ArchLinux : Icinga2 インストール

# groupadd -g 667 icinga
# useradd -u 667 -g icinga -G http -d /dev/null -s /bin/false icinga

# ls /usr/lib/monitoring-plugins/
check_apt       check_dummy         check_ircd         check_nagios    check_rpc      check_ups
check_breeze    check_file_age      check_jabber       check_nntp      check_sensors  check_uptime
check_by_ssh    check_flexlm        check_ldap         check_nntps     check_simap    check_users
check_clamd     check_fping         check_ldaps        check_nscp_api  check_smtp     check_wave
check_cluster   check_ftp           check_load         check_ntp_peer  check_snmp     negate
check_curl      check_hpjd          check_log          check_ntp_time  check_spop     urlize
check_dbi       check_http          check_mailq        check_oracle    check_ssh      utils.pm
check_dhcp      check_icmp          check_mrtg         check_pgsql     check_ssmtp    utils.sh
check_dig       check_ide_smart     check_mrtgtraf     check_ping      check_swap
check_disk      check_ifoperstatus  check_mssql        check_pop       check_tcp
check_disk_smb  check_ifstatus      check_mysql        check_procs     check_time
check_dns       check_imap          check_mysql_query  check_real      check_udp

# systemctl start icinga2
# systemctl enable --now icinga2
Created symlink '/etc/systemd/system/multi-user.target.wants/icinga2.service' → '/usr/lib/systemd/system/icinga2.service'.

# icinga2 --version
icinga2 - The Icinga 2 network monitoring daemon (version: r2.16.5-1)

Copyright (c) 2012-2026 Icinga GmbH (https://icinga.com/)
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl-3.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
  Platform: Arch Linux
  Platform version: Unknown
  Kernel: Linux
  Kernel version: 7.2.2-arch1-1
  Architecture: x86_64

Build information:
  Compiler: GNU 16.2.1
  Build host: unknown
  OpenSSL version: OpenSSL 3.6.4 25 Aug 2026

Application information:

General paths:
  Config directory: /etc/icinga2
  Data directory: /var/lib/icinga2
  Log directory: /var/log/icinga2
  Cache directory: /var/cache/icinga2
  Spool directory: /var/spool/icinga2
  Run directory: /run/icinga2

Old paths (deprecated):
  Installation root: /usr
  Sysconf directory: /etc
  Run directory (base): /run
  Local state directory: /var

Internal paths:
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

# icinga2 api setup

information/cli: Generating new CA.
information/base: Writing private key to '/var/lib/icinga2/ca//ca.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/ca//ca.crt'.
information/cli: Generating new CSR in '/var/lib/icinga2/certs//lepard.csr'.
information/base: Writing private key to '/var/lib/icinga2/certs//lepard.key'.
information/base: Writing certificate signing request to '/var/lib/icinga2/certs//lepard.csr'.
information/cli: Signing CSR with CA and writing certificate to '/var/lib/icinga2/certs//lepard.crt'.
information/pki: Writing certificate to file '/var/lib/icinga2/certs//lepard.crt'.
information/cli: Copying CA certificate to '/var/lib/icinga2/certs//ca.crt'.
information/cli: Adding new ApiUser 'root' in '/etc/icinga2/conf.d/api-users.conf'.
information/cli: Reading '/etc/icinga2/icinga2.conf'.
information/cli: Enabling the 'api' feature.
Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.
information/cli: Updating 'NodeName' constant in '/etc/icinga2/constants.conf'.
information/cli: Created backup file '/etc/icinga2/constants.conf.orig'.
information/cli: Updating 'ZoneName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.
Done.

Now restart your Icinga 2 daemon to finish the installation!

#  systemctl restart icinga2

# ss -tlnp | grep 5665
LISTEN 0      4096               *:5665            *:*    users:(("icinga2",pid=18316,fd=18))

# ufw allow 5665/tcp 
# ufw reload

# mysql -u root -p 

> CREATE DATABASE icingadb;
> CREATE USER 'icingauser'@'localhost' IDENTIFIED BY '?Ww123456';
> GRANT ALL ON icingadb.* TO 'icingauser'@'localhost';

> CREATE DATABASE icingaweb2db;
> CREATE USER 'icingaweb2user'@'localhost' IDENTIFIED BY '?Yy123456';
> GRANT ALL ON icingaweb2db.* TO 'icingaweb2user'@'localhost';

> FLUSH PRIVILEGES;
> exit;

# pacman -S valkey
# su - huong
$ yay -S icingadb

# vim  /etc/valkey/valkey.conf
bind 127.0.0.1 -::1
port 6379

# systemctl enable --now valkey
# systemctl start valkey

# mysql -u root -p icingadb < /usr/share/icingadb/schema/mysql/schema.sql

# vim /etc/icingadb/config.yml

6行目以降database:項目の内容を次のようにする
database:
  type: mysql
  host: localhost
  port: 3306
  database: icingadb
  user: icingauser
  password: ?Ww123456

Redis接続設定項目を編集
redis:
  host: "localhost"       # Valkeyが動いているホスト
  port: 6379 

# vim /etc/icinga2/features-enabled/icingadb.conf
下記の通り設定
object IcingaDB "icingadb" {
  host = "127.0.0.1"
  port = 6379
  //password = "xxx"
}

# icinga2 feature enable icingadb

# icinga2 daemon -C

# systemctl enable --now icingadb
# systemctl restart icinga2

$ yay -S icingaweb2 icingadb-web icingacli  php-cli php-common

# vim /etc/php/php.ini
912行目当たりからのextension項目で次を有効にする
curl
gd
gettext
intl
ldap
pdo_mysql
pdo_pgsql
pfsql
sockets

# icingacli setup config webserver apache --document-root /usr/share/webapps/icingaweb2/public > /etc/httpd/conf/conf.d/icingaweb2.conf

# vim /etc/httpd/conf/httpd.conf
下記モジュールのコメントを外す
LoadModule rewrite_module modules/mod_rewrite.so

# systemctl restart httpd

# icingacli setup config directory --group icingaweb2
# icingacli setup token create
The newly generated setup token is: 4ea825b1e0a100b0

# pacman -S php-imagick

# vim /etc/php/php.ini

下記を追記する
extension=imagick

# systemctl restart httpd
# systemctl restart php-fpm.service

# vi /etc/icinga2/conf.d/api-users.conf

object ApiUser "root" {
  password = "629ee19fa6f0fbee"

# systemctl restart icingadb

# su - huong
$ yay -S icingaweb2-module-director
$ yay -S icingaweb2-module-incubator

# mysql -u root -p

> CREATE DATABASE directordb ;
> CREATE USER 'directoruser'@'localhost' IDENTIFIED BY '?Xx123456';
> GRANT ALL ON directordb.* TO 'directoruser'@'localhost';
> FLUSH PRIVILEGES;
> EXIT;

# mysql -u root -p icingadb < /usr/share/webapps/icingaweb2/modules/director/schema/mysql.sql

# systemctl enable icinga-director

# ls /usr/lib/monitoring-plugins/
check_apt       check_dummy         check_ircd         check_nagios    check_rpc      check_ups
check_breeze    check_file_age      check_jabber       check_nntp      check_sensors  check_uptime
check_by_ssh    check_flexlm        check_ldap         check_nntps     check_simap    check_users
check_clamd     check_fping         check_ldaps        check_nscp_api  check_smtp     check_wave
check_cluster   check_ftp           check_load         check_ntp_peer  check_snmp     negate
check_curl      check_hpjd          check_log          check_ntp_time  check_spop     urlize
check_dbi       check_http          check_mailq        check_oracle    check_ssh      utils.pm
check_dhcp      check_icmp          check_mrtg         check_pgsql     check_ssmtp    utils.sh
check_dig       check_ide_smart     check_mrtgtraf     check_ping      check_swap
check_disk      check_ifoperstatus  check_mssql        check_pop       check_tcp
check_disk_smb  check_ifstatus      check_mysql        check_procs     check_time
check_dns       check_imap          check_mysql_query  check_real      check_udp

# systemctl start icinga2
# systemctl enable --now icinga2
Created symlink '/etc/systemd/system/multi-user.target.wants/icinga2.service' → '/usr/lib/systemd/system/icinga2.service'.

# vim /etc/hosts
192.168.11.83   lepard
192.168.11.85   Lion.korodes.com

# icinga2 pki ticket --cn 'Lion'
0cf1682f55272481d5634acf9b2b188ecdcebdb5

# icinga2 node wizard
Welcome to the Icinga 2 Setup Wizard!

We will guide you through all required configuration details.

Please specify if this is an agent/satellite setup ('n' installs a master setup) [Y/n]: Y

Starting the Agent/Satellite setup routine...

Please specify the common name (CN) [Lion]:

Please specify the parent endpoint(s) (master or satellite) where this node should connect to:
Master/Satellite Common Name (CN from your master/satellite node): lepard

Do you want to establish a connection to the parent node from this node? [Y/n]: Y
Please specify the master/satellite connection information:
Master/Satellite endpoint host (IP address or FQDN): 192.168.11.83
Master/Satellite endpoint port [5665]:

Add more master/satellite endpoints? [y/N]: N
Parent certificate information:

 Version:             3
 Subject:             CN = lepard
 Issuer:              CN = Icinga CA
 Valid From:          Sep  3 02:08:12 2026 GMT
 Valid Until:         Oct  5 02:08:12 2027 GMT
 Serial:              D3581F60932658A22F9698CA51D318E39F7D434C

 Signature Algorithm: sha256WithRSAEncryption
 Subject Alt Names:   lepard
 Fingerprint:         7A 4E 27 92 8A 88 38 D3 2F 29 A2 A0 7A 96 27 C0 E4 A6 84 2E 6E A4 83 18 D7 CB 82 B9 9E 9F DC 32

Is this information correct? [y/N]: y

Please specify the request ticket generated on your Icinga 2 master (optional).
 (Hint: # icinga2 pki ticket --cn 'Lion'): 0cf1682f55272481d5634acf9b2b188ecdcebdb5
Please specify the API bind host/port (optional):
Bind Host []: 0.0.0.0
Bind Port []: 5665

Accept config from parent node? [y/N]: y
Accept commands from parent node? [y/N]: y

Reconfiguring Icinga...

Local zone name [Lion]:
Parent zone name [master]:

Default global zones: global-templates director-global
Do you want to specify additional global zones? [y/N]: N

Do you want to disable the inclusion of the conf.d directory [Y/n]: Y
Disabling the inclusion of the conf.d directory...

Done.

Now restart your Icinga 2 daemon to finish the installation!

# systemctl restart icinga2