openSUSE16.0 : Icinga インストール

# rpm --import https://packages.icinga.com/icinga.key

# zypper ar https://packages.icinga.com/openSUSE/ICINGA-release.repo
# zypper ref

# zypper ar https://download.opensuse.org/repositories/server:/monitoring/16.0/server:monitoring.repo

# zypper -n install icinga2

# icinga2 daemon -C
--------------------------------------------------------------
[2026-09-02 09:55:42 +0900] information/cli: Finished validating the configuration file(s).

# zypper -n install --recommends monitoring-plugins-all

# ls /usr/lib/nagios/plugins/
check_breeze    check_ftp           check_mrtg         check_ping        check_swap
check_by_ssh    check_host          check_mrtgtraf     check_pop         check_tcp
check_clamd     check_hpjd          check_mysql        check_procs       check_time
check_cluster   check_http          check_mysql_query  check_procs_perf  check_udp
check_cups      check_icmp          check_nagios       check_radius      check_ups
check_curl      check_ide_smart     check_nntp         check_real        check_uptime
check_dbi       check_ifoperstatus  check_nntps        check_rpc         check_users
check_dhcp      check_ifstatus      check_nscp_api     check_rsync       check_wave
check_dig       check_imap          check_nt           check_rta_multi   check_zypper
check_disk      check_ircd          check_ntp          check_sensors     negate
check_disk_smb  check_jabber        check_ntp_peer     check_simap       urlize
check_dns       check_ldap          check_ntp_time     check_smtp        utils.pm
check_dummy     check_ldaps         check_nwstat       check_snmp        utils.sh
check_file_age  check_load          check_oracle       check_spop
check_flexlm    check_log           check_overcr       check_ssh
check_fping     check_mailq         check_pgsql        check_ssmtp

# systemctl start icinga2
# systemctl enable --now icinga2
Created symlink '/etc/systemd/system/multi-user.target.wants/icinga2.service' → '/usr/lib/systemd/system/icinga2.service'.

# icinga2 --version

icinga2 - The Icinga 2 network monitoring daemon (version: r2.16.5-1)

Copyright (c) 2012-2026 Icinga GmbH (https://icinga.com/)
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl-3.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
  Platform: openSUSE Leap
  Platform version: 16.0
  Kernel: Linux
  Kernel version: 6.12.0-160000.37-default
  Architecture: x86_64

Build information:
  Compiler: GNU 15.3.0
  Build host: unknown
  OpenSSL version: OpenSSL 3.5.0 8 Apr 2025

Application information:

General paths:
  Config directory: /etc/icinga2
  Data directory: /var/lib/icinga2
  Log directory: /var/log/icinga2
  Cache directory: /var/cache/icinga2
  Spool directory: /var/spool/icinga2
  Run directory: /run/icinga2

Old paths (deprecated):
  Installation root: /usr
  Sysconf directory: /etc
  Run directory (base): /run
  Local state directory: /var

Internal paths:
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

# icinga2 api setup
information/cli: Generating new CA.
information/base: Writing private key to '/var/lib/icinga2/ca//ca.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/ca//ca.crt'.
information/cli: Generating new CSR in '/var/lib/icinga2/certs//lepard.csr'.
information/base: Writing private key to '/var/lib/icinga2/certs//lepard.key'.
information/base: Writing certificate signing request to '/var/lib/icinga2/certs//lepard.csr'.
information/cli: Signing CSR with CA and writing certificate to '/var/lib/icinga2/certs//lepard.crt'.
information/pki: Writing certificate to file '/var/lib/icinga2/certs//lepard.crt'.
information/cli: Copying CA certificate to '/var/lib/icinga2/certs//ca.crt'.
information/cli: Adding new ApiUser 'root' in '/etc/icinga2/conf.d/api-users.conf'.
information/cli: Reading '/etc/icinga2/icinga2.conf'.
information/cli: Enabling the 'api' feature.
Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.
information/cli: Updating 'NodeName' constant in '/etc/icinga2/constants.conf'.
information/cli: Created backup file '/etc/icinga2/constants.conf.orig'.
information/cli: Updating 'ZoneName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.
Done.

Now restart your Icinga 2 daemon to finish the installation!

#  systemctl restart icinga2

# ss -tlnp | grep 5665
LISTEN 0      4096               *:5665            *:*    users:(("icinga2",pid=5535,fd=18))

# firewall-cmd --permanent --add-port=5665/tcp 
# firewall-cmd --reload

# mysql -u root -p 

> CREATE DATABASE icingadb;
> CREATE USER 'icingauser'@'localhost' IDENTIFIED BY '?Ww123456';
> GRANT ALL ON icingadb.* TO 'icingauser'@'localhost';

> CREATE DATABASE icingaweb2db;
> CREATE USER 'icingaweb2user'@'localhost' IDENTIFIED BY '?Yy123456';
> GRANT ALL ON icingaweb2db.* TO 'icingaweb2user'@'localhost';

> FLUSH PRIVILEGES;
> exit;

# zypper -n install icingadb icingadb-redis

# systemctl enable --now icingadb-redis
# systemctl start icingadb-redis

# mysql -u root -p icingadb < /usr/share/icingadb/schema/mysql/schema.sql

# vi /etc/icingadb/config.yml

6行目以降database:項目の内容を次のようにする
database:
  type: mysql
  host: localhost
  port: 3306
  database: icingadb
  user: icingauser
  password: ?Ww123456

# icinga2 feature enable icingadb

# systemctl enable --now icingadb
# systemctl restart icinga2

# zypper -n install icingaweb2 icingadb-web icingacli  php-cli

# a2enmod rewrite
# a2enmod php8.4
# systemctl restart apache2

# icingacli setup token create
The newly generated setup token is: 5837bcf3b42f054a

# zypper -n install php8-imagick
# systemctl restart apache2

# vi /etc/icinga2/conf.d/api-users.conf

object ApiUser "root" {
    password = "716d105e5610b363"

# systemctl restart icingadb

# zypper ar -r https://packages.icinga.com/opensuse/$releasever/release/ icinga-release
# zypper -n install icinga-director

# mysql -u root -p

> CREATE DATABASE directordb ;
> CREATE USER 'directoruser'@'localhost' IDENTIFIED BY '?Xx123456';
> GRANT ALL ON directordb.* TO 'directoruser'@'localhost';
> FLUSH PRIVILEGES;
> EXIT;

# mysql -u root -p icingadb < /usr/share/icingaweb2/modules/director/schema/mysql.sql

# systemctl enable icinga-director

# vi /etc/hosts

下記を追記する
192.168.11.83 lepard ←hostname

# rpm --import https://packages.icinga.com/icinga.key

# zypper ar https://packages.icinga.com/openSUSE/ICINGA-release.repo
# zypper ref

# zypper ar https://download.opensuse.org/repositories/server:/monitoring/16.0/server:monitoring.repo

# zypper -n install icinga2

# icinga2 daemon -C
--------------------------------------------------------------
[2026-09-02 17:34:19 +0900] information/cli: Finished validating the configuration file(s).

# zypper -n install --recommends monitoring-plugins-all

# systemctl start icinga2
# systemctl enable --now icinga2
Created symlink '/etc/systemd/system/multi-user.target.wants/icinga2.service' → '/usr/lib/systemd/system/icinga2.service'.

# vi /etc/hosts
192.168.11.83   lepard
192.168.11.85   Lion

# vi /etc/icinga2/constants.conf

最終行あたり
const TicketSalt = ""　となっていれば、任意の複雑なキーを設定する
const TicketSalt = "****************"

# icinga2 daemon -C

エラーがなければ再起動
# systemctl restart icinga2

# vi deploy-agent.sh

例として下記のようなもの
#!/bin/bash

# This generates and signs your required certificates. Please do not
# forget to install the Icinga 2 package and your desired monitoring
# plugins first.

# Config from Director
ICINGA2_NODENAME='Lion'
ICINGA2_CA_TICKET='0cf1682f55272481d5634acf9b2b188ecdcebdb5'
ICINGA2_PARENT_ZONE='lepard'
ICINGA2_PARENT_ENDPOINTS=('lepard,lepard')
ICINGA2_CA_NODE='lepard'
ICINGA2_GLOBAL_ZONES=('director-global')

# Internal defaults
: "${ICINGA2_OSFAMILY:=}"
: "${ICINGA2_HOSTNAME:="$(hostname -f)"}"
: "${ICINGA2_NODENAME:="${ICINGA2_HOSTNAME}"}"
: "${ICINGA2_CA_NODE:=}"
: "${ICINGA2_CA_PORT:=5665}"
: "${ICINGA2_CA_TICKET:=}"
: "${ICINGA2_PARENT_ZONE:=master}"
: "${ICINGA2_PARENT_ENDPOINTS:=()}"
: "${ICINGA2_GLOBAL_ZONES:=director-global}"
: "${ICINGA2_DRYRUN:=}"
: "${ICINGA2_UPDATE_CONFIG:=}"

# Helper functions
fail() {
  echo "ERROR: $1" >&2
  exit 1
}

warn() {
  echo "WARNING: $1" >&2
}

info() {
  echo "INFO: $1" >&2
}

check_command() {
  command -v "$@" &>/dev/null
}

install_config() {
  if [ -e "$1" ] && [ ! -e "${1}.orig" ]; then
    info "Creating a backup at ${1}.orig"
    cp "$1" "${1}.orig"
  fi
  echo "Writing config to ${1}"
  echo "$2" > "${1}"
}

[ "$BASH_VERSION" ] || fail "This is a Bash script"

errors=
for key in NODENAME CA_NODE CA_PORT CA_TICKET PARENT_ZONE PARENT_ENDPOINTS; do
  var="ICINGA2_${key}"
  if [ -z "${!var}" ]; then
    warn "The variable $var needs to be configured!"
    errors+=1
  fi
done
[ -z "$errors" ] || exit 1

# Detect osfamily
if [ -n "$ICINGA2_OSFAMILY" ]; then
  info "Assuming supplied osfamily $ICINGA2_OSFAMILY"
elif check_command rpm && ! check_command dpkg; then
  info "This should be a RedHat system"
  if [ -e /etc/sysconfig/icinga2 ]; then
    # shellcheck disable=SC1091
    . /etc/sysconfig/icinga2
  fi
  ICINGA2_OSFAMILY=redhat
elif check_command dpkg; then
  info "This should be a Debian system"
  if [ -e /etc/default/icinga2 ]; then
    # shellcheck disable=SC1091
    . /etc/default/icinga2
  fi
  ICINGA2_OSFAMILY=debian
elif check_command apk; then
  info "This should be a Alpine system"
  if [ -e /etc/icinga2/icinga2.sysconfig ]; then
    # shellcheck disable=SC1091
    . /etc/icinga2/icinga2.sysconfig
  fi
  ICINGA2_OSFAMILY=alpine
else
  fail "Could not determine your os type!"
fi

# internal defaults
: "${ICINGA2_CONFIG_FILE:=/etc/icinga2/icinga2.conf}"
: "${ICINGA2_CONFIGDIR:="$(dirname "$ICINGA2_CONFIG_FILE")"}"
: "${ICINGA2_DATADIR:=/var/lib/icinga2}"
: "${ICINGA2_SSLDIR_OLD:="${ICINGA2_CONFIGDIR}"/pki}"
: "${ICINGA2_SSLDIR_NEW:="${ICINGA2_DATADIR}"/certs}"
: "${ICINGA2_SSLDIR:=}"
: "${ICINGA2_BIN:=icinga2}"

case "$ICINGA2_OSFAMILY" in
debian)
  : "${ICINGA2_USER:=nagios}"
  : "${ICINGA2_GROUP:=nagios}"
  ;;
redhat)
  : "${ICINGA2_USER:=icinga}"
  : "${ICINGA2_GROUP:=icinga}"
  ;;
alpine)
  : "${ICINGA2_USER:=icinga}"
  : "${ICINGA2_GROUP:=icinga}"
  ;;
*)
  fail "Unknown osfamily '$ICINGA2_OSFAMILY'!"
  ;;
esac

icinga_version() {
  "$ICINGA2_BIN" --version 2>/dev/null | grep -oPi '\(version: [rv]?\K\d+\.\d+\.\d+[^\)]*'
}

version() {
   echo "$@" | awk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }'
}

# Make sure icinga2 is installed and running
echo -n "check: icinga2 installed - "
if version=$(icinga_version); then
  echo "OK: $version"
else
  fail "You need to install icinga2!"
fi

if [ -z "${ICINGA2_SSLDIR}" ]; then
  if [ -f "${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt" ]; then
    info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}"
    info "Because you already have a certificate in ${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt"
    ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}"
  elif [ $(version $version) -gt $(version 2.8) ]; then
    info "Using new SSL directory: ${ICINGA2_SSLDIR_NEW}"
    ICINGA2_SSLDIR="${ICINGA2_SSLDIR_NEW}"
  else
    info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}"
    ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}"
  fi
fi

if [ ! -d "$ICINGA2_SSLDIR" ]; then
  mkdir "$ICINGA2_SSLDIR"
  chown "$ICINGA2_USER.$ICINGA2_GROUP" "$ICINGA2_SSLDIR"
fi

if [ -f "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" ]; then
  warn "ERROR: a certificate for '${ICINGA2_NODENAME}' already exists"
  warn "Please remove ${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.??? in case you want a"
  warn "new certificate to be generated and signed by ${ICINGA2_CA_NODE}"

  if [ -z "${ICINGA2_UPDATE_CONFIG}" ] && [ -z "${ICINGA2_DRYRUN}" ]; then
    warn "Aborting here, you can can call the script like this to just update config:"
    info " ICINGA2_UPDATE_CONFIG=1 $0"
    exit 1
  fi
elif [ -z "${ICINGA2_DRYRUN}" ]; then
  if ! "$ICINGA2_BIN" pki new-cert --cn "${ICINGA2_NODENAME}" \
    --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \
    --csr "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.csr" \
    --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key"
  then fail "Could not create self signed certificate!"
  fi

  if ! "$ICINGA2_BIN" pki save-cert \
    --host "${ICINGA2_CA_NODE}" \
    --port "${ICINGA2_CA_PORT}" \
    --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \
    --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt"
  then fail "Could not retrieve trusted certificate from host ${ICINGA2_CA_NODE}"
  fi

  if ! "$ICINGA2_BIN" pki request \
    --host "${ICINGA2_CA_NODE}" \
    --port "${ICINGA2_CA_PORT}" \
    --ticket "${ICINGA2_CA_TICKET}" \
    --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \
    --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \
    --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt" \
    --ca "${ICINGA2_SSLDIR}/ca.crt"
  then fail "Could not retrieve final certificate from host ${ICINGA2_CA_NODE}"
  fi
else
  info "Would create certificates under ${ICINGA2_SSLDIR}, but in dry-run!"
fi

# Prepare Config Files
content_config=$(cat << EOF
/** Icinga 2 Config - proposed by Icinga Director */

include "constants.conf"

$([ "${ICINGA2_HOSTNAME}" != "${ICINGA2_NODENAME}" ] || echo '// ')const NodeName = "${ICINGA2_NODENAME}"

include "zones.conf"
include "features-enabled/*.conf"

include <itl>
include <plugins>
include <plugins-contrib>
include <manubulon>
include <windows-plugins>
include <nscp>
EOF
)

endpoint_list=''
for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do
  endpoint=$(echo "$item" | cut -d, -f1)
  endpoint_list+="\"${endpoint}\", "
done

content_zones=$(cat << EOF
/** Icinga 2 Config - proposed by Icinga Director */

object Endpoint "${ICINGA2_NODENAME}" {}

object Zone "${ICINGA2_NODENAME}" {
  parent = "${ICINGA2_PARENT_ZONE}"
  endpoints = [ "${ICINGA2_NODENAME}" ]
}

object Zone "${ICINGA2_PARENT_ZONE}" {
  endpoints = [ ${endpoint_list%, } ]
}
EOF
)

for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do
  endpoint=$(echo "$item" | cut -d, -f1)
  host=$(echo "$item" | cut -s -d, -f2)

  content_zones+=$(cat << EOF

object Endpoint "${endpoint}" {
$([ -n "$host" ] && echo "  host = \"${host}\"" || echo "  //host = \"${endpoint}\"")
}
EOF
)
done

for zone in "${ICINGA2_GLOBAL_ZONES[@]}"; do
  content_zones+=$(cat << EOF

object Zone "${zone}" {
  global = true
}
EOF
)
done

content_api="/** Icinga 2 Config - proposed by Icinga Director */

object ApiListener \"api\" {"

if [ "${ICINGA2_SSLDIR}" = "${ICINGA2_SSLDIR_OLD}" ]; then
content_api+="
  cert_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.crt\"
  key_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.key\"
  ca_path = SysconfDir + \"/icinga2/pki/ca.crt\"
"
fi
content_api+="
  accept_commands = true
  accept_config = true
}
"

if [ -z "${ICINGA2_DRYRUN}" ]; then
  install_config "$ICINGA2_CONFIGDIR"/icinga2.conf "$content_config"
  install_config "$ICINGA2_CONFIGDIR"/zones.conf "$content_zones"
  install_config "$ICINGA2_CONFIGDIR"/features-available/api.conf "$content_api"

  "$ICINGA2_BIN" feature enable api

  "$ICINGA2_BIN" daemon -C

  echo "Please restart icinga2:"
  case "$ICINGA2_OSFAMILY" in
  debian)
    echo "  systemctl restart icinga2"
    ;;
  redhat)
    echo "  systemctl restart icinga2"
    ;;
  alpine)
    echo "  rc-service icinga2 restart"
    ;;
  *)
    fail "Unknown osfamily '$ICINGA2_OSFAMILY'!"
    ;;
  esac
else
  output_code() {
    sed 's/^/    /m' <<<"$1"
  }
  echo "### $ICINGA2_CONFIGDIR"/icinga2.conf
  echo
  output_code "$content_config"
  echo
  echo "### $ICINGA2_CONFIGDIR"/zones.conf
  echo
  output_code "$content_zones"
  echo
  echo "### $ICINGA2_CONFIGDIR"/features-available/api.conf
  echo
  output_code "$content_api"
fi

# chmod +x deploy-agent.sh
# ./deploy-agent.sh

INFO: This should be a RedHat system
check: icinga2 installed - OK: 2.16.5-1
INFO: Using new SSL directory: /var/lib/icinga2/certs
information/base: Writing private key to '/var/lib/icinga2/certs/Lion.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/certs/Lion.crt'.
information/base: Writing certificate signing request to '/var/lib/icinga2/certs/Lion.csr'.
information/cli: Retrieving TLS certificate for 'lepard:5665'.

 Version:             3
 Subject:             CN = lepard
 Issuer:              CN = Icinga CA
 Valid From:          Sep  2 03:58:50 2026 GMT
 Valid Until:         Oct  4 03:58:50 2027 GMT
 Serial:              07278DB03F3C9EA73C2061036EFDCA6AB5664F45

 Signature Algorithm: sha256WithRSAEncryption
 Subject Alt Names:   lepard
 Fingerprint:         A1 E4 2C 9E 2B DF 55 FD FB 7F 7A 7D 01 02 5F 73 53 9F 99 B7 D8 B9 43 E7 C3 3B 17 74 13 AA 55 57

***
*** You have to ensure that this certificate actually matches the parent
*** instance's certificate in order to avoid man-in-the-middle attacks.
***

information/pki: Writing certificate to file '/var/lib/icinga2/certs/trusted-master.crt'.
information/cli: Writing CA certificate to file '/var/lib/icinga2/certs/ca.crt'.
information/cli: Writing signed certificate to file '/var/lib/icinga2/certs/Lion.crt'.
INFO: Creating a backup at /etc/icinga2/icinga2.conf.orig
Writing config to /etc/icinga2/icinga2.conf
INFO: Creating a backup at /etc/icinga2/zones.conf.orig
Writing config to /etc/icinga2/zones.conf
INFO: Creating a backup at /etc/icinga2/features-available/api.conf.orig
Writing config to /etc/icinga2/features-available/api.conf
Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.
[2026-09-02 17:48:08 +0900] information/cli: Icinga application loader (version: r2.16.5-1)
[2026-09-02 17:48:08 +0900] information/cli: Loading configuration file(s).
[2026-09-02 17:48:08 +0900] information/ConfigItem: Committing config item(s).
[2026-09-02 17:48:08 +0900] information/ApiListener: My API identity: Lion
[2026-09-02 17:48:08 +0900] warning/ApiListener: Security notice:
    Currently, all ApiUsers are allowed to use Icinga 2 DSL filter expressions
    in API queries because enforce_filter_expression_permission is set to false.
    This can pose a security risk as filters are evaluated within the Icinga 2
    process and their complexity can be used for denial of service attacks. The
    new 'filter-expression' permission can be used to allow this for individual
    ApiUsers, which should only be granted to trusted users. It is recommended
    to set enforce_filter_expression_permission to true to enforce the
    permission. This will become the default in v2.17.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 1 CheckerComponent.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 3 Zones.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 1 IcingaApplication.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 1 FileLogger.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 2 Endpoints.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 1 ApiListener.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 250 CheckCommands.
[2026-09-02 17:48:08 +0900] information/ConfigItem: Instantiated 1 NotificationComponent.
[2026-09-02 17:48:08 +0900] information/ScriptGlobal: Dumping variables to file '/var/cache/icinga2/icinga2.vars'
[2026-09-02 17:48:08 +0900] information/cli: Finished validating the configuration file(s).
Please restart icinga2:
  systemctl restart icinga2

# systemctl restart icinga2