AHMED ZBYR

AHMED ZBYR

Biker, EV Enthusiast

After migrating or restoring a Nagios XI server, navigating to the Servicegroup Summary, Hostgroup Summary, or legacy Nagios Core CGI views may fail with one of two errors:

Problem 1: CGI Configuration File Unreadable or Missing

Error: Could not open CGI config file '/usr/local/nagios/etc/cgi.cfg' for reading!

Problem 1

Problem 2: Authorization Denied for Requested Hosts/Services

It appears as though you do not have permission to view information for any of the hosts you requested...

Problem 2

Root Cause

Nagios Core’s C-based CGI binaries (status.cgi, extinfo.cgi, cmd.cgi) read /usr/local/nagios/etc/cgi.cfg on every request to determine:

  1. Where the main nagios.cfg file and HTML assets reside.
  2. Which authenticated users (authorized_for_all_hosts, authorized_for_all_services, etc.) have global visibility and command permissions.

If /usr/local/nagios/etc/cgi.cfg is missing, has restrictive file permissions that prevent the apache user from reading it, or is missing nagiosadmin in its authorized_for_* directives, the Service Group Summary page fails with the errors above.

Solution: Restore and Verify /usr/local/nagios/etc/cgi.cfg

1. Expected /usr/local/nagios/etc/cgi.cfg Content for Nagios XI

Ensure /usr/local/nagios/etc/cgi.cfg contains the following configuration:

# MODIFIED
default_statusmap_layout=6

# UNMODIFIED
action_url_target=_blank
authorized_for_all_host_commands=nagiosadmin
authorized_for_all_hosts=nagiosadmin
authorized_for_all_service_commands=nagiosadmin
authorized_for_all_services=nagiosadmin
authorized_for_configuration_information=nagiosadmin
authorized_for_system_commands=nagiosadmin
authorized_for_system_information=nagiosadmin
default_statuswrl_layout=4
escape_html_tags=1
lock_author_names=1
main_config_file=/usr/local/nagios/etc/nagios.cfg
notes_url_target=_blank
physical_html_path=/usr/local/nagios/share
ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$
refresh_rate=90
show_context_help=0
url_html_path=/nagios
use_authentication=1
use_pending_states=1
use_ssl_authentication=0

2. Step-by-Step Recovery from the Nagios XI Installer Archive

If /usr/local/nagios/etc/cgi.cfg was corrupted or overwritten, you can restore the clean Nagios XI template directly from the Nagios XI source archive:

  1. Extract the Nagios XI installer tarball: 
    tar xvf xi-5.2.9.tar.gz
cd nagiosxi/
  2. Locate the bundled cgi.cfg template: 
    find . -name "cgi.cfg" -print
# ./subcomponents/nagioscore/mods/cfg/cgi.cfg
  3. Back up the existing /usr/local/nagios/etc/cgi.cfg file: 
    sudo cp /usr/local/nagios/etc/cgi.cfg /usr/local/nagios/etc/cgi.cfg.org
  4. Copy the clean cgi.cfg into /usr/local/nagios/etc/ and verify ownership (apache:nagios) and permissions (0664): 
    sudo cp ./subcomponents/nagioscore/mods/cfg/cgi.cfg /usr/local/nagios/etc/cgi.cfg
sudo chown apache:nagios /usr/local/nagios/etc/cgi.cfg
sudo chmod 0664 /usr/local/nagios/etc/cgi.cfg
  5. Restart httpd and nagios: 
    sudo service httpd restart
sudo service nagios restart

Once restarted, the Service Group Summary view loads normally:

Resolved

(Tip: In Nagios XI, when you create additional administrative users in Admin → Manage Users, Nagios XI automatically appends their usernames to the comma-delimited authorized_for_* lines in /usr/local/nagios/etc/cgi.cfg. If you replace cgi.cfg from the installer archive, go to Admin → Manage Users, edit any non-nagiosadmin admin accounts, and click Update User so Nagios XI re-syncs their usernames into cgi.cfg.)

Reference: Annotated Nagios Core cgi.cfg Directives

Below is the annotated upstream Nagios Core cgi.cfg.in reference explaining each directive:

#################################################################
# CGI.CFG - Sample CGI Configuration File for Nagios
#################################################################

# MAIN CONFIGURATION FILE
# Tells the CGIs where to find your main configuration file.
main_config_file=/usr/local/nagios/etc/nagios.cfg

# PHYSICAL HTML PATH
# Directory where the HTML files for Nagios reside.
physical_html_path=/usr/local/nagios/share

# URL HTML PATH
# URL path corresponding to the physical location of the Nagios HTML files.
url_html_path=/nagios

# CONTEXT-SENSITIVE HELP (0 = disabled, 1 = enabled)
show_context_help=0

# PENDING STATES OPTION (1 = mark unchecked hosts/services as PENDING)
use_pending_states=1

# AUTHENTICATION USAGE
# Controls whether the CGIs use authentication when displaying status
# and committing commands to Nagios. Keep set to 1!
use_authentication=1

# x509 CERT AUTHENTICATION
use_ssl_authentication=0

# SYSTEM/PROCESS INFORMATION ACCESS
authorized_for_system_information=nagiosadmin

# CONFIGURATION INFORMATION ACCESS
authorized_for_configuration_information=nagiosadmin

# SYSTEM/PROCESS COMMAND ACCESS
authorized_for_system_commands=nagiosadmin

# GLOBAL HOST/SERVICE VIEW ACCESS
authorized_for_all_services=nagiosadmin
authorized_for_all_hosts=nagiosadmin

# GLOBAL HOST/SERVICE COMMAND ACCESS
authorized_for_all_service_commands=nagiosadmin
authorized_for_all_host_commands=nagiosadmin

# READ-ONLY USERS (optional)
#authorized_for_read_only=user1,user2

# DEFAULT STATUSMAP LAYOUT METHOD
# 0 = User-defined coordinates, 1 = Depth layers, 2 = Collapsed tree,
# 3 = Balanced tree, 4 = Circular, 5 = Circular (Marked Up), 6 = Circular (Balloon)
default_statusmap_layout=6

# DEFAULT STATUSWRL LAYOUT METHOD
default_statuswrl_layout=4

# PING SYNTAX
ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$

# REFRESH RATE (in seconds)
refresh_rate=90

# DEFAULT PAGE LIMIT (0 = show all results)
result_limit=100

# ESCAPE HTML TAGS (1 = escape HTML tags in plugin output)
escape_html_tags=1

# URL TARGET FRAMES
action_url_target=_blank
notes_url_target=_blank

# LOCK AUTHOR NAMES OPTION (1 = disallow editing author name on comments/downtime)
lock_author_names=1

# NAVIGATION BAR SEARCH OPTIONS
navbar_search_for_addresses=1
navbar_search_for_aliases=1

References

You May Also Enjoy