv[8])
           description = "[{}] {} alert: {}/{} is {}".format(notification_type, object_type, host_name, service, state)
       content_dict = {'service':""}
       content_dict['object_type'] = object_type
       content_dict['notification_type'] = notification_type
       content_dict['host_name'] = host_name
       content_dict['host_ip'] = host_ip
       content_dict['state'] = state
       content_dict['time'] = time
       content_dict['info'] = info
       content_dict['service'] = service
       content_dict['description'] = description
       print(content_dict)
       return content_dict
   
   
   def msg(text):
       result = requests.post(url=api_url, data=json.dumps(text), headers=headers)
       print(result)
   
   
   if __name__ == '__main__':
       text = parse(sys)
       msg(text)

3. Install the requests library if it is not already installed:

   pip install requests

Define Nagios commands

1. Open the Nagios commands configuration file:

   vim /usr/local/nagios/etc/objects/commands.cf

2. Add the following command definitions to the file:

   define command{
       command_name notify-host-by-alert
       command_line python /usr/local/nagios/libexec/nagios-alert.py "host" "$NOTIFICATIONTYPE$" "$HOSTALIAS$" "$HOSTADDRESS$" "$HOSTSTATE$" "$LONGDATETIME$" "$HOSTOUTPUT$"
       }
   
   define command{
       command_name notify-service-by-alert
       command_line python /usr/local/nagios/libexec/nagios-alert.py "service" "$NOTIFICATIONTYPE$" "$HOSTALIAS$" "$HOSTADDRESS$" "$SERVICESTATE$" "$LONGDATETIME$" "$SERVICEOUTPUT$" "$SERVICEDESC$"
       }

3. Save and close the file.

Update contact notification commands

1. Open the Nagios contacts configuration file:

   vim /usr/local/nagios/etc/objects/contacts.cfg

2. Add or update the following notification command directives in the contact definition:

   service_notification_commands   notify-service-by-alert
   host_notification_commands      notify-host-by-alert

   

3. Save and close the file.

Restart Nagios

Run the following command to apply the changes:

systemctl restart nagios

Send test data

1. On the Alert Integration tab, find the integration and click Edit in the Actions column.

2. In the Event Mapping section, click Send Test Data.

3. In the Send Test Data dialog box, paste a JSON alert payload and click Send.

   Note

   • If the message "Uploaded. No events are generated. Configure mappings based on the original data." appears, the source fields are not yet mapped. The uploaded data is displayed in the left pane for you to select fields when configuring mappings.

   • If the message "Uploaded." appears, the alert content has been reported to the Alert Event History page. For more information, see View historical alert events.

4. In the Send Test Data dialog box, click Disable.

Configure field mappings

1. In the left pane of the Event Mapping section, click a data record to view its details.

2. (Optional) In the Select Root Node section, enable batch processing if the alert data contains an array node. Select the array node to use as the root node. The system processes data under that node in a batch.

   Note

   If multiple array nodes exist in the alert data, you can select only one for batch processing.

3. In the Map Source Fields to Target Fields section, map source fields to ARMS alert fields. Click the Map icon to select a mapping method:

   • Direct -- Maps a single source field to an ARMS alert field.

   • Series -- Concatenates multiple source fields with a delimiter (special characters only), then maps the result to an ARMS alert field.

   • Condition -- Maps source fields to ARMS alert fields only when values meet specified conditions.

   • Mapping table -- Maps severity levels from the alert source to ARMS severity levels. Use this method only for the severity field.

Configure event deduplication

Event deduplication merges multiple events that share the same value for a specified field into a single alert notification, reducing noise.

1. In the Event Deduplication section on the Integration Details page, select the fields to use for deduplication.

2. Click Deduplication Test to preview the grouping results.

   Note

   The deduplication test runs against the 10 most recent data records uploaded in the Event Mapping section.

3. Click Save.