Monitoraggio di sistemi con collectd

Installazione stand alone

• Installazione pacchetti

sudo apt-get install collectd

• Abilitazione plugin necessari:

sudoedit /etc/collectd/collectd.conf 

• Syslog è necessario per loggare:

LoadPlugin syslog
<Plugin syslog>
        LogLevel info
</Plugin>

• Rrdtool è necessario per scrivere le statistiche su disco in /var/lib/collectd/rrd/nomemacchina.example.com. Se la macchina che si sta configurando è solo client, non è necessario salvare le statistiche in locale:

LoadPlugin rrdtool
<Plugin rrdtool>
        DataDir "/var/lib/collectd/rrd"
</Plugin>

• Questo è un plugin base per le statistiche CPU, non necessita di configurazione:

LoadPlugin cpu

• Vedi sezione finale per quelli che necessitano di configurazione

• Riavvio

sudo invoke-rc.d collectd restart

Installazione frontend web

PhpCollection

cd /var/www/
sudo mkdir php-collection
cd php-collection/
sudo cp /usr/share/doc/collectd/examples/php-collection/* .

• Installare apache2 e php-5

• Loggarsi su http://servername.example.com/php-collection/

CGP

cd /var/www
sudo mkdir -p collectd
cd collectd
sudo git clone https://github.com/pommi/CGP.git .

• Loggarsi su http://servername.example.com/collectd/

Configurazione Client

• Installare come standalone

• Se non si intende consultare le statistiche in locale, è possibile NON abilitare il plugin rrdtool

1. LoadPlugin rrdtool

• Abilitare il plugin network, che serve ad inviare le statistiche ad un server centrale:

sudoedit /etc/collectd/collectd.conf 

LoadPlugin network

<Plugin network>
#   # client setup:
    Server "192.168.254.101"
</Plugin>

• Riavviare

sudo invoke-rc.d collectd restart

Configurazione Server

• Installare come standalone

• Abilitare il plugin

sudoedit /etc/collectd/collectd.conf 

LoadPlugin network

<Plugin network>
#   # server setup:
    Listen "192.168.254.101"
</Plugin>

• Riavviare

sudo invoke-rc.d collectd restart

Gestione

• Azzerare il database:

sudo invoke-rc.d collectd stop
sudo rm -rf /var/lib/collectd/rrd
sudo invoke-rc.d collectd start

Configurazione Plugins

Apache

• Configurare mod_status sul virtualhost da monitorare:

sudoedit /etc/mods-enabled/status.conf

<IfModule mod_status.c>
        #
        # Allow server status reports generated by mod_status,
        # with the URL of http://servername/server-status
        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
        #
        <Location /server-status>
            SetHandler server-status
            #    Order deny,allow
            #    Deny from all
            #    Allow from 127.0.0.1 ::1
            #    Allow from 192.0.2.0/24
        </Location>

        # Keep track of extended status information for each request
        ExtendedStatus On

        # Determine if mod_status displays the first 63 characters of a request or
        # the last 63, assuming the request itself is greater than 63 chars.
        # Default: Off
        #SeeRequestTail On


        <IfModule mod_proxy.c>
            # Show Proxy LoadBalancer status in mod_status
            ProxyStatus On
        </IfModule>


</IfModule>

sudo invoke-rc.d apache2 reload

• Verificare

http://myserver.example.com/server-status?auto

Total Accesses: 60870
Total kBytes: 295063
CPULoad: .21889
Uptime: 39216
ReqPerSec: 1.55217
BytesPerSec: 7704.62
BytesPerReq: 4963.77
BusyWorkers: 31
IdleWorkers: 8
Scoreboard: .KW__K__KKKKKK_K.K_K.K..K.WK_KKKKWK_...WKR.K........KKKK......K................................................................................................................................................................................................

• Configurare il plugin

sudoedit /etc/collectd/collectd.conf 

# ...
LoadPlugin apache
#...
<Plugin apache>
    <Instance myserver.example.priv">
        URL "http://myserver.example.priv/server-status?auto"
#       User "www-user"
#       Password "secret"
#       VerifyPeer false
#       VerifyHost false
#       CACert "/etc/ssl/ca.crt"
        Server "apache"
    </Instance>

    <Instance "myserver.example.com">
        URL "https://myserver.example.com/server-status?auto"
#       User "www-user"
#       Password "secret"
#       VerifyPeer false
#       VerifyHost false
#       CACert "/etc/ssl/ca.crt"
        Server "apache"
    </Instance>
</Plugin>

sudo invoke-rc.d collectd restart

Bind

• Questo plugin mostra delel statistiche di bind.
• Attivare l'accesso alle stats di bind:

sudoedit /etc/bind/named.conf.options

# ...
 statistics-channels {
  inet 127.0.0.1 port 8053;
};
# ...

sudo invoke-rc.d bind9 restart

• Impostare le opzioni:

sudoedit /etc/collectd/collectd.conf 

# ...
LoadPlugin bind
#...
<Plugin "bind">
    URL "http://localhost:8053/"

    OpCodes true
    QTypes true
    ServerStats true
    ZoneMaintStats true
    ResolverStats false
    MemoryStats true
#
#   <View "_default">
#       QTypes true
#       ResolverStats true
#       CacheRRSets true
#
#       Zone "127.in-addr.arpa/IN"
#   </View>
</Plugin>

sudo invoke-rc.d collectd restart

Df

Mostra spazio libero ed occupato. Di default mostra tutti i filesystem montati, compresi i temporanei. Per includere solo i filesystem ext4:

#...
LoadPlugin df
#...
<Plugin df>
    FSType ext4
    IgnoreSelected false
    ReportByDevice true
    ReportInodes true
</Plugin>
#...

Per un bug, se non si configura il plugin, i filesystem vengono conteggiati doppi (ad esempio rootfs o tmpfs), e il syslog viene floodato con messaggi del tipo

Aug 20 16:27:12 mythbox collectd[32167]: rrdtool plugin: rrd_update_r (/var/lib/collectd/rrd/mythbox/df-root/df_complex-free.rrd) failed: /var/lib/collectd/rrd/mythbox/df-root/df_complex-free.rrd: illegal attempt to update using time 1345444032 when last update time is 1345444032 (minimum one second step)

Attenzione che in questo modo, se vengono montati degli snapshot o filesystem, questi verranno inclusi nel conteggio. Eventualmente, usare la selezione per device, esempio:

Device "/dev/md0"

Vedi:

• Collectd causing rrd illegal attempt to update using time errors

Filecount

Serve per mostrare la dimensione di una directory e il numero di files.

Funziona solo se configurato.

• Esempio:

<Plugin filecount>
	<Directory "/var/www/example.com">
		Instance "WWW example.com"
		IncludeHidden true
	</Directory>
</Plugin>

HDDTemp

• Installare hddtemp setuid root, senza logging delle temperature, in ascolto con i parametri standard

sudo apt-get install hddtemp

• Configurare il plugin

sudoedit /etc/collectd/collectd.conf 

#...
LoadPlugin hddtemp
#...
<Plugin hddtemp>
    Host "127.0.0.1"
    Port 7634
    TranslateDevicename true
</Plugin>
#...

Mysql

• Configurare il plugin:

<Plugin mysql>
    <Database example_string>
        Host "localhost"
        Port 3306
        User "collectd"
        Password "secretPassword"
    </Database>

</Plugin>

• Creare uno user con questi privilegi:

 CREATE USER 'collectd'@'localhost' IDENTIFIED BY 'secretPassword';
 -- Give appropriate permissions
 -- ("GRANT USAGE" is synonymous to "no privileges")
 GRANT USAGE ON *.* TO 'collectd'@'localhost';
 -- Permissions for the MasterStats and SlaveStats options
 GRANT REPLICATION CLIENT ON *.* TO 'collectd'@'localhost';

Nut

• Questo plugin fornisce info sull'ups collegato:

LoadPlugin nut

• Indicare il nome dell'ups come da comando:

upsc -l

<Plugin nut>
        UPS "apc_backups_cs_500"
</Plugin>

Tail

Questo plugin viene usato per leggere i log. Matchando delle occorrenze si possono estrarre delle info loggate dai vari daemon.

Postfix

Questa configurazione crea delle statistiche per Postfix.

• Definire un tipo dati utilizzato nei contatori

sudoedit /etc/collectd/my_types.db 

mail_counter value:COUNTER:0:65535

• Abilitare i tipi dati custom:

sudoedit /etc/collectd/collectd.conf 

TypesDB "/usr/share/collectd/types.db" "/etc/collectd/my_types.db"

• Configurare il plugin:

sudoedit /etc/collectd/collectd.conf 

#...
LoadPlugin tail
#...
<Plugin "tail">
#...
<File "/var/log/mail.log">
# or: <File "/srv/rsyslog/mail.log">
  Instance "postfix"

   # number of connections
   # (incoming)
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: connect from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-open"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: disconnect from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-close"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: lost connection after .* from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-lost"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: timeout after .* from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-timeout"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: setting up TLS connection from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-TLS-setup"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: [A-Za-z]+ TLS connection established from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-TLS-established"
   </Match>
   # (outgoing)
   <Match>
     Regex "\\<postfix\\/smtp\\[[0-9]+\\]: setting up TLS connection to\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-out-TLS-setup"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtp\\[[0-9]+\\]: [A-Za-z]+ TLS connection established to\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-out-TLS-established"
   </Match>

  # rejects for incoming E-mails
  <Match>
    Regex "\\<554 5\\.7\\.1\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected"
  </Match>
  <Match>
    Regex "\\<450 4\\.7\\.1\\>.*Helo command rejected: Host not found\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected-host_not_found"
  </Match>
  <Match>
    Regex "\\<450 4\\.7\\.1\\>.*Client host rejected: No DNS entries for your MTA, HELO and Domain\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected-no_dns_entry"
  </Match>
   <Match>
     Regex "\\<450 4\\.7\\.1\\>.*Client host rejected: Mail appeared to be SPAM or forged\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "rejected-spam_or_forged"
   </Match>

  # status codes
  <Match>
    Regex "status=deferred"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-deferred"
  </Match>
  <Match>
    Regex "status=forwarded"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-forwarded"
  </Match>
  <Match>
    Regex "status=reject"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-reject"
  </Match>
  <Match>
    Regex "status=sent"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-sent"
  </Match>
  <Match>
    Regex "status=bounced"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-bounced"
  </Match>
  <Match>
    Regex "status=SOFTBOUNCE"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-softbounce"
  </Match>

  # message size
  <Match>
    Regex "size=([0-9]*)"
    DSType "CounterAdd"
    Type "ipt_bytes"
    Instance "size"
  </Match>

  # delays (see [1] for details)
  # total time spent in the Postfix queue
  <Match>
    Regex "delay=([\.0-9]*)"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay"
  </Match>
  # time spent before the queue manager, including message transmission
  <Match>
    Regex "delays=([\.0-9]*)/[\.0-9]*/[\.0-9]*/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-before_queue_mgr"
  </Match>
  # time spent in the queue manager
  <Match>
    Regex "delays=[\.0-9]*/([\.0-9]*)/[\.0-9]*/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-in_queue_mgr"
  </Match>
  # connection setup time including DNS, HELO and TLS
  <Match>
    Regex "delays=[\.0-9]*/[\.0-9]*/([\.0-9]*)/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-setup_time"
  </Match>
  # message transmission time
  <Match>
    Regex "delays=[\.0-9]*/[\.0-9]*/[\.0-9]*/([\.0-9]*)"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-trans_time"
  </Match>
</File>
</Plugin>

Postgrey

<File "/var/log/mail.log">
  Instance "postgrey"
  <Match>
    Regex "\\<action=greylist, reason=new\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "greylisted"
  </Match>
 
  <Match>
    Regex "\\<action=pass, reason=triplet found\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "accepted"
  </Match>
 
  <Match>
    Regex "\\<action=pass, reason=client whitelist\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "client_whitelist"
  </Match>
</File>

Vedi:

*Plugin:Tail/Config - collectd Wiki