I have a distributed setup, where the “master” site should be used to receive logging messages forwarded form the logging server.
I am currently in the base setup for the event console and trying with some test messages. For the hosts located on the master site it shows up on the corresponding host as Event Service (as expected). For hosts located on remote sites it does not.
I have setup replication of event console from a master in the site config. What am I missing here?
ok, it seems I tripped over my own feet. I have a local slave site, which was using the default EC port as livestatus port and of course this is not working. I gave the local site another port and setup “Check event state in Event Console” to the master site.
The messages are showing up now on the corresponding hosts, but as soon as I click on the “Events of Host XYZ” in the context menu of the Hosts “Events”-Service, no Events are showing up. The Host is monitored on the slave site, but the context menu button refers to the slave site. It does not refer to the master sites EC. Is there another config to do?
I am still struggling to get this to work. Is no one using a central EC in a distributed setup anymore? I think it was standard until “recently”.
Ok, I got this to work:
Message receiving via EC on the master site
Displaying the events on the hosts (even, when they are monitored on a slave site) via the “Check event state in Event Console” referring to the master sites EC via TCP
Whats missing / not working:
Even though I can see the events of hosts residing on a slave, when I click “Events of Hosts XYZ” in the “Events”-Service context menu in the hosts service view of that host, nothing shows up
I think the master EC does not identify the host as a monitored host, since it “is” on the slave. How do I get the master site/EC to check with the slaves or am I totally on the wrong track?