smart_proxy_monitoring 0.1.1 → 0.1.2
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA256:
|
3
|
+
metadata.gz: 46ec7e1ae3a0926b300c520f7b8662ac70b5c497712974eed34071f450559d5a
|
4
|
+
data.tar.gz: 8fb8d22594814a7a14228695a294377eef17fd751d39461f072fac269f5efa0a
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: e8fa63a47d22f009520c4ffde668b9d93b11c12a1801ec205b3f42379bb5d3f653695dead3bd9a1d875fcd757fc994d2c20175fff93ef3aae30b6b77b82f5c63
|
7
|
+
data.tar.gz: 10f9b88a20566a5e8663039b3f5076f810c41b83006425b8acd26c32e6cfa85d6833f294e78b4b2c640c6d6c3872a6bc8db660bf64f523762dfaa4e98421b018
|
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# Smart Proxy - Monitoring
|
2
2
|
|
3
3
|
This plug-in adds support for Monitoring to Foreman's Smart Proxy.
|
4
|
-
It requires
|
4
|
+
It also requires the Foreman Monitoring plug-in.
|
5
5
|
|
6
6
|
# Installation
|
7
7
|
|
@@ -18,7 +18,7 @@ Deb users can install the `ruby-smart-proxy-monitoring` packages.
|
|
18
18
|
# Configuration
|
19
19
|
|
20
20
|
The plug-in requires some configuration on the Monitoring server and the Smart Proxy.
|
21
|
-
For now the only supported Monitoring solution is Icinga 2 and the combination of Icinga 2
|
21
|
+
For now, the only supported Monitoring solution is Icinga 2 and the combination of Icinga 2
|
22
22
|
and the Icinga Web 2 Module Director.
|
23
23
|
|
24
24
|
## Icinga 2
|
@@ -31,7 +31,7 @@ The required steps for connecting the Smart Proxy and Icinga 2 will be found bel
|
|
31
31
|
|
32
32
|
### Monitoring Server
|
33
33
|
|
34
|
-
On the Monitoring Server you have to enable the API and create API User.
|
34
|
+
On the Monitoring Server, you have to enable the API and create API User.
|
35
35
|
|
36
36
|
For testing the fastest way to setup this will be the following commands.
|
37
37
|
|
@@ -40,12 +40,12 @@ For testing the fastest way to setup this will be the following commands.
|
|
40
40
|
# systemctl restart icinga2.service
|
41
41
|
```
|
42
42
|
|
43
|
-
This will create the
|
43
|
+
This will create the certificates, enable the API feature and create and API User `root` with
|
44
44
|
a random password. The configuration of the API User will be located in `/etc/icinga2/conf.d/api-users.conf`.
|
45
45
|
|
46
46
|
More detailed instructions:
|
47
47
|
|
48
|
-
To enable the API follow the next steps
|
48
|
+
To enable the API, follow the next steps if the API is already enabled skip this steps
|
49
49
|
and start by creating an API User. The API will already be enabled if you use the Icingaweb 2
|
50
50
|
Module Director for configuration, Icinga 2 as Agents or in a distributed or high-available
|
51
51
|
setup.
|
@@ -60,8 +60,8 @@ To create Icinga 2's own CA run:
|
|
60
60
|
# icinga2 pki new-ca
|
61
61
|
```
|
62
62
|
|
63
|
-
Afterwards copy the CA certificate to Icinga 2's
|
64
|
-
source and platform you have to create the
|
63
|
+
Afterwards copy the CA certificate to Icinga 2's PKI directory (depending on installation
|
64
|
+
source and platform you have to create the PKI directory first with write permissions for the
|
65
65
|
user Icinga 2 is running with, typically `icinga` or `nagios`):
|
66
66
|
|
67
67
|
```
|
@@ -81,7 +81,7 @@ And then sign the certficate request to get a certificate by executing:
|
|
81
81
|
# icinga2 pki sign-csr --csr /etc/icinga2/pki/$(hostname -f).csr --cert /etc/icinga2/pki/$(hostname -f).crt
|
82
82
|
```
|
83
83
|
|
84
|
-
With the certificates created and placed in Icinga 2's
|
84
|
+
With the certificates created and placed in Icinga 2's PKI directory, you can enable the API feature.
|
85
85
|
|
86
86
|
```
|
87
87
|
# icinga2 feature enable api
|
@@ -89,7 +89,7 @@ With the certificates created and placed in Icinga 2's pki directory you can ena
|
|
89
89
|
```
|
90
90
|
|
91
91
|
To allow API connections you have to create an API User. You should name him according to the use case,
|
92
|
-
so instructions will create
|
92
|
+
so instructions will create a user named `foreman`.
|
93
93
|
|
94
94
|
Password authentication is easier to setup, but certificate-based authentication is more secure.
|
95
95
|
|
@@ -118,8 +118,8 @@ object ApiUser "foreman" {
|
|
118
118
|
# icinga2 pki sign-csr --csr /etc/icinga2/pki/foreman.csr --cert /etc/icinga2/pki/foreman.crt
|
119
119
|
```
|
120
120
|
|
121
|
-
In addition to the authentication a Host template is required. By default it uses "foreman-host" if none
|
122
|
-
is provided
|
121
|
+
In addition to the authentication, a Host template is required. By default, it uses "foreman-host" if none
|
122
|
+
is provided at the Foreman WebUI. This template should define defaults for the host check and intervals.
|
123
123
|
|
124
124
|
```
|
125
125
|
# vi /etc/icinga2/conf.d/templates.conf
|
@@ -141,7 +141,7 @@ template Host "foreman-host" {
|
|
141
141
|
|
142
142
|
Ensure that the Monitoring module is enabled and uses the provider monitoring_icinga2.
|
143
143
|
It is the default provider so also no setting for use_provider is fine.
|
144
|
-
If you configured hosts in Icinga2 only with hostname instead of FQDN, you can add `:strip_domain` with
|
144
|
+
If you configured hosts in Icinga2 only with the hostname instead of the FQDN, you can add `:strip_domain` with
|
145
145
|
all the parts to strip, e.g. `.localdomain`.
|
146
146
|
By default, SmartProxy will collect monitoring statuses from your monitoring solution and upload them to
|
147
147
|
Foreman. This can be disabled by setting `collect_status` to `false`.
|
@@ -173,7 +173,7 @@ instead of the FQDN of the server, you will have to set verify_ssl to false.
|
|
173
173
|
:verify_ssl: true
|
174
174
|
```
|
175
175
|
|
176
|
-
Afterwards restart the service.
|
176
|
+
Afterwards, restart the service.
|
177
177
|
|
178
178
|
```
|
179
179
|
# systemctl restart foreman-proxy.service
|
@@ -182,27 +182,27 @@ Afterwards restart the service.
|
|
182
182
|
## Icinga 2 and Icinga Web 2 Module Director
|
183
183
|
|
184
184
|
This requires you to do the configuration steps above so
|
185
|
-
Downtimes
|
185
|
+
Downtimes can be sent to Foreman and Status information can be
|
186
186
|
read from Icinga 2.
|
187
187
|
|
188
|
-
In addition you have to configure the provider Icingadirector
|
188
|
+
In addition, you have to configure the provider Icingadirector
|
189
189
|
for managing hosts in the Icinga Web 2 Module Director. This
|
190
190
|
graphical configuration frontend for Icinga 2 will allow you
|
191
191
|
to customize the host, e.g. adding additional required objects
|
192
192
|
for using Icinga 2 as a monitoring agent or assign more attributes
|
193
|
-
and services. By default it requires a template named `foreman-host`.
|
193
|
+
and services. By default, it requires a template named `foreman-host`.
|
194
194
|
|
195
195
|
### Icinga Web 2 Module Director
|
196
196
|
|
197
197
|
Using the API of the Icinga Web 2 Module Director requires
|
198
|
-
Authentication and Authorisation
|
198
|
+
Authentication and Authorisation as it is described in the
|
199
199
|
[documentation](https://github.com/Icinga/icingaweb2-module-director/blob/master/doc/70-REST-API.md).
|
200
200
|
|
201
|
-
For the basic authentication of the webserver there are two
|
201
|
+
For the basic authentication of the webserver, there are two
|
202
202
|
possible ways of configuration. If you already use basic auth
|
203
203
|
simply add a user and password to the authentication source.
|
204
204
|
If you do not want to add basic authentication you can configure
|
205
|
-
the webserver to auto login as a user depending on your source
|
205
|
+
the webserver to auto login as a user depending on your source IP.
|
206
206
|
```
|
207
207
|
# vi /etc/httpd/conf.d/icingaweb2.conf
|
208
208
|
...
|
@@ -213,14 +213,14 @@ RewriteRule ^(.*)$ - [E=REMOTE_USER:foreman]
|
|
213
213
|
```
|
214
214
|
|
215
215
|
In Icinga Web 2 you also have to add an authentication backend
|
216
|
-
|
216
|
+
`external`.
|
217
217
|
```
|
218
218
|
# vi /etc/icingaweb2/authentication.ini
|
219
219
|
[External]
|
220
220
|
backend = "external"
|
221
221
|
```
|
222
222
|
|
223
|
-
Furthermore a role is required assigning permissions to your user.
|
223
|
+
Furthermore, a role is required assigning permissions to your user.
|
224
224
|
```
|
225
225
|
# vi /etc/icingaweb2/roles.ini
|
226
226
|
[Foreman]
|
@@ -230,8 +230,8 @@ permissions = "module/director, director/api, director/*"
|
|
230
230
|
|
231
231
|
### Smart Proxy
|
232
232
|
|
233
|
-
Ensure that the Monitoring module is enabled and uses the provider monitoring_icinga2
|
234
|
-
and monitoring_icingadirector
|
233
|
+
Ensure that the Monitoring module is enabled and uses the provider `monitoring_icinga2`
|
234
|
+
and `monitoring_icingadirector`.
|
235
235
|
```
|
236
236
|
# vi /etc/foreman-proxy/settings.d/monitoring.yml
|
237
237
|
---
|
@@ -255,7 +255,7 @@ but not required.
|
|
255
255
|
:verify_ssl: true
|
256
256
|
```
|
257
257
|
|
258
|
-
Afterwards restart the service.
|
258
|
+
Afterwards, restart the service.
|
259
259
|
|
260
260
|
```
|
261
261
|
# systemctl restart foreman-proxy.service
|
@@ -264,14 +264,14 @@ Afterwards restart the service.
|
|
264
264
|
# Troubleshooting
|
265
265
|
|
266
266
|
The plug-in uses the configuration of the Smart Proxy to write its logs and does
|
267
|
-
not provide a
|
267
|
+
not provide a separate log for now. So have a look into `/var/log/foreman-proxy/proxy.log`
|
268
268
|
for default installations.
|
269
269
|
|
270
270
|
Also look into the logs of the monitoring solution and when opening issues attach relevant entries
|
271
271
|
for both logs. For Icinga 2 it is typically `/var/log/icinga2/icinga2.log` or if enabled
|
272
272
|
`/var/log/icinga2/debug.log`. Icinga Web 2 Director uses Icinga Web 2's configuration
|
273
|
-
which is typically logging to syslog with
|
274
|
-
which will result in logging entry in `/var/log/message` for osfamily Red Hat and `/var/log/syslog`
|
273
|
+
which is typically logging to syslog with facility `user` and application prefix `icingaweb2`
|
274
|
+
which will result in a logging entry in `/var/log/message` for osfamily Red Hat and `/var/log/syslog`
|
275
275
|
for osfamily Debian.
|
276
276
|
|
277
277
|
# TODO
|
@@ -39,7 +39,7 @@ module ::Proxy::Monitoring::Icinga2
|
|
39
39
|
transformed = { result: change[:check_result][:state] }
|
40
40
|
when 'AcknowledgementSet'
|
41
41
|
transformed = { acknowledged: true }
|
42
|
-
when '
|
42
|
+
when 'AcknowledgementCleared'
|
43
43
|
transformed = { acknowledged: false }
|
44
44
|
when 'DowntimeTriggered'
|
45
45
|
transformed = { downtime: true }
|
@@ -82,6 +82,8 @@ module ::Proxy::Monitoring::IcingaDirector
|
|
82
82
|
Proxy::Monitoring::NotFound.new("Icinga Director returned not found for #{request_url(url)}.")
|
83
83
|
when RestClient::Unauthorized
|
84
84
|
Proxy::Monitoring::AuthenticationError.new("Error authenicating to Icinga Director at #{request_url(url)}: #{e.message}")
|
85
|
+
when RestClient::NotModified
|
86
|
+
raise
|
85
87
|
else
|
86
88
|
Proxy::Monitoring::Error.new("Error connecting to Icinga Director at #{request_url(url)}: #{e.message}")
|
87
89
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: smart_proxy_monitoring
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.1.
|
4
|
+
version: 0.1.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Timo Goebel
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date:
|
12
|
+
date: 2018-06-12 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: rest-client
|
@@ -141,7 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
141
141
|
version: '0'
|
142
142
|
requirements: []
|
143
143
|
rubyforge_project:
|
144
|
-
rubygems_version: 2.
|
144
|
+
rubygems_version: 2.7.3
|
145
145
|
signing_key:
|
146
146
|
specification_version: 4
|
147
147
|
summary: Monitoring plug-in for Foreman's smart proxy
|