Thoughts from the abyss

While perusing the Nagios list today during normal traffic, I found a cool new Nagios plugin which is simple but yet very effective for determining who is logged into a Linux server. It’s a Bash script which can easily be implemented across NRPE. You can whitelist users, flag other users to return a critical if you want to be alerted when someone logs in, or you can just use it for informational purposes. Thanks to Hari Sekhon, you can get it here.

Show Users

Just define a service definition in /etc/nagios/services.cfg

define service{
        use                             basic-service
        name                            check-show-users
        check_command                   check_show_users
        service_description             USERS
        contact_groups                  your_contact
        host_name                       your_box
}

Then define a check command in /etc/nagios/checkcommands.cfg

define command{
        command_name    check_show_users
        command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -c show_users
}

If you already have NRPE setup and running on the host you want to check, then just add this line to /etc/nagios/nrpe.cfg

command[show_users]=/usr/lib/nagios/plugins/show_users

This just shows all logged in users and how many sessions they have active. Check out the other switches for the whitelisting and unauthorized checks.

You can check it out on the command line:

[root@nagios plugins]# /usr/lib/nagios/plugins/show_users
USERS OK: batman(1) root(2)

Sweet! I’m easily amused when it comes to Nagios.