CN=Monitor Installation and Configuration v2.0

Transcription

1 1 Installation and Configuration v2.0

2 2 Installation...3 Prerequisites...3 RPM Installation...3 Manual *nix Installation...4 Setup monitoring...5 Upgrade...6 Backup configuration files...6 Disable Monitoring Scripts...6 RPM Upgrade...6 Enable Monitoring Scripts...7 Uninstall...7 RPM Uninstallation...7 Manual *nix Uninstallation...8 Configuration...9 Understanding configuration levels Not inherited options General Environment Level Environment Level Server Level Configuration Examples Simple configuration to get started Simple configuration with database support for one environment Two environments All Configurable Options General Mail / Error Reporting Environment and Server, Name Options Environment and Server, Connection Options Environment and Server, Monitor and History Options Environment and Server, Graph and Chart Options Environment and Server, Query Options Environment and Server, Replication Options Environment and Server, Cache and Log Options Features Monitoring Known Problems Releases Contact Information Download Updates Donate using PayPal Contact Developer(s) Appendix Deprecated or removed configuration options... 22

3 3 Installation Prerequisites In order to use the following applications and libraries needs to be installed. Installation notes below will include how to install these prerequisites. Operating system - Linux / Unix - Mac OS X 10.6 Web Server - Apache HTTPd server 2.0 Include PHP and mod_ssl extension - PHP 5.X Include LDAP, GD and CLI modules - OpenSSL SQL Database (Optional) - PostgreSQL - MySQL Avoid Certificate validation Set the following setting in /etc/openldap/ldap.conf to avoid Common Name validation of certificates. Especially important when you have a clustered environment. # vi /etc/openldap/ldap.conf TLS_REQCERT never RPM Installation Install Dependencies # yum install openldap-clients # yum install httpd mod_ssl openssl # yum install php php-cli php-ldap php-gd Install # rpm -ivh cnmonitor noarch.rpm Installed files: /etc/cnmonitor /usr/share/cnmonitor/www /usr/share/cnmonitor/bin /usr/share/cnmonitor/sql /usr/share/cnmonitor/doc /usr/share/man/man1 Configuration Files Web Application Scripts to collect historical events SQL Files to setup database This document Manual (man) files for Don t forget to restart httpd # service httpd restart

4 4 Collect historical monitor events (optional but recommended). Supported databases are MySQL and PostgreSQL. MySQL # yum install mysql-server php-mysql # service mysqld start Install schema # mysql -u root -p < /usr/share/cnmonitor/sql/mysql.sql In this example we are using root as user for MySQL. Don t forget to restart httpd # service httpd restart PostgreSQL # yum install postgresql-server php-pqsql # service postgresql initdb # service postgresql start Install schema # psql -U postgres -f /usr/share/cnmonitor/sql/postgresql.sql In this example we are using postgres as user for PostreSQL. Don t forget to restart httpd # service httpd restart Continue to chapter Setup Monitoring. Manual *nix Installation For other Unix/Linux distributions that meet stated requirements. Install Untar and unzip tgz file in /usr/share # cd /usr/share # tar -zxvf cnmonitor tgz You should now end up with: /usr/share/cnmonitor/config /usr/share/cnmonitor/www /usr/share/cnmonitor/bin /usr/share/cnmonitor/sql /usr/share/cnmonitor/doc /usr/share/cnmonitor/conf Configuration Files Web Application Scripts to collect historical events SQL Files to setup database This document Apache Configuration files

5 5 /usr/share/cnmonitor/man1 Manual (man) file If you need the man file. Install it in: /usr/share/man/man1 Move config directory to /etc, create symbolic link and set file permissions: # mv /usr/share/cnmonitor/config /etc/cnmonitor # ln -s /etc/cnmonitor /usr/share/cnmonitor/config # chown -R root:apache /etc/cnmonitor # chmod -R 650 /etc/cnmonitor # chmod -R +x /usr/share/cnmonitor/bin Copy apache configurations file to your conf.d directory for apache or manually add the configuration in httpd.conf. # cp /usr/share/cnmonitor/conf/httpd/cnmonitor.conf /etc/httpd/conf.d/ Don t forget to restart httpd # service httpd restart Collection of historical events Consult your vendor documentation how to setup your database connection and further configuration. Database configuration files are available in the cnmonitor/sql directory. This documentation is available in the cnmonitor/doc directory. Continue to chapter Setup Monitoring. Setup monitoring You can set the configuration option nocollect with value 1 to exclude environments and servers to be included. Setup collect monitoring information (run it around every minutes): # crontab e */30 * * * * cd /usr/share/cnmonitor/bin;php collectdb.php Setup collect server messages and retrieve alerts (run it around every 10 minutes): # crontab -e */10 * * * * cd /usr/share/cnmonitor/bin;php collectservermessage.php Setup create collection summary (should be run once a day): # crontab -e 0 4 * * * cd /usr/share/cnmonitor/bin;php collectsummary.php In some distributions its preferred to use /etc/cron.daily/<custom shell script>

6 6 Setup sending status mail every week: # crontab -e 0 4 * * 0 cd /usr/share/cnmonitor/bin;php collectmailreport.php In some distributions its preferred to use /etc/cron.weekly/<custom shell script> Note that you need to configure to use this functionality. You also need to configure and start sendmail before this functionality can be used. See configuration chapter for more info. I highly recommend running the commands from the command line to verify the functionality before scheduling the jobs. Consult your crontab documentation and set preferred monitoring interval. In the example above we are collecting every five minutes. Upgrade You should back up your configuration files before upgrading. It s also recommended to upgrade from the previous released version (1.3). Important Information Configurations file now available in XML format. Make sure that you run the steps below and backup your old configuration files before running the RPM upgrade! Backup configuration files Upgrading form version 1.x to 2.0 will replace all configuration files. Backup the /etc/cnmonitor directory before upgrading! # cp -rd /etc/cnmonitor /tmp/cnmonitorconfig Disable Monitoring Scripts Disable all configured monitoring scripts during this upgrade: # crontab -e Add comment # character: # */30 * * * * cd /usr/share/cnmonitor/bin;php collectdb.php # */10 * * * * cd /usr/share/cnmonitor/bin;php collectservermessage.php # 0 4 * * 0 cd /usr/share/cnmonitor/bin;php collectsummary.php RPM Upgrade # rpm -Uvh cnmonitor noarch.rpm Your old configuration file is now saved as config.php.rpmsave. Convert old configuration file to XML format Run the following script to convert your configuration or update your new configuration template (config.xml) file manually.

7 7 # cd /usr/share/cnmonitor/bin # php convertconfig.php You should end up with the following output on successful conversion: Configuration converted to XML format New Configuration file:../config/config.xml Old Configuration file:../config/config.php.rpmsave Configuration template:../config/config.xml.template Please verify and test your configuration! Consult installation documentation for more information Now edit config.xml and verify your environment. The config.php should only contain a reference to use XML. Optionally verify the file permissions for your configuration files: # chown -R root:apache /etc/cnmonitor # chmod R 650 /etc/cnmonitor Remove old configuration files When you have verified that the new configuration file is working: # rm /etc/cnmonitor/config.php.rpmsave # rm -rf /tmp/cnmonitorconfig Database Update If upgrading from a version older then version (1.3), download previous released installation notes and read the upgrade sections, as there might exist database updates. Enable Monitoring Scripts Enable all configured monitoring scripts: # crontab -e Remove added comment # character: */30 * * * * cd /usr/share/cnmonitor/bin;php collectdb.php */10 * * * * cd /usr/share/cnmonitor/bin;php collectservermessage.php 0 4 * * 0 cd /usr/share/cnmonitor/bin;php collectsummary.php Upgrade should now be completed! Uninstall RPM Uninstallation Uninstall RPM Package: # rpm -e cnmonitor Remove configuration files located at: /etc/cnmonitor.

8 8 Manual *nix Uninstallation # cd /usr/share # rm -rf cnmonitor # cd /etc # rm -rf cnmonitor

9 9 Configuration Configuration file located at /etc/cnmonitor/config.xml. Configuration files for special pages can also be found in the config directory. Understanding configuration levels There are four levels where you can set configurable options 1. Not inherited options Configurable options that can t be inherited for environment and server configurations <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> <language>en</language> <database> <username>root</username> <password></password> <host>localhost</host> <database>cnmonitor</database> <type>mysql</type> </database> </general> </cnmonitor> Language Default language to use for. <language> en en sv Database Optional but recommended database configuration for to collect historical events. The following options should be enclosed within a <database> section. <username> (username to be used to access your SQL database) <password> (password to be used to access your SQL database) <host> (datbase hostname) <database> Database name. Use cnmonitor as default value. <type> Database type. Use mysql for MySQL <port> 3306 (MySQL) 5432 (PostgreSQL) or pqsql for PostgreSQL Optional. The database port.

10 10 Other databases may be supported if you have PHP dbx support: 2. General Environment Level All configurable options will be applied on all servers within all environments. <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> <environment> <wwwaddress> </environment> </general> </cnmonitor> Everything you add to this section will be inherited for your environments and servers. I.e. setting <dn> and <password> within the general environment section will be used for all servers within all environments (if you don t configure these options on environment or server level). There are still some options that are recommended to configure on this level. Web Address Optional WWW address to reach your deployment. Used for links in weekly mail reports. <wwwaddress> (URL to your web address) Mail From Optional mail from address when sending mails from <mailfrom> (Mail from address when/if sending mail) Mail To Optional mail to addresses when sending mails from <mailto> (Comma separated list of mail addresses to send mail to) 3. Environment Level Environment sections. You can configure as many environment sections as you need on this level. Name is required for each environment.

11 11 All configurable options will be applied on all s within the environment. <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> </general> <environment> <name>openldap</name> <loadbalancer>ldap.itd.umich.edu</loadbalancer> <description>using Cluster ldap.itd.umich.edu</description> <url> <name>donniebrasco.dir.itd.umich.edu</name> <description>description server 1</description> <name>heat.dir.itd.umich.edu</name> <description>description server 2</description> </environment> </cnmonitor> Environment Name Required option on this level. Your environment must have a name. <name> (Name of environment) 4. Server Level Configuration options for each server. Name is required for each server. <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> </general> <environment> <name>openldap</name> <loadbalancer>ldap.itd.umich.edu</loadbalancer> <description>using Cluster ldap.itd.umich.edu</description> <url> <name>donniebrasco.dir.itd.umich.edu</name> <description>description server 1</description> <name>heat.dir.itd.umich.edu</name> <description>description server 2</description> </environment> </cnmonitor> Servername Server name (hostname) for each.

12 12 This is the only required option needed to configure servers. Additional options such as <dn>, <password> and <scheme> are recommended to secure your connection and to be able to read monitor suffixes. <name> (Name of server) Configuration Examples Simple configuration to get started Example with one environment and two servers configured. Environment name is: OpenLDAP Cluster Address is: ldap.itd.umich.edu Two servers with anonymous read access has been configured: donniebrasco.dir.itd.umich.edu heat.dir.itd.umich.edu <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> <language>en</language> <environment> </environment> </general> <environment> <name>openldap</name> <loadbalancer>ldap.itd.umich.edu</loadbalancer> <name>donniebrasco.dir.itd.umich.edu</name> <name>heat.dir.itd.umich.edu</name> </environment> </cnmonitor> Simple configuration with database support for one environment This example configures a PostgreSQL database, configures mail reporting and creates one environment with two servers. By using a similar configuration you will use as much as possible of. <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> <language>en</language> <database> <username>postgres</username> <password>secret</password> <host>localhost</host> <database>cnmonitor</database> <type>pqsql</type> </database> <environment> <wwwaddress> <mailfrom>serveradmin@localhost.com</mailfrom> <mailto>my .mydomain.com</mailto> </environment> </general> <environment>

13 13 <name>openldap</name> <loadbalancer>ldap.itd.umich.edu</loadbalancer> <name>donniebrasco.dir.itd.umich.edu</name> <name>heat.dir.itd.umich.edu</name> </environment> </cnmonitor> Two environments In the next example we are authenticating using a monitoring user over LDAPS. The configuration options have been added to the environment section as the username and password is equal on both servers. <?xml version="1.0" encoding="utf-8"?> <cnmonitor> <general> <language>en</language> <database> <username>postgres</username> <password>secret</password> <host>localhost</host> <database>cnmonitor</database> <type>pqsql</type> </database> <environment> <wwwaddress> <mailfrom>serveradmin@localhost.com</mailfrom> <mailto>my .mydomain.com</mailto> </environment> </general> <environment> <name>ldap.itd.umich.edu</name> <name>donniebrasco.dir.itd.umich.edu</name> <name>heat.dir.itd.umich.edu</name> </environment> <environment> <name>test Servers</name> <dn>uid=monitor.cnmonitor,ou=people,dc=localdomain</dn> <password>secret</password> <scheme>ldaps</scheme> <name> </name> <name> </name> </environment> </cnmonitor> All Configurable Options General Configuration options for <general> section.

14 14 Language Default language to use for. <language> en en sv More language files are appreciated. Files are located in the www/language directory. Stylesheet Default style to use for. <stylesheet>./style/default.css (If you want to use a different stylesheet) Encryption If you want to encrypt passwords for configuration file. Requires PHP version 5.3. You can check if encryption is available in your environment by running the encrypt password file available in the bin directory: $ php encryptpassword.php <encryption> AES CBC (Running the script bin/encryptpassword.php will display all possible values for your server) Database Optional but recommended database configuration for to collect historical events. The following options should be enclosed within a <database> section. <username> (username to be used to access your SQL database) <password> (password to be used to access your SQL database) <host> (datbase hostname) <database> Database name. Use cnmonitor as default value. <type> Database driver. Use mysql for MySQL <port> 3306 (MySQL) 5432 (PostgreSQL) or pqsql for PostgreSQL Optional. The database port. Mail / Error Reporting Configuration options for <general> / <environment> section.

15 15 Web Address Optional WWW address to reach your deployment. Used for links in weekly mail reports. <wwwaddress> (URL to your web address) Mail From Optional mail from address when sending mails from <mailfrom> (Mail from address when/if sending mail) Mail To Optional mail to addresses when sending mails from <mailto> (Comma separated list of mail addresses to send mail to) Run Script Run script option will trigger a script with the following values: /path/to/script.sh error_key servername optional message This option can be set on all levels (i.e. set on server level if you want to trigger a different script for a specific server). This option does not require mail functionality to be enabled. <runscript> /path/to/script.sh Environment and Server, Name Options Configuration options for <environment> and sections. Environment or Server name Environment or server name. Environment names should not be the same name as a server name <name> (Environment or servername) Server Alias Server alias. Will never be used for contacting your LDAP host. Instead it is used for host matching if server returns another hostname i.e. DNS CNAME instead of A- Record. <alias> (alternative hostname) Description Short description of your server. Should not include special characters such as $,, <, >.

16 16 <description> (description) URL URL for more information about the environment or server. Should not include special characters such as $,, <, >. <url> ( Load Balancer Set cluster address as value. By default the environment name is used as cluster name. <loadbalancer> (clusteraddress.mydomain.com) Environment and Server, Connection Options Authentication Distinguished Name Default authentication user Distinguished Name. <dn> (I.e. uid=monitoring.user,ou=people, dc=mydomain,dc=com) Password Default authentication user Password <password> (password for <dn>) Encrypted Password Encrypted authentication user password using the script encryptpassword.php. Encrypting passwords for requires PHP version 5.3 <encpassword> (encrypted password for <dn>) Port Set this value if your server isn t running standard LDAP port 389 <port> 389 Secure / Secondary Port Set this value if your server isn t running standard LDAPS port 636 <port> 636 TLS Set this value to on if you add dn and password and want to run your connection secure over standard LDAP port using TLS <tls> off LDAP Scheme

17 17 Set this value to ldaps if you add dn and password and want to run your connection over LDAPS <scheme> ldap ldap ldaps DN By Filter Get DN by filter for authentication. Use this property if you want to authenticate against your LDAP server by entering an ID instead of complete distinguished name. Example authenticating using employeenumber: (employeenumber=?) Default if not entering DN is finding DN by uid or cn. <dnbyfilter> ( (uid=?)(cn=?)) Environment and Server, Monitor and History Options Disable collect of monitoring history Disable collecting monitoring information about servers. Set value 1. This will also cause not to load and verify LDAP database connectivity on index page. <nocollect> Environment and Server, Graph and Chart Options Default Line Graph Style Default value if you want to use Adobe flash based graph or dynamic picture graph. monitorstyle image flash image Line Graph Height and Width Setting these values changes the default size of monitoring graphs. linegraphwidth 1000 linegraphheight 300 Combine Server Result Set If you by default want to combine server result set to one single line graph. monitorcombine Number of Servers in a row displayed on first page Only to be changed if you have a big monitor or high screen resolution. view_environments_limit

18 18 Environment and Server, Query Options Query Default base suffix Set this value if you prefer to set a default base suffix. <querysuffix> Query Return Attributes Set this value if you prefer to have a default query return attribute list <queryreturn> Query Filter Set this value if you prefer to have a default query filter <queryfilter> Environment and Server, Replication Options Replication Ignore Consumer Lookup (CSN) Improves performance but skips consumer replication status. Replication page works even if replicas are unresponsive. Set value 1 on suppliers/masters to enable this option. <replication_ignoreconsumer> 0 1 Environment and Server, Cache and Log Options Disable connection cache Enable connection cache. Adding this option will make faster but won t ensure that your LDAP servers become unavailable. <cache_connection> Log LDAP Enable logging of LDAP calls. Recommended only for debugging your LDAP connections and. Set log file path as value i.e. /tmp/cnmonitor/ldaplog.log <logldap> ( Logfile location ) Log

19 19 Logs selected parts of. Should by default be turned off but if you experience any problems we might ask you to enable it for debugging purposes. Log file available for each session: /tmp/cnmonitor/<your session id>_log.tmp <loglevel> 0 0 = No Logs activated 1-9 = Log enabled in debug mode Features See document Guide for a complete list of features. Monitoring Overview of what can monitor depending on Directory Server. Information RedHat/389 Open DAP Sun Novell IBM Connection Peak x x Threads x (current) x (max) x x Current x x x x Connections Total Connections x x x x Entries Sent x x x x Bytes Sent x x x x Start Time x X x x Current Time x x x x Anonymous Binds x (Included in Simple Binds) x (Included in UnAuthenticated Binds) (Actual all completed binds) UnAuthenticated x (Included in x x Binds Simple Binds) Simple Binds x x x x Strong Binds x (Included in x x Simple Binds) Bind Security x x x Errors Whole Search tree op. x x x x (Included as Search Op.) Search op. x x x x x Compare op. x x x x X Add op. x x x x X Modify op. x x x x X ModifyRDN op. x x x x X Remove op. x x x x X In op. x x x x x Errors x x x (As slapderrorlog messages) Security Errors x x x Known Problems If you notice any problems please send a mail to monitorldap@gmail.com if you have any questions or want to report a bug.

20 20 Releases 2.0 New Major Release XML based configuration file, added IBM Tivoli Monitoring, Open LDAP replication monitoring, flash graph support and layout changes. 1.3 New Functionality Release This release contains mobile support, improved replication verification, attribute protection for query, layout changes and code refactoring. 1.2 New Functionality Release This release contains improved replication view, the possibility to compare entries between servers, server alias support, unauthenticated binds support, live view for pie charts... and some bugfixes Bugfix Release Bugfixes for 1.1. Improved authentication dialog, smaller GUI changes and support for IE New Functionality Release This release contains a new environmental view, a new historical summary, a new authentication dialog, new dynamic query configuration, temporarily adding servers, and supported schema attribute querying Bugfix and FHS file layout This release contains minor bugfixes and improved documentation. The RPM- based installation is now following FHS (the Filesystem Hierarchy Standard). Read the PDF file before upgrading. 1.0 Initial Release This release has the ability to view environment and server availability, perform live monitoring, collect and view performance load and trends, verify replication status, cache sizes, schema, and load balancing, and retrieve a weekly mail report. It has an advanced query editor and advanced LDAP querying. Contact Information Download Updates Updates are available at project page: Donate using PayPal If you appreciate. Feel free to donate any amount to support future development of this software and show your appreciation.

21 21 Contact Developer(s) You can contact the developer of this software by sending an to: Andreas Andersson Or stay in touch using the forum on the project site:

22 22 Appendix Deprecated or removed configuration options replication:<suffix DN> no 24 Set acceptable replication time in hours. A warning will be displayed if replication hasn t been done after configured value. Removed. Instead this option can be set as: ACCEPTABLE_DELAY option in the configuration file for replication: config/replication.php