Graylog → Checkmk Event Console Bridge

A lightweight Python HTTP bridge that forwards Graylog alerts to the Checkmk Event Console via syslog.

---

📌 Architecture

Graylog Alert ➔ [ HTTP POST ] ➔ Python Bridge ➔ [ UDP Syslog ] ➔ Checkmk Event Console ➔ [ CRIT / WARN / OK ]

The bridge is completely generic and is not tied to a specific Graylog event type.

---

✨ Features

• 📩 Receives Graylog alerts via HTTP POST
• 🖥️ Extracts hostname automatically from Graylog group_by_fields.source
• 📊 Extracts alert title and aggregation count
• 📜 Includes the original log message from the Graylog backlog
• 📤 Sends structured events to Checkmk via UDP syslog
• ⚙️ Native systemd service integration
• 🚀 Zero external Python dependencies (uses standard library only)

---

📋 Requirements

• Python 3.x
• Graylog (with HTTP notification support)
• Checkmk (with Event Console enabled)
• UDP syslog input enabled in Checkmk
• Port 20080 available for the HTTP bridge

---

📥 Installation

1. Clone the Repository

git clone https://github.com/vmgk/graylog-checkmk-bridge.git
cd graylog-checkmk-bridge

---

2. Deploy Application Files

Create the destination directory and copy the necessary files:

sudo mkdir -p /opt/graylog-checkmk-bridge
sudo cp graylog_checkmk_bridge.py /opt/graylog-checkmk-bridge/
sudo cp config.env.example /opt/graylog-checkmk-bridge/config.env

---

3. Configure Permissions

Assign ownership to the Checkmk site user and set proper file permissions:

# Set ownership
sudo chown -R cmk:cmk /opt/graylog-checkmk-bridge

# Set permissions
sudo chmod 755 /opt/graylog-checkmk-bridge/graylog_checkmk_bridge.py
sudo chmod 640 /opt/graylog-checkmk-bridge/config.env

---

4. Install & Start Systemd Service

Install the service unit file, reload systemd, and start the service:

# Copy service file
sudo cp graylog-checkmk-bridge.service /etc/systemd/system/

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable --now graylog-checkmk-bridge

---

5. Verify Installation

Check service status:

sudo systemctl status graylog-checkmk-bridge

View live application logs:

sudo journalctl -u graylog-checkmk-bridge -f

---

⚙️ Configuration

Copy the example environment configuration file and adjust it as needed:

cp config.env.example config.env

config.env.example

LISTEN_ADDRESS=0.0.0.0
LISTEN_PORT=20080

CHECKMK_HOST=127.0.0.1
CHECKMK_PORT=514

---

🚀 Running Manually

If you prefer to run the bridge directly without systemd:

python3 graylog_checkmk_bridge.py

The bridge listens for Graylog notifications on: http://<server>:20080/graylog

---

🔧 Integration Setup

1. Graylog Setup

Create an HTTP Notification pointing to: http://<bridge-server>:20080/graylog

The bridge parses and accepts the standard Graylog alert JSON payload.

---

2. Checkmk Setup

The bridge sends a syslog message directly to the Checkmk Event Console.

Example Syslog Output:

<11>Aug 12 11:30:15 testserver graylog: Linux SSH failed authentification; count=3; Failed password for invalid user user_test5

The Checkmk Event Console uses its rules to determine the event state (CRIT, WARN, OK) and handling.

Note: The bridge itself does not determine the severity state — it forwards events to Checkmk where rule evaluation occurs.

---

📜 License

This project is licensed under the MIT License. See the LICENSE file for details.