Surveillance de Serveur Avec munin Et monit Sur Debian Wheezy - Page 2

4 Installer Et Configurer monit

Pour installer monit, nous faisons ceci :

apt-get install monit

Maintenant, nous devons éditer /etc/monit/monitrc. Le fichier par défaut /etc/monit/monitrc contient de nombreux exemples, et vous pouvez trouver plus d’exemples de configuration sur http://mmonit.com/monit/documentation/. Cependant, dans mon cas, je veux surveiller proftpd, sshd, mysql, apache et postfix, je veux activer l’interface web de monit sur le port 2812, je veux une interface web https, je veux me connecter à l’interface web avec le nom d’utilisateur admin et le mot de passe test, et je veux que monit envoie des alertes par email à root@localhost, donc mon fichier ressemble à ceci (j’ai ajouté des exemples pour d’autres démons à la configuration afin que vous puissiez ajuster le fichier à vos besoins) :

cp /etc/monit/monitrc /etc/monit/monitrc_orig  
cat /dev/null > /etc/monit/monitrc  
vi /etc/monit/monitrc

| set daemon 60 set logfile syslog facility log_daemon set mailserver localhost set mail-format { from: [email protected] } set alert root@localhost set httpd port 2812 and SSL ENABLE PEMFILE /var/certs/monit.pem allow admin:test check process proftpd with pidfile /var/run/proftpd.pid start program = "/etc/init.d/proftpd start" stop program = "/etc/init.d/proftpd stop" if failed port 21 protocol ftp then restart if 5 restarts within 5 cycles then timeout check process sshd with pidfile /var/run/sshd.pid start program "/etc/init.d/ssh start" stop program "/etc/init.d/ssh stop" if failed port 22 protocol ssh then restart if 5 restarts within 5 cycles then timeout check process mysql with pidfile /var/run/mysqld/mysqld.pid group database start program = "/etc/init.d/mysql start" stop program = "/etc/init.d/mysql stop" if failed host 127.0.0.1 port 3306 then restart if 5 restarts within 5 cycles then timeout check process apache with pidfile /var/run/apache2.pid group www start program = "/etc/init.d/apache2 start" stop program = "/etc/init.d/apache2 stop" if failed host www.example.com port 80 protocol http and request "/monit/token" then restart if cpu is greater than 60% for 2 cycles then alert if cpu > 80% for 5 cycles then restart if totalmem > 500 MB for 5 cycles then restart if children > 250 then restart if loadavg(5min) greater than 10 for 8 cycles then stop if 3 restarts within 5 cycles then timeout check process postfix with pidfile /var/spool/postfix/pid/master.pid group mail start program = "/etc/init.d/postfix start" stop program = "/etc/init.d/postfix stop" if failed port 25 protocol smtp then restart if 5 restarts within 5 cycles then timeout #check process nginx with pidfile /var/run/nginx.pid # start program = "/etc/init.d/nginx start" # stop program = "/etc/init.d/nginx stop" # if failed host 127.0.0.1 port 80 then restart # #check process memcached with pidfile /var/run/memcached.pid # start program = "/etc/init.d/memcached start" # stop program = "/etc/init.d/memcached stop" # if failed host 127.0.0.1 port 11211 then restart # #check process pureftpd with pidfile /var/run/pure-ftpd/pure-ftpd.pid # start program = "/etc/init.d/pure-ftpd-mysql start" # stop program = "/etc/init.d/pure-ftpd-mysql stop" # if failed port 21 protocol ftp then restart # if 5 restarts within 5 cycles then timeout # #check process named with pidfile /var/run/named/named.pid # start program = "/etc/init.d/bind9 start" # stop program = "/etc/init.d/bind9 stop" # if failed host 127.0.0.1 port 53 type tcp protocol dns then restart # if failed host 127.0.0.1 port 53 type udp protocol dns then restart # if 5 restarts within 5 cycles then timeout # #check process ntpd with pidfile /var/run/ntpd.pid # start program = "/etc/init.d/ntp start" # stop program = "/etc/init.d/ntp stop" # if failed host 127.0.0.1 port 123 type udp then restart # if 5 restarts within 5 cycles then timeout # #check process mailman with pidfile /var/run/mailman/mailman.pid # group mail # start program = "/etc/init.d/mailman start" # stop program = "/etc/init.d/mailman stop" # #check process amavisd with pidfile /var/run/amavis/amavisd.pid # group mail # start program = "/etc/init.d/amavis start" # stop program = "/etc/init.d/amavis stop" # if failed port 10024 protocol smtp then restart # if 5 restarts within 5 cycles then timeout # #check process courier-imap with pidfile /var/run/courier/imapd.pid # group mail # start program = "/etc/init.d/courier-imap start" # stop program = "/etc/init.d/courier-imap stop" # if failed host localhost port 143 type tcp protocol imap then restart # if 5 restarts within 5 cycles then timeout # #check process courier-imap-ssl with pidfile /var/run/courier/imapd-ssl.pid # group mail # start program = "/etc/init.d/courier-imap-ssl start" # stop program = "/etc/init.d/courier-imap-ssl stop" # if failed host localhost port 993 type tcpssl sslauto protocol imap then restart # if 5 restarts within 5 cycles then timeout # #check process courier-pop3 with pidfile /var/run/courier/pop3d.pid # group mail # start program = "/etc/init.d/courier-pop start" # stop program = "/etc/init.d/courier-pop stop" # if failed host localhost port 110 type tcp protocol pop then restart # if 5 restarts within 5 cycles then timeout # #check process courier-pop3-ssl with pidfile /var/run/courier/pop3d-ssl.pid # group mail # start program = "/etc/init.d/courier-pop-ssl start" # stop program = "/etc/init.d/courier-pop-ssl stop" # if failed host localhost port 995 type tcpssl sslauto protocol pop then restart # if 5 restarts within 5 cycles then timeout # #check process dovecot with pidfile /var/run/dovecot/master.pid # group mail # start program = "/etc/init.d/dovecot start" # stop program = "/etc/init.d/dovecot stop" # if failed host localhost port 993 type tcpssl sslauto protocol imap then restart # if 5 restarts within 5 cycles then timeout |

Le fichier de configuration est assez explicite ; si vous n’êtes pas sûr d’une option, jetez un œil à la documentation de monit : http://mmonit.com/monit/documentation/monit.html

Dans la partie apache de la configuration de monit, vous trouvez ceci :

| if failed host www.example.com port 80 protocol http and request "/monit/token" then restart |

ce qui signifie que monit essaie de se connecter à www.example.com sur le port 80 et essaie d’accéder au fichier /monit/token qui est /var/www/www.example.com/web/monit/token parce que la racine de document de notre site web est /var/www/www.example.com/web. Si monit ne réussit pas, cela signifie qu’Apache ne fonctionne pas, et monit va le redémarrer. Maintenant, nous devons créer le fichier /var/www/www.example.com/web/monit/token et y écrire une chaîne aléatoire :

mkdir /var/www/www.example.com/web/monit  
echo "hello" > /var/www/www.example.com/web/monit/token

Ensuite, nous créons le certificat pem ( /var/certs/monit.pem) dont nous avons besoin pour l’interface web de monit chiffrée SSL :

mkdir /var/certs  
cd /var/certs

Nous avons besoin d’un fichier de configuration OpenSSL pour créer notre certificat. Il peut ressembler à ceci :

vi /var/certs/monit.cnf

| # create RSA certs - Server RANDFILE = ./openssl.rnd [ req ] default_bits = 2048 encrypt_key = yes distinguished_name = req_dn x509_extensions = cert_type [ req_dn ] countryName = Country Name (2 letter code) countryName_default = MO stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Monitoria localityName = Locality Name (eg, city) localityName_default = Monittown organizationName = Organization Name (eg, company) organizationName_default = Monit Inc. organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = Dept. of Monitoring Technologies commonName = Common Name (FQDN of your server) commonName_default = server.monit.mo emailAddress = Email Address emailAddress_default = [email protected] [ cert_type ] nsCertType = server |

Maintenant, nous créons le certificat comme ceci :

openssl req -new -x509 -days 365 -nodes -config ./monit.cnf -out /var/certs/monit.pem -keyout /var/certs/monit.pem

openssl gendh 512 >> /var/certs/monit.pem

openssl x509 -subject -dates -fingerprint -noout -in /var/certs/monit.pem

chmod 700 /var/certs/monit.pem

Enfin, nous pouvons démarrer monit :

/etc/init.d/monit start

Maintenant, pointez votre navigateur vers https://www.example.com:2812/ (assurez-vous que le port 2812 n’est pas bloqué par votre pare-feu), connectez-vous avec admin et test, et vous devriez voir l’interface web de monit. Cela devrait ressembler à ceci :

(Ecran Principal)

(Page d’État d’Apache)

En fonction de votre configuration dans /etc/monit/monitrc, monit redémarrera vos services s’ils échouent et enverra des emails de notification si les identifiants de processus des services changent, etc.

Amusez-vous bien !

5 Liens

• munin: http://munin-monitoring.org/
• monit: http://mmonit.com/monit/