Icinga Satellite behind firewall - how to check if it is up / down

Icinga 2
1

Dear all,

maybe I missed a already existing topic for that. But at this moment I “can’t see the wood for the trees”. I have the following situation:

Icinga2-Master located at my home, behind a FritzBox (192.168.178.12)
Icinga2-Satellite located on a different location behind a FritzBox too (192.168.179.5)

My master has the port 5665 reachable via port forwarding and the satellite connects to the icinga2-master. I can do service checks on the satellite, no problem.

But in Icinga Web it is shown as “unreachable” what is for sure true, because I configured this host object:

object Host "extern" {
  import "generic-host"
  address = "192.168.179.5"
  vars.agent_endpoint = name
  vars.os = "Linux"
  vars.notification["sms"] = {
    users = [ "tgm" ]
  }
  vars.disks["disk /"] = {
    disk_partitions = "/"
  }
}

And yes indeed the icinga2-master can not ping 192.168.179.5. The service check is running through the agent, because I use command_endpoint. Okay, fine. But how I can show in Icinga if the host is really up or down? Any idea?

The host overview is always down, the checks has the real state. Only ssh/ping as service check is critical because Icinga-master can not reach them. OK. Maybe I could add “command_endpoint” for this both checks ONLY for this agent. Then they would be recover. Okay… BUT: The host is shown as unreachable/down in the host-overview. How I can solve this?

2

I configured it now like this, but is this really a good idea?

object Host "extern" {
  import "generic-host"
  command_endpoint = "extern"
  address = "192.168.179.5"
  vars.agent_endpoint = name
  vars.os = "Linux"
  vars.notification["sms"] = {
    users = [ "tgm" ]
  }
  vars.disks["disk /"] = {
    disk_partitions = "/"
  }
}

Now the host is shown as UP in the Icinga Web interface.

But is this really a good idea?

3

You could use cluster-zone instead of hostalive for your host object.

4

Yes, true! That´s a fantastic idea. Thanks for the hint.

5

Hi there, I have a similar problem.
The satellite is behind a firewall and can only connect to the master via 5665/tcp.
The satellite is in its respective zone (zones.d/internal/satellite-internal.conf) and has the check_command cluster-zone.

However, if i stop the icinga2.service or even power off the host, it is still displayed as up on icingaweb (running on the master node) with plugin output: “Zone ‘internal’ is connected. Log lag: less than 1 millisecond”

When i move the satellite config to zones.d/master it works and the check source is the master node, but this would introduce other problems I faced with configuring host dependencies for that zone

Any help would be greatly appreciated

6

In this case I’d recommend to define additional service cluster-zone at your master having vars.cluster_zone = “”.

BTW: Continuing a thread which is already mark as solved may not be seen by many users, hence, it is better to open a new topic and incl. a reference to this thread.