{"id":20815296,"url":"https://github.com/sowoi/graylog-alerts-to-icinga","last_synced_at":"2025-12-25T02:49:12.295Z","repository":{"id":138602773,"uuid":"535584315","full_name":"sowoi/graylog-alerts-to-icinga","owner":"sowoi","description":"Monitor graylog alerts with icinga2","archived":false,"fork":false,"pushed_at":"2023-10-17T21:06:14.000Z","size":237,"stargazers_count":3,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-06T08:48:24.091Z","etag":null,"topics":["graylog","icinga","icinga-plugin","icinga2","icinga2-plugin","monitoring"],"latest_commit_sha":null,"homepage":"https://okxo.de/show-graylog-alerts-in-icinga2/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sowoi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-09-12T08:58:05.000Z","updated_at":"2024-08-17T17:22:28.000Z","dependencies_parsed_at":"2023-10-03T18:30:57.753Z","dependency_job_id":null,"html_url":"https://github.com/sowoi/graylog-alerts-to-icinga","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sowoi%2Fgraylog-alerts-to-icinga","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sowoi%2Fgraylog-alerts-to-icinga/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sowoi%2Fgraylog-alerts-to-icinga/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sowoi%2Fgraylog-alerts-to-icinga/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sowoi","download_url":"https://codeload.github.com/sowoi/graylog-alerts-to-icinga/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243161186,"owners_count":20246014,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["graylog","icinga","icinga-plugin","icinga2","icinga2-plugin","monitoring"],"created_at":"2024-11-17T21:21:01.988Z","updated_at":"2025-12-25T02:49:12.246Z","avatar_url":"https://github.com/sowoi.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# graylog-alerts-to-icinga\nMonitor graylog alerts with icinga2\n\nThis python script checks the Graylog event stream for entries. If an Altert has been triggered, a Critical message is sent to Icinga2. \nThe monitoring of icinga2 is thus connected to Graylog.\n\nGraylog is a log monitoring tool.\nIcinga is a tool for machine monitoring. \n\n\n# Features\n- debugging\n- customizations can be done via Graylog\n- query search to not show alerts that should not trigger anything\n- customize search time or restrict to specific machines/hosts\n- fully compatible with Graylog 4\n- Session authentication\n- works with self-signed certificates\n\n# How it works\n- Graylog Eventstream is queried via the API (\u003caddress\u003e:9000/api/events/search)\n- In the Graylog eventstream there are usually only events that are worth watching\n- By default, an alarm is triggered in icinga2 when an event is in the eventstream\n- how well this plugin works depends very much on which alarms\u0026events are configured in the Graylog\n\n# Prerequisites\n- I strongly recommend to create a readonly monitoring user! See below how to do that.\n- Python module requests: pip3 install requests\n- The Graylog GUI should be accessible via https. A self-signed certificate is sufficient. \nHowever, the plugin also works without encryption.\n- Port 9000 must be enabled in the firewall. \n\n# Installation\n- Download check_graylog_alerts.py to your local Graylog server\n- Put the Python script to your Pluginfolder. Usually /usr/lib/nagios/plugins/\n- Create a new command custome command:\n\n```\nobject CheckCommand \"check_graylog_alerts\" {\n    import \"plugin-check-command\"\n    command = [ PluginDir + \"/check_graylog_alerts.py\" ]\n    arguments += {\n        \"--host\" = {\n            description = \"hostname\"\n            required = true\n            value = \"$address$\"\n        }\n        \"--machine\" = {\n            description = \"machine to check for in graylog stream  (default: all, if not set)\"\n            required = false\n        }\n        \"--password\" = {\n            description = \"Graylog Userpassword\"\n            required = true\n        }\n        \"--query\" = {\n            description = \"graylog search query (default: show all queries if not set)\"\n            required = false\n        }\n        \"--time\" = {\n            description = \"timerange to check since now in seconds (default 86400 if not set)\"\n            required = false\n        }\n        \"--user\" = {\n            description = \"Graylog Username\"\n            required = true\n        }\n    }\n}\n\n```\n\n- Create a new Service object:\n\n\n```\nobject Service \"Service: Graylog Alerts\" {\n   import               \"generic-service\"\n   host_name =          \"YOUR GAYLOG HOST\"\n   check_command =      \"check_graylog_alerts\"\n}\n```\n\n\n# icinga director\n- Create a custome command with following arguments:\n![icinga director](https://github.com/sowoi/graylog-alerts-to-icinga/blob/main/img/check_graylog_icinga_director.png?raw=true)\n\n\n# CLI Usage\n- `python3 check_graylog_alerts.py -h` will show you a manual.\n\n\n\nUsage: check_graylog_alerts.py [options]\n\ncheck_graylog_alerts.py checks graylog stream for alerts. you need to setup\nalerts beforehand.  \n\nExample: `check_graylog_alerts.py -H 192.168.134.11 -u admin -p secret -m testmachine -t 33`\n\n```\nOptions:\n  -h, --help            show this help message and exit\n\n  Generic options:\n    -d, --debug         enable debugging outputs (default: no)\n\n  Host options:\n    -H HOST, --host=HOST\n                        defines graylog  hostname or IP\n\n  User options:\n    -u USER, --user=USER\n                        graylog user with access to API and event stream\n                        (default: admin)\n\n  Password options:\n    -p PASSWORD, --password=PASSWORD\n                        graylog user password (default: none)\n\n  Machine options:\n    -m MACHINE, --machine=MACHINE\n                        machine to check for in graylog stream  (default: all)\n\n  Timerange options:\n    -t TIMERANGE, --time=TIMERANGE\n                        timerange since now in seconds (default 86400)\n\n  Query options:\n    -q QUERY, --query=QUERY\n                        graylog search query (default: show all queries)\n```\n\n\n# Create a readonly monitoring user\n- In Graylog, open the System tab and select \"Users and Teams\".\n- Create a new user with assigend role: \"View Manager\"\n![icinga user](https://github.com/sowoi/graylog-alerts-to-icinga/blob/main/img/createIcinga2user.png)\n\n- Share your \"All Events\" Stream with the new user\n![Share all events](https://github.com/sowoi/graylog-alerts-to-icinga/blob/main/img/GraylogEvents.png)\n\n- Add your newly created user. Leave the rights at \"Viewer\".\n![Share all events](https://github.com/sowoi/graylog-alerts-to-icinga/blob/main/img/icingauserviewer.png)\n\n# License\nLicensed under the terms of Apache License Version 2. See LICENSE file.\n\n# More\n[Dev-Site okxo.de](https://okxo.de/show-graylog-alerts-in-icinga2/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsowoi%2Fgraylog-alerts-to-icinga","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsowoi%2Fgraylog-alerts-to-icinga","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsowoi%2Fgraylog-alerts-to-icinga/lists"}