CMK version: Community 2.4, Enterprise 2.1.5 OS version: Redhat, Ubuntu
Hi All,
My checkmk environment is : our company has multiple branches that each branch has installed Checkmk community 2.4.0p24, and as HQ we are also using a Checkmk community 2.4.0p24 for Distribution monitoring for those branches’ checkmks. We also have a CheckMk enterprise edition version 2.1.5 installed in HQ to monitor HQ’s network and pinging branches checkmk for monitoring. So in summary, in HQ, we have a central checkmk(community edition for distribution monitroing) and another CheckMK (enterprise edition).
my question is, we want to centralized manage all the branches’ event log and notify log, but it seems on my Distribution monitoring checkmk(community edition), it only has the event log but no notify log of the branches. Do we have to get the branches notify log from each branches checkmk? any way to centralized manage the event log and notify log? If I use the HQ’s enterprise CheckMk for distribution monitoring instead, will it be able to get all the branches event log and notify log ? what is the best practise ?
can please advise the directory of the log for the distribution monitoring (the branches) event log from my HQ checkMK?
There is a rule ‘Parameters for Forward Notification to Event Console’ which might do the job.
There is also the notification method ‘Forward Notification to Event Console’
A key design principle of Checkmk is its decentralized architecture all data including event logs and notify logs is stored on the respective sites. The master system only centralizes the configuration and visualization of this data within the GUI.
This means that all logfiles remain stored locally on each branch’s Checkmk site. The master does not collect any logs from the remote sites. Event logs may be viewed centrally via the distributed setup, but notify logs are only available on the respective local sites.
If you want to access or analyze these logs beyond the standard views available in Checkmk, you need to either transfer them manually or use external log management tools that collect log files from all sites, index and store them centrally, and visualize the results through a unified interface.
In the paid versions of Checkmk, monitoring data and configuration can be centrally displayed and managed in the GUI. However, the actual log files still reside on each site, as Checkmk’s distributed monitoring is designed to maintain decentralized data processing for scalability and reliability. Full log centralization therefore requires external log management solutions.
Since I do not use the Community Edition myself, I cannot provide detailed insight into its specific limitations.
Best practice:
Use Checkmk’s distributed setup for monitoring and visualization, and employ a dedicated log management platform (such as ELK, Loki, or Splunk) for centralized collection and analysis of logs.
If one of the answers helped you solve your question, please mark it as the solution. This way, you thank the person who helped you and also indicate that the question has been resolved. This, in turn, helps others who come across the same question.
