28. 08. 2025 Attilio Broglio NetEye, Unified Monitoring

Massive Update of the Icinga custom_var (Host & Services)

One feature that’s widely used by customers for the enrichment of entities (hosts/services) within Icinga is custom_var. These can be used for a variety of reasons: to provide more information to end users about a device, faster classification, to integrate data used by other tools such as notification, etc…

These variables can be managed directly from the GUI (through the creation of dedicated fields) or through automation, but for some very large environments a massive update of these variables is either difficult to carry out, or takes a long time. This situation is hard to manage especially when these variables are set in a service, but are then inherited from the host and might be overwritten.

So in this short article, we propose an alternative approach that’s based on the Director APIs: https://icinga.com/docs/icinga-director/latest/doc/70-REST-API/#icinga-objects

The first step is to build a script for updating the custom_var “foobar” in hosts previously extracted from a CSV file, e.g. host_to_be_updated.csv, with these columns: host_name,old_var_value.

The script ignores the first line of the header, parses each line, and calls the related API to update the target custom_var “foobar”:

#!/bin/bash

while IFS="," read -r HOST $VAL

do NEW_VAL="NEV_VALUE"

URL="https://127.0.0.1/neteye/director/host?name=$HOST"

curl -k -s -u 'USERNAME@PASSWORD' -H 'Accept: application/json' -X POST $URL -d '{ "vars.foobar": "'"${NEW_VAL}"'"}'

 if [ $? -eq 0 ]

then

    echo "[OK] updated [$HOST] var: [$VAL] [$NEW_VAL]"

else

    echo "[ERROR] not updated [$HOST]"

fi

done < <(tail -n +2 host_to_be_updated.csv)

The script described above can then be improved to also perform the same operation for services, but overwriting the inherited variables.

In order to update variables inside services, we start from a CSV file (service_to_be_updated.csv) that contains an extra column with the name of the service to be updated: host_name,service_name,old_var_value where in addition the API has the “allowOverrides” query string parameter. The result will therefore be:

#!/bin/bash

while IFS="," read -r HOST SERVICE VAL

do

NEW_VAL="NEV_VALUE"

SRV=${SERVICE// /%20}

URL="https://127.0.0.1/neteye/director/service?name=$SRV&host=$HOST&allowOverrides"

curl -k -s -u 'USERNAME:PASSWORD' -H 'Accept: application/json' -X POST $URL -d '{ "vars.foobar ": "'"${NEW_VAL}"'"}'

if [ $? -eq 0 ]

then

    echo "[OK] updated [$HOST][$SERVICE] var: [$VAL] [$NEW_VAL]"

else

    echo "[ERROR] not updated [$HOST][$SERVICE]"

fi

done < <(tail -n +2 service_to_be_updated.csv)

Starting from these simple scripts, massively updating the custom_var within Icinga becomes much easier and faster, avoiding complicated situations such as updates of inherited custom_vars or similar.