Permissions

The monitoring module provides an additional set of restrictions and permissions that can be used for access control. The following sections will list those restrictions and permissions in detail:

The monitoring module allows to send commands to an Icinga 2 instance. A user needs specific permissions to be able to send those commands when using the monitoring module.

Name	Permits
monitoring/command/*	Allow all commands.
monitoring/command/schedule-check	Allow scheduling host and service checks.
monitoring/command/schedule-check /active-only	Allow scheduling host and service checks. (Only on objects with active checks enabled)
monitoring/command/acknowledge-pr oblem	Allow acknowledging host and service problems.
monitoring/command/remove-acknowl edgement	Allow removing problem acknowledgements.
monitoring/command/comment/*	Allow adding and deleting host and service comments.
monitoring/command/comment/add	Allow commenting on hosts and services.
monitoring/command/comment/delete	Allow deleting host and service comments.
monitoring/command/downtime/*	Allow scheduling and deleting host and service downtimes.
monitoring/command/downtime/sched ule	Allow scheduling host and service downtimes.
monitoring/command/downtime/delet e	Allow deleting host and service downtimes.
monitoring/command/process-check- result	Allow processing host and service check results.
monitoring/command/feature/instan ce	Allow processing commands for toggling features on an instance-wide basis.
monitoring/command/feature/object /*	Allow processing commands for toggling features on host and service objects.
monitoring/command/feature/object /active-checks	Allow processing commands for toggling active checks on host and service objects.
monitoring/command/feature/object /passive-checks	Allow processing commands for toggling passive checks on host and service objects.
monitoring/command/feature/object /notifications	Allow processing commands for toggling notifications on host and service objects.
monitoring/command/feature/object /event-handler	Allow processing commands for toggling event handlers on host and service objects.
monitoring/command/feature/object /flap-detection	Allow processing commands for toggling flap detection on host and service objects.
monitoring/command/send-custom-no tification	Allow sending custom notifications for hosts and services.

Restrictions

The monitoring module allows filtering objects:

Keys	Restricts
monitoring/filter/objects	Applies a filter to all hosts and services.

This filter will affect all hosts and services. Furthermore, it will also affect all related objects, like notifications, downtimes and events. If a service is hidden, all notifications, downtimes on that service will be hidden too.

Filter Column Names

The following filter column names are available in filter expressions:

Column	Description
instance_name	Filter on an Icinga 2 instance.
host_name	Filter on host object names.
hostgroup_name	Filter on hostgroup object names.
service_description	Filter on service object names.
servicegroup_name	Filter on servicegroup object names.
all custom variables prefixed with _host_ or _service_	Filter on specified custom variables.

Restrict Access to Custom Variables

• Restriction name: monitoring/blacklist/properties

• Restriction value: Comma separated list of GLOB like filters

Imagine the following host custom variable structure:

host.vars.
|-- cmdb_name
|-- cmdb_id
|-- cmdb_location
|-- wiki_id
|-- passwords.
|   |-- mysql_password
|   |-- ldap_password
|   `-- mongodb_password
|-- legacy.
|   |-- cmdb_name
|   |-- mysql_password
|   `-- wiki_id
`-- backup.
    `-- passwords.
        |-- mysql_password
        `-- ldap_password

host.vars.cmdb_name

Blacklists cmdb_name in the first level of the custom variable structure only. host.vars.legacy.cmdb_name is not blacklisted.

host.vars.cmdb_*

All custom variables in the first level of the structure which begin with cmdb_ become blacklisted. Deeper custom variables are ignored. host.vars.legacy.cmdb_name is not blacklisted.

host.vars.*id

All custom variables in the first level of the structure which end with id become blacklisted. Deeper custom variables are ignored. host.vars.legacy.wiki_id is not blacklisted.

host.vars.*.mysql_password

Matches all custom variables on the second level which are equal to mysql_password.

host.vars.*.*password

Matches all custom variables on the second level which end with password.

host.vars.*.mysql_password,host.vars.*.ldap_password

Matches all custorm variables on the second level which equal mysql_password or ldap_password.

host.vars.**.*password

Matches all custom variables on all levels which end with password.

Please note the two asterisks, **, here for crossing level boundaries. This syntax is used for matching the complete custom variable structure.

If you want to restrict all custom variables that end with password for both hosts and services, you have to define the following restriction.

host.vars.**.*password,service.vars.**.*password

Escape Meta Characters

Use backslash to escape the meta characters

• *

• ,

host.vars.\*fall

Matches all custom variables in the first level which equal *fall.