Network Monitoring with Nagios. Matt Gracie, Information Security Administrator Canisius College, Buffalo, NY

Size: px

Start display at page:

Download "Network Monitoring with Nagios. Matt Gracie, Information Security Administrator Canisius College, Buffalo, NY"

Louise Barnett
8 years ago
Views:

1 Network Monitoring with Nagios Matt Gracie, Information Security Administrator Canisius College, Buffalo, NY

2 Canisius College is one of 28 Jesuit colleges in the nation and the premier private college in Western New York. Canisius prepares leaders intelligent, caring, faithful individuals able to pursue and promote excellence in their professions, communities and service to humanity.

Canisius prepares leaders intelligent, caring, faithful individuals

3 What is Nagios? Nagios is a host and service monitor designed to inform you of network problems before your clients, end-users or managers do. -- from

4 What Is Required? Nagios is an open source tool released under the terms of the GNU General Public License (GPL). There is no cost to use the software, unless you choose to pay for professional support. Nagios was originally written to run under Linux, but it should work under almost any Unix variant with a C compiler. Additionally, the machine should have an HTTP server and a TCP stack available.

There is no cost to use the software, unless you choose to pay for professional support.

5 How does it work? The monitoring daemon runs intermittent checks on hosts and services you specify using external "plugins" which return status information to Nagios. When problems are encountered, the daemon can send notifications out to administrative contacts in a variety of different ways ( , instant message, SMS, etc.). Current status information, historical logs, and reports can all be accessed via a web browser. --from

6 Why Did We Start Using It? Sometimes, nobody knows who is responsible for a particular computer. Generally, this turns out to be a problem.

7 Our Setup We are running Nagios 1.4 on Debian GNU/Linux. It is being used to constantly monitor 584 services across 345 different hosts, ranging from switches and routers to various types of servers. Though our installation is a little behind the current 2.X series, there are very few differences in functionality, so the content of this presentation should be applicable to an installation of a newer version as well. The initial, test implementation was running on a 1.4 Ghz Pentium 4 desktop computer. Currently, we are running it on a 2.6 Ghz Opteron blade.

servers. Though our installation is a little behind the current 2.

8 Configuration Files The majority of the configuration in Nagios is handled via text files in the /etc/nagios directory of the server. While there are many additional files and options, the truly necessary ones for a basic implementation are: hosts.cfg hostgroups.cfg contacts.cfg contactgroups.cfg services.cfg

While there are many additional files and options, the truly necessary ones

9 The Simplest Setup In this configuration, the Nagios Server will periodically ping the Web Server to make sure that it is still responding to network traffic. If it stops responding, the Nagios Server will alert the people designated as contacts for the Web Server. The Nagios Server will also use plugins, such as check_disk, to monitor its own status.

If it stops responding, the Nagios Server will alert the people designated as contacts

10 NRPE In this case, the Nagios Server will use the NRPE (Nagios Remote Plugin Execution) service running on the Web Server to run plugins on the remote machine. This allows the Nagios Server to monitor private information, such as CPU load or disk space, on the Web Server, and send alerts based on configured thresholds.

11 NSCA In this case, the Nagios Server cannot reach the Database Server because of the intervening firewall. So, instead, the Database Server uses the send_nsca utility to submit passive reports to the Nagios Server. This allows the Nagios Server to stay abreast of the Database Server's status without requiring a specific firewall hole to accommodate it.

So, instead, the Database Server uses the send_nsca utility to submit passive reports to

12 More Advanced Features

13 Scheduled Downtime It is possible, using the web interface for Nagios, to schedule downtime for hosts or individual services. This means that the checks for those hosts and services will be suspended until the scheduled downtime ends.

14 Event Handlers An event handler is an automatic script that kicks off when a monitored service enters a particular state. For example, if a machine is prone to having its Apache installation crash, a script could be written that attempts to restart the daemon and only mails the admin if this is unsuccessful.

For example, if a machine is prone to having its Apache installation crash, a

15 Notification Escalations Nagios supports Notification Escalations, a method of alerting additional or different groups of administrators when a problem goes unsolved. define serviceescalation{ host_name webserver service_description HTTP first_notification 3 last_notification 5 notification_interval 90 contact_groups ntadmins,managers } Initial Alert define serviceescalation{ host_name webserver service_description HTTP first_notification 6 last_notification 10 notification_interval 60 contact_groups ntadmins,managers,everyone } Escalated Alert

$define serviceescalation{ host_name webserver service_description HTTP first_notification 3 last_notification 5 notification_interval 90$

16 Service Dependencies In a case like this, services on the Web Server will be unreachable from the Nagios Server if there's something wrong with the Border Router. Nagios allows for Service Dependencies to be added to the configuration, so that in a situation like that, the Web Server would not be checked until the Border Router is functioning properly again.

Nagios allows for Service Dependencies to be added to the configuration, so that in a

17 Distributed Monitoring

18 Alternative Frontends Because Nagios stores all of its information in a standard MySQL database, it's very simple to draw that information out for other purposes. This is a web frontend to the Nagios database that I made for our Help Desk, so that they can see in real time if a host is down.

19 Third-Party Tools There are a lot of third-party tools available for Nagios. Fruity Nagmin Nagat nagiosgraph And many, many more...

20 Summary

21 More Information Nagios Home Page Nagios Exchange (Third-party products) Complete Guide to Nagios Network Monitoring with Nagios

Network Monitoring Systems / Nagios. 2/19/08 Michael Miller e mail: mike.mikemiller@gmail.com

Network Monitoring Systems / Nagios 2/19/08 Michael Miller e mail: mike.mikemiller@gmail.com Network Monitoring System What is a Network Monitoring System ( NMS ) What types of devices can you monitor?