Check_MK virt1 - User Manual. Valid since version 1.2.3

Check_MK virt1 - User Manual Valid since version 1.2.3

Contents 1 Quick start guide 1 2 Setting up with VirtualBox 2 3 Setting up with VMware ESX 6 4 Basic configuration 12 4.1 Network and access configuration via console............................ 14 4.1.1 Network configuration....................................... 14 4.1.2 Access to the web interface.................................... 14 4.1.3 Protecting access to the console................................. 15 4.2 Basic settings on the web interface................................... 16 5 Administrating monitoring instances 19 6 Administrating Check_MK versions 21 7 Firmware installation 22 8 Device settings 23 8.1 Changing the language.......................................... 23 8.2 Changing the network configuration.................................. 23 8.3 Configuring host and domain names.................................. 23 8.4 Configuring name resolution....................................... 23 8.5 Configuring time synchronisation.................................... 24 8.6 Forwarding syslog entries......................................... 24 8.7 Changing the default web page..................................... 24 8.8 Configuring outgoing emails....................................... 24 8.9 Changing access to Check_MK agents................................. 25 9 Remote access via SSH 26 9.1 Activating instance login via SSH.................................... 26 9.2 Activating console via SSH........................................ 26 9.3 Activating root access via SSH...................................... 27

CONTENTS CONTENTS 10 Protecting web access via SSL 30 10.1Installing a certificate........................................... 30 10.1.1Creating a new certificate and having it signed........................ 30 10.1.2Creating a new certificate and signing it yourself...................... 31 10.1.3Uploading existing certificate................................... 32 10.2Configuring access types......................................... 32 10.3Displaying current configuration/certificates............................. 33 11 Device control 34 11.1Restarting / Shutting down........................................ 34 11.2Restoring factory configuration..................................... 35 12 Failover cluster 36 12.1Prerequisites................................................. 36 12.2Migration of existing installations.................................... 37 12.3Configuration of the cluster........................................ 37 12.3.1Network configuration....................................... 37 12.3.2Host names.............................................. 41 12.3.3Connecting the cluster....................................... 41 12.4The state of the cluster.......................................... 43 12.5Special cases in the cluster........................................ 44 12.5.1Access to resources......................................... 44 12.5.2Device settings........................................... 45 12.5.3IP addresses or host names of the nodes............................ 45 12.5.4Administrating Check_MK versions and monitoring instances............... 45 12.6Administrative tasks............................................ 45 12.6.1Firmware updates in the cluster................................. 45 12.6.2Disbanding clusters......................................... 47 12.6.3Exchanging a device........................................ 47 12.7Diagnostics and troubleshooting..................................... 47 12.7.1Logging................................................ 47 13 SMS notifications 49 13.1Starting up the modem.......................................... 49 13.2Diagnostics.................................................. 50 14 Diagnostics 51 14.1Logs...................................................... 51

CONTENTS CONTENTS 15 Service & support 53 15.1Manual.................................................... 53 15.2Internet.................................................... 53 15.3Firmware................................................... 53 15.4Hardware support............................................. 53 15.5Software support.............................................. 53 16 Appendices 54.1 CE declaration of conformity....................................... 54.2 Licences................................................... 54.3 VMware Tools................................................ 55.4 VirtualBox Guest Additions........................................ 55.5 Legal notice................................................. 55 Index 56

Check_MK virt1 - User Manual 1 / 56 1. Quick start guide Download the required Check_MK virt1 archive from our website 1. Import the archive (file extension.ova) into your hypervisor. Launch the imported virtual machine and open the local console. During the launching procedure, a dialogue box asking you to initialise the data medium will appear on the screen. Confirm this box. After a few minutes the launching procedure will resume. On completion of the launching procedure, the console status screen will be displayed. So that the appliance can be used for monitoring, there are some settings that need to be made. Press the key <F1> and, using the configuration dialogue box, configure the following settings as a minimum: Network configuration Access to the web interface Once you have configured these settings, you can access the web interface from a computer connected to the network by entering the URL http://<ipaddress>/ into the web browser. Log into the web interface using the password you just configured. In order to make things such as name resolution and sending emails possible, you must make further settings in the web interface. You can read more about this in the chapter on basic configuration on the web interface. You do not need this to get started however. Select the item instance administration on the menu now shown and click on Create new instance on the following page. Now create a new monitoring instance using the current dialogue box. This instance will start automatically. You can now call up the URL http://<ipaddress>/<instanz-id>/ in your browser. Log in using the access data you selected when creating the instance. 1 https:///check_mk_appliance_download.php?html=yes

Check_MK virt1 - User Manual 2 / 56 2. Setting up with VirtualBox The software VirtualBox is a widely used virtualisation solution for desktop PCs. It is well-suited for tests and experiments. This chapter describes how to import the virtual appliance Check_MK virt1 with the current version 4.3.6 of VirtualBox. This guide assumes that you have already installed and launched VirtualBox on your computer. First, download Check_MK virt1 from our website 1 onto your computer. Check_MK virt1 will be offered for download as an OVA file (Open Virtual Appliance). You can open this file directly in your VirtualBox. To do this, first select the File menu on the VirtualBox interface and then the menu item Import appliance. The dialogue box for importing appliances will then open. Now click on the folder symbol. 1 http:///check_mk_appliance_download.php?html=yes

Check_MK virt1 - User Manual 3 / 56 Select the downloaded OVA file of the Check_MK appliance from your hard drive and confirm the dialogue box by clicking on Open. Back in the previous dialogue box, confirm your selection again by clicking on Next >.

Check_MK virt1 - User Manual 4 / 56 The dialogue box that follows will display detailed information on the appliance. In this box you can view and also change the default settings, e.g. amount of memory or number of CPUs. The appliance is preconfigured with a memory of 4096 MB and 2 CPU cores. If you wish to change these values, click on the current value and change it. It is recommended to place the tick by Reinitialize the MAC address of all network cards so that there are no conflicts when Check_MK virt1 appliances are used more than once.

Check_MK virt1 - User Manual 5 / 56 Once all settings have been made, start the importing process by clicking on Import. A dialogue box will open showing the progress of importing. Once importing is complete, you will find a new item Check_MK virt1 in the left-hand list of the main VirtualBox window. Select this item and press Start in the action bar at the top in order to launch Check_MK virt1. Once you have done this, a window showing the Check_MK virt1 screen output will open. You have now completed the VirtualBox specific steps and can continue with the Chapter 4 of your appliance.

Check_MK virt1 - User Manual 6 / 56 3. Setting up with VMware ESX The software VMware ESX or ESXi is a virtualisation solution that is widely used in professional environments. This chapter describes how to import the virtual appliance Check_MK virt1 onto a VMware ESXi server version 5.0. This guide assumes that you have already installed and launched VMware ESXi on a server in your network and have also installed and launched the VMware vsphere Client on your computer. First, download Check_MK virt1 from our website 1 onto your computer. Check_MK virt1 will be offered for download as an OVA file (Open Virtual Appliance). You can import this file onto your ESXi server using the VMware vsphere Client. To do this, first select the File menu on the the vsphere Client interface and then the menu item Deploy OVF template. The dialogue box for importing appliances will then open. Now click on the button Browse and select the OVA file you downloaded onto your hard drive before. 1 http:///check_mk_appliance_download.php?html=yes

Check_MK virt1 - User Manual 7 / 56 Confirm your selection by clicking on Next >. You will now be displayed a dialogue box with details on the selected appliance. In this case, Check_MK virt1 will be imported in version 1.0.1.

Check_MK virt1 - User Manual 8 / 56 Continue by clicking on Next >. In the following dialogue box you can change the default name of the appliance. The appliance will appear with this name on your vsphere interface after importing.

Check_MK virt1 - User Manual 9 / 56 Once you have entered the name you want, confirm by clicking on Next >. Finally, you will be displayed a confirmation dialogue box showing all the details that were just entered. You can put a tick below the text box if you wish to launch Check_MK virt1 directly after importing. If all details are correct, confirm the import with Finish.

Check_MK virt1 - User Manual 10 / 56 The deployment of Check_MK virt1 will now take place. Depending on the network connection between your computer and the ESX server, this may take a few minutes. Once importing is complete, you can select Check_MK virt1 on the vsphere interface and go to the console, where a dialogue box asking which language you would like to use will appear during the launching process.

Check_MK virt1 - User Manual 11 / 56 Note Check_MK virt1 is supplied with a virtual network interface of the type Intel PRO/1000 MT Server (82545EM), as this is compatible with the most common virtualisation solutions. On an ESX server it is recommended, for the sake of improving performance, to change the network interface card type to VMXNET 3. You have now completed the VMware ESX specific steps and can continue with the Chapter 4 of your appliance.

Check_MK virt1 - User Manual 12 / 56 4. Basic configuration When starting up for the first time, a message will appear asking you what language to choose. This language will be saved for the entire device. You will then be displayed a message asking you to initialise the data medium. Confirm this dialogue box and wait for device startup to be resumed and for the status screen to then be displayed.

Check_MK virt1 - User Manual 13 / 56 Once the device has been started up, you will see the status screen on the local console. This screen will show you general status information and the most important configuration options of your device.

Check_MK virt1 - User Manual 14 / 56 4.1 Network and access configuration via console From the status screen, you can get to the configuration menu by pressing the key <F1>. For starting up the device, you now need to set the network configuration and specify the device password. 4.1.1 Network configuration Use this dialogue box to set up the network configuration of the device. The IP-address, netmask and the optional default gateway will be queried. In most cases, the device will need to also access network devices outside of its own network segment. The default gateway must also be configured for this purpose. Once these values have been entered, the configuration will be activated, meaning the device will be immediately reachable via the network and at the entered IP address. One way of testing this is to send a ping from another device in the network. 4.1.2 Access to the web interface A large part of the device s configuration is carried out via the web interface. Access to this web interface is protected by a password, the device password, which you need to specify first. The factory settings do not include a device password, meaning you cannot yet access the web interface. Press the key <F1> on the status screen and select device password in order to set the password. Then select the option web interface from the configuration menu to activate the web interface.

Check_MK virt1 - User Manual 15 / 56 Once you have completed these steps you will see the configured IP address in the box device information and web interface: on in the access box on the status screen of the console, as shown in the screenshot above. If you have already correctly connected the device with your network, you will now see that the network connection is active (Network: ACTIVE in the Status box). 4.1.3 Protecting access to the console After the basic configuration, access to the local console is not protected. This means that anyone who has direct access to the console (e.g. through access to the server room, or in the case of Check_MK virt1, through access to the management interface of the virtualisation solution), is able to change the basic configuration of the device. In order to protect such access, you have the option to activate a login that must be used in conjunction with the device password before settings can be made or the current status viewed. If you have already activated the web interface, you will have already set a device password and do not need to assign a new one. If you have not done so, open the configuration menu on the console by pressing the key <F1> and select device password to set the password. Then select console login from the configuration menu in order to activate this option.

Check_MK virt1 - User Manual 16 / 56 Once you have completed these steps, you will see console login: on in the access box on the status screen of the console, as shown in the screenshot above. 4.2 Basic settings on the web interface Having enabled access to the web interface through the configuration you performed previously, you can now open the web interface over a web browser on a computer that is connected with the device via the network. For this purpose, enter the URL http://<ipaddress>/ for the device (in this case http:/ /10.1.2.9/) into the address bar of the browser. You will now see the login screen of the web interface.

Check_MK virt1 - User Manual 17 / 56 After you have logged in with the password previously specified for the web interface, the main menu will open. From here, you can get to all features of the web interface. On this menu, select the item device settings. In this dialogue box you can see and change the most important device settings.

Check_MK virt1 - User Manual 18 / 56 By clicking on the titles of the settings, you will be taken to the dialogue box for adjusting the respective setting. If you have DNS servers available in your environment, you should now configure one or more of these first so that the resolution of host names can be used. If you have one or more NTP servers for time synchronisation available in your environment, enter these as IP addresses or hostnames under the item NTP server. If emails are to be sent from your device, such as notifications in the event of problems being detected, you must configure the option Outgoing emails. To do this, enter the SMTP relay server responsible for this device and any access data required. All emails generated on the device will be sent to this server. Under this setting, you can also configure all emails generated by the operating system of the device (e.g. in the case of critical errors) to be sent to a particular email address. The basic configuration of the device is now complete and you can continue setting up the first monitoring instance.

Check_MK virt1 - User Manual 19 / 56 5. Administrating monitoring instances Open the main menu of the web interface and click on the menu item instance administration. In this dialogue box, you have access to all monitoring instances of this device. You can configure, update and delete monitoring instances as well as create new ones. The first time you open the dialogue box it will be empty. To create your first monitoring instance, click on the button Create instance. In the dialogue box that then appears, you can specify the initial configuration of the monitoring instance. Start by entering an instance ID, which serves to identify the monitoring instance. The instance ID may only contain letters, numbers, - and _, must start with a letter or _ and may be a maximum of 16 characters in length. Now select the Check_MK version with which to create the monitoring instance. You can leave all other settings as they are for the time being. You can change these settings later on using the instance editing dialogue. As soon as you confirm the dialogue box with Create instance, the new monitoring instance will be created. This may take a few seconds. Once the instance has been created or started, you will be taken to the list of all monitoring instances.

Check_MK virt1 - User Manual 20 / 56 In this list, you will see the instance just created with the ID sysmon. You can also see the status of the instance, where active means the instance has been fully started. You can start or stop the instance with the button to the right of the status. On the left you will see different icons, with which you can a) edit the settings of the instance, b) update the instance and c) delete the instance. After the instance has been created and started, you can either click on the instance ID or enter the URL for the monitoring instance http://<ipaddress>/<instanz-id>/ (in this case http://10.1.2.9/ sysmon/) into the address bar of your browser. You will now see the login screen of the monitoring instance, where you can log in using the access data you entered when creating the instance. Once you have logged in you can set up Check_MK in the usual manner. The snap-in Check_MK Appliance is available in all monitoring instances and for all administrators. You will find it in the sidebar. This snap-in will take you from your monitoring instances directly to the web interface of the device.

Check_MK virt1 - User Manual 21 / 56 6. Administrating Check_MK versions It is possible to install several Check_MK versions on the device at the same time. This allows several instances to be run in different versions and individual instances to be changed to newer or older versions independently of one another. Meaning you can install a new version for example, and try it out in a test instance initially in order to then update your productive instance if testing is successful. To administrate the Check_MK versions, select the item Check_MK versions in the main menu of the web interface. The dialogue box that then appears will list all Check_MK versions installed. If a version is not being used by any instance and is not the last installed version, you have the option to delete it from the appliance. Using this dialogue box, you can also upload new Check_MK versions onto the device in order to use them in new instances or to update existing instances. To do this, download the desired Check_MK version from our website 1 onto your computer (search for Check_MK appliance in the Distribution column). Then select the file from your hard drive using the file selection dialogue and confirm your selection by clicking on Upload & install. The Check_MK version will now be uploaded onto the device. Depending on the network connection between your computer and the ESX server, this may take a few minutes. Once uploading is complete, you will see the new version in the table of installed versions. 1 http:///nagios_support_download.php?html=yes

Check_MK virt1 - User Manual 22 / 56 7. Firmware installation You can update the software of your device to a newer version or downgrade to an earlier version. Both are carried out via the so-called firmware update in the web interface. First, download the desired firmware package from our website 1 onto your computer. Then open the web interface of the device and select the item Firmware update in the main menu. In the box that appears, select the firmware package you downloaded before from the hard drive. Confirm the dialogue box by clicking on Upload & install. The package will now be loaded onto your device. Depending on the network connection, this may take a few minutes. Once the package has been recognised as valid firmware, you will be shown a dialogue box asking you to confirm the firmware update. Depending on the version differences between the current version and the one to be installed, various messages will appear telling you what to do with your data during the update. Change in the first digit: You must back up the data of your device manually and restore it after the update. An update cannot be performed without data migration. Update to higher number for the second digit: The update can be carried out without data migration. You are advised to back up your data beforehand anyway. Downgrade to lower number for the second digit: You must back up the data of your device manually and restore it after the update. An update cannot be performed without data migration. Change in the third digit: The update can be carried out without data migration. You are advised to back up your data beforehand anyway. When you confirm this dialogue box, the device will be restarted immediately. When the device is restarting, the firmware last uploaded will be installed. This will cause restarting to take much longer than usual. It will normally take less than 10 minutes however. A further restart will be carried out after the installation has taken place. This will complete the firmware update. 1 http:///check_mk_appliance_download.php?html=yes

Check_MK virt1 - User Manual 23 / 56 8. Device settings In this dialogue box you can change the default configuration of the device. All settings will become effective immediately after saving. 8.1 Changing the language During the basic configuration, you specified the language of your device. You can change this at any time, either via the console configuration or via the device settings in the web interface. 8.2 Changing the network configuration During the basic configuration, you specified the network configuration of your device. You can change this at any time, either via the console configuration or via the device settings in the web interface. If you made an error when specifying the network configuration, the device may no longer be accessible via the network. In this case you can only correct the settings on the console. 8.3 Configuring host and domain names Host and domain names serve to identify a computer in the network. When sending emails for example, these names are used to form the sender address. In addition, the configured host name is added as a source host to all log entries that are sent to a syslog server. This makes it easier to assign the entries. 8.4 Configuring name resolution In most environments, DNS servers are used to translate IP addresses into host names and vice versa. Host names or FQDNs (Fully Qualified Domain Names) are frequently used for monitoring instead of IP addresses. In order to use the name resolution on your device, you must configure the IP addresses of at least one DNS server in your environment. It is recommended to enter at least two DNS servers. Only when you have configured this option can you use host and domain names (in the configuration of NTP or mail servers for example).

Check_MK virt1 - User Manual 24 / 56 8.5 Configuring time synchronisation The system time of the device is used for many purposes, such as for recording measurement data or writing log files. A stable system time is therefore very important. This is best ensured by using a time synchronisation service (NTP). To activate the synchronisation, enter the host address of at least one time server under NTP server. 8.6 Forwarding syslog entries Log messages are generated on the device by the operating system and some permanently running processes. They are initially written into a local log via syslog. You can also send these entries to a central or higher-level syslog server where they can be evaluated, filtered or archived. Select the item Syslog to configure the forwarding. In the dialogue box that appears next, you can configure which protocol you wish to use for forwarding. Syslog via UDP is more widely used, but not as reliable as via TCP. So if your syslog server supports both protocols, it is recommended to use TCP. You also need to configure the host address of the syslog server that is to receive the log messages. 8.7 Changing the default web page If you access the host address of the device directly via the web browser without entering a path, you will be taken to the web interface of the device in the default setting. However, it is also possible for you to be forwarded directly to a monitoring instance of your choice. You can configure this using the setting HTTP access without URL. Via this setting, select the monitoring instance to open instead of the web interface. 8.8 Configuring outgoing emails So that you can send emails from the device (in the case of events during monitoring for example), the forwarding of emails to one of your mail servers must be configured. In order for the sending of emails to work, you must have at least configured the host address of your mail server as an SMTP relay server. This server will receive the emails from your device and forward them. However, configuring the SMTP relay server is only sufficient as long as your mail server accepts emails via anonymous SMTP. If your mail server requires authentication, then you need to activate the appropriate login method under the item Authentication and indicate the access data of an account that can log onto the mail server. If you do not even receive any emails after the configuration, it is worth taking a look at the system log of the device. All attempts to send emails are logged here. The device itself can send system emails if there are critical problems (e.g. a job cannot be executed or a hardware problem has been detected). In order to receive these emails, you must configure an email address to which these emails are to be sent.

Check_MK virt1 - User Manual 25 / 56 8.9 Changing access to Check_MK agents A Check_MK agent is installed on the device and can only be queried by the device itself in the basic setting. You can use it to create an instance on the device and directly add the device to the monitoring. It is also possible to make the Check_MK agent accessible from another device, meaning the device can also be monitored by another Check_MK system (e.g. in a distributed environment of a central server). For this purpose, you can configure a list of IP addresses that are allowed to contact the Check_MK agent.

Check_MK virt1 - User Manual 26 / 56 9. Remote access via SSH You can activate different types of access via the remote maintenance protocol SSH. As a general rule, a) access to the console and b) direct login to the instances are supported. Access to the root system user is possible but not recommended or supported since it is very easy to damage the configuration or the software through doing so. 9.1 Activating instance login via SSH You can activate access to the command line of the individual monitoring instances, enabling you to view and control the entire environment of the instance. This access is controlled via the instance administration. In the settings dialogue of each individual instance, you can activate and deactivate access as well as set a password to protect access. 9.2 Activating console via SSH It is possible to activate access to the console of the device via the network, enabling you to view and adjust the basic configuration of the device even without direct access to the device. You can enable access via the configuration dialogue of the console. To do this, select the menu item Activate console via SSH.

Check_MK virt1 - User Manual 27 / 56 When you activate this option, you will be asked to enter a password. You must enter this password if you are connecting as a setup user via SSH. Access will be automatically enabled directly after confirming this dialogue. You can now connect to the device as a setup user using an SSH Client (e.g. PuTTY). You can check whether access is currently enabled by looking at the Access box of the console s status screen. 9.3 Activating root access via SSH It is possible to activate access to the device as a root system user. Once the device has initialised however, this access will be deactivated. Once activated, you can log onto the device as a root user via SSH. Caution Commands you execute on the device as root can cause lasting alteration or damage, not only to your data, but also to the delivered system. The manufacturer shall accept no liability for alterations you make in this way. Only activate and use the root user if you are sure what you are doing and only for diagnostic purposes.

Check_MK virt1 - User Manual 28 / 56 You can enable access via the configuration dialogue of the console. To do this, select the menu item root access via SSH. When you activate this option, you will be asked to enter a password. You must enter this password if you are connecting as a root user via SSH. Access will be automatically enabled directly after confirming

Check_MK virt1 - User Manual 29 / 56 this dialogue. You can now connect to the device as a root user using an SSH Client (e.g. PuTTY). You can check whether access is currently enabled by looking at the Access box of the console s status screen.

Check_MK virt1 - User Manual 30 / 56 10. Protecting web access via SSL Access to your device s web interface is factory-set to take place via HTTP in plain text. You can protect this access via HTTPS (SSL), encrypting the data transferred between your browser and the device. You can open the configuration by pressing the button Web access type in the device settings. 10.1 Installing a certificate In order to encrypt data traffic, the device needs a certificate and a private key first. There are several ways available for you to install these. Create a new certificate and have it signed by a certification authority by sending a certificate signing request (CSR) Upload an existing private key and certificate Create a new certificate and sign it yourself You can choose one of the options above that fits your requirements and possibilities. Certificates signed by certification authorities generally have the advantage that clients can automatically verify the authenticity of the host (device) at the time of access. This is normally the case with official certification authorities. If a user accesses the web interface via HTTPS and the certificate is either self-signed or signed by a certification authority not trusted by the user, this will cause a warning to appear in the user s web browser first. 10.1.1 Creating a new certificate and having it signed To create a new certificate, select the option New certificate. In the dialogue box that follows, you now enter device and operator information, which is then stored on the certificate and can be used by both the certification authority and clients later on to verify the certificate.

Check_MK virt1 - User Manual 31 / 56 Once you have confirmed the dialogue box with Save, you can download the certificate signing request (CSR) file from the web access page. You must provide this file to your certification authority. You will then receive a signed certificate from your certification authority and, where necessary, a certificate chain (often consisting of intermediate and/or root certificates). You will usually receive these in the form of.pem- oder.crt files or directly in PEM-encoded text form. You can now transfer the signed certificate to the device via the Upload certificate dialogue. If you have received a certificate chain, you can upload it via this dialogue too. Once you have confirmed the dialogue with Upload, you can continue configuring the types of access. 10.1.2 Creating a new certificate and signing it yourself To create a new certificate, select the option New certificate. In the dialogue box that follows, you now enter device and operator information, which is then stored on the certificate and can be used clients later on to verify the certificate.

Check_MK virt1 - User Manual 32 / 56 In the last section Signing, you now select Create self-signed certificate. After that you can specify the maximum validity period of the certificate. Once this validity period has expired, you must generate a new certificate. This should be done in good time before expiration so that there are no problems accessing your device. Once you have confirmed the dialogue with Save, you can continue configuring the types of access. 10.1.3 Uploading existing certificate If you have an existing certificate along with a private key, and wish to use this to protect HTTPS traffic, you can transfer these files to your device via the Upload certificate dialogue. Once you have confirmed the dialogue with Upload, you can continue configuring the types of access. 10.2 Configuring access types Once you have installed a certificate, you can now configure the access types according to your requirements. If you wish to protect access to your device via HTTPS, you are recommended to select the option Forced HTTPS. The device will only respond via HTTPS, but will redirect all incoming HTTP requests to HTTPS. This means that users who inadvertently access the web interface via HTTP, either directly or via bookmarks, will automatically be redirected to HTTPS. If it is very important for not a single request to go over the net in plain language, you can select the option HTTPS only. This setting will cause users accessing via HTTP to receive an error message. You can also have a simultaneous configuration of HTTP and HTTPS. However, this setting is only recommended in exceptional cases, for migration purposes or for testing. If you ever want to deactivate HTTPS, you can do this by selecting the option HTTP only.

Check_MK virt1 - User Manual 33 / 56 10.3 Displaying current configuration/certificates On the access type configuration page, you can see the types of access currently active as well as information regarding the current certificate.

Check_MK virt1 - User Manual 34 / 56 11. Device control Procedures such as starting, restarting or shutting down the device all come under device control. You can give these commands in different ways. 11.1 Restarting / Shutting down You can restart or shut down the device over both the web interface and the console. In the web interface you will find the menu items Restart device and Shut down device under the point Control device in the main menu. The device will execute the action immediately after the command has been selected. In the console, you can get to the device control menu by pressing <F2>.

Check_MK virt1 - User Manual 35 / 56 11.2 Restoring factory configuration You can reset your device to factory settings. This means that any changes you have made to the device (e.g. your device settings, monitoring configuration or recorded statistics and logs) will be deleted. When resetting the settings, the firmware version currently installed will be kept; the firmware installed when the device was delivered will not be restored. You can perform this action on the console. To do this, press the key <F2> on the status screen and select Restore factory configuration in dialogue box that follows. Confirm the next dialogue box by clicking on Yes. Your data will now be deleted from the device and the device then restarted immediately. The device will now start with a fresh configuration.

Check_MK virt1 - User Manual 36 / 56 12. Failover cluster You can combine two Check_MK appliances to form a failover cluster. In doing so, all configurations and data will be synchronised between the two devices. The devices connected as a cluster are also referred to as nodes. One of the nodes in the cluster assumes the active role, executing the tasks of the cluster. There is a constant exchange of information between both nodes regarding their state. As soon as the inactive node detects that the active node can no longer complete its tasks (due to failure for example), the inactive node assumes the tasks and becomes the active node. The failover cluster is there to increase the availability of your monitoring installation by protecting a device or individual components against hardware failures. The clustering is not a replacement for data backup. The cluster ensures a shorter downtime in the following situations: If the RAID in a Check_MK rack1 or the SD card in a Check_MK rail1 is no longer accessible, the inactive node takes control of the resources. If the device that has been active until now can no longer be accessed (has failed), the inactive node takes control of the resources. If the active device can no longer access the external network and, unlike the inactive node, has a connection to this network, the inactive node takes control of the resources. If you carry out a firmware update, you can update the nodes individually. While one node is being updated, the other node will continue performing the monitoring. 12.1 Prerequisites In order to build a cluster, you first need two compatible Check_MK appliances. The following models can be clustered with one another: 2x Check_MK rack1 2x Check_MK rail1 2x Check_MK virt1 1x Check_MK rack1 and 1x Check_MK virt1 In addition, the two devices must use a compatible firmware, and at least version 1.1.0. The devices must be wired with at least two mutually independent network connections. It is recommended to use as direct a connection as possible between the devices and to make a further connection over your LAN.

Check_MK virt1 - User Manual 37 / 56 12.2 Migration of existing installations Devices that were delivered and initialised with the firmware version 1.1.0 or higher can be clustered without migration. Devices initialised with earlier firmware must first be updated to version 1.1.0 or higher. The factory settings of the device need to then be restored, preparing the device for clustering. Please note that, in order to prevent data loss, you must back up your data from the device and then restore it. 12.3 Configuration of the cluster This guide assumes that you have already pre-configured both devices to the extent where the web interface can be opened with a web browser. Before actually setting up the cluster, you must first prepare both devices. This mainly involves adapting the network configuration to fulfil clustering requirements (see prerequisites). The configuration of a cluster with two Check_MK rack1 is shown in the following. A cluster is built which looks as shown in the diagram below. The interface designations LAN1, LAN2 etc. used in the diagram correspond to the designations of the physical interfaces on the device. In the operating system, LAN1 corresponds to the device eth0, LAN2 to the device eth1 etc. This configuration complies with the recommendations for the clustering of two Check_MK rack1. You can of course use IP addresses in your environment that suit it. Make sure however that the internal cluster network (bond1 in the diagram) uses a different IP network to the external network (bond0 in the diagram). 12.3.1 Network configuration Open the web interface of the first node, select Device settings and Network settings at the top. You will now be on the network settings configuration page. There are two modes available to you here. The Basic mode, which you can only use to configure your device s LAN1, is activated by default.

Check_MK virt1 - User Manual 38 / 56 The Advanced mode is required for clustering. In order to activate this mode, click on the button Advanced mode at the top and confirm the security prompt. All network interfaces available in the device will be shown to you on the following page. Only the interface eth0 (corresponding to LAN1 ) will currently have a configuration, which was applied by the Basic mode. Now create the first bonding interface bond0 by clicking on Create bonding. For this purpose, enter into the dialogue that follows all data as shown in the diagram below and confirm the dialogue with Save.

Check_MK virt1 - User Manual 39 / 56 Now create the second bonding interface bond1 with the appropriate configuration.

Check_MK virt1 - User Manual 40 / 56 After you have created the two bonding interfaces, you will be able to review all settings made in the network configuration dialogue.

Check_MK virt1 - User Manual 41 / 56 Once you have successfully completed all configuration steps, make the settings effective by clicking on Activate changes. The new network settings will then be loaded. After few seconds, the network configuration will look like this: Now, with the appropriate settings, repeat the configuration of network settings on your second device also. 12.3.2 Host names Devices to be connected in a cluster must have different host names. You can specify these now in the device settings. In our example, we configure node1 as a host name on the first device and node2 on the second device. 12.3.3 Connecting the cluster Having completed preparations, you can now continue setting up the cluster. To do this, open the Clustering module in the main menu of the first device (here node1) in the web interface and click on Manually set up cluster. Now enter the appropriate configuration in the cluster creation dialogue and confirm the dialogue with Save. If you require more information about this dialogue, click on the icon beside the MK logo in the top right-hand corner. Context help will then appear in the dialogue explaining the individual options.

Check_MK virt1 - User Manual 42 / 56 On the following page, you can connect the two devices to form a cluster. To do this, you need to enter the password of the web interface of the second device. This password is used once to establish the connection between the two devices. Then confirm the security prompt if you are sure that you want to overwrite the data of the target device with the IP address displayed. Once this connection is successful, cluster setup is commenced. You can have the current status displayed on the cluster page.

Check_MK virt1 - User Manual 43 / 56 As soon as the cluster has been successfully built, the synchronisation of monitoring data will start from the first to the second node. While this synchronisation is still taking place, all resources, including any monitoring instances you may have, will be started on the first node. From now on you can, using the cluster IP address (here 10.3.3.30), access the resources of the cluster (e.g. your monitoring instances), regardless of the node by which the resources are currently being held. 12.4 The state of the cluster When the first synchronisation is complete, your cluster will be fully operational. You can view the state at any time on the cluster page.

Check_MK virt1 - User Manual 44 / 56 Using the status screen on the console, you can also view the current state of the cluster in the Cluster box in summarised form. The role of the respective node is shown after the current status with (M) for the master host and (S) for the slave host. 12.5 Special cases in the cluster 12.5.1 Access to resources All requests to the monitoring instances (e.g. web interface access) as well as incoming messages (e.g. SNMP traps or syslog messages to the event console or requests to Livestatus) should normally always be sent via the cluster IP address. Only in exceptional cases (e.g. diagnostics or updates of a particular node) should you need to access the individual nodes directly.

Check_MK virt1 - User Manual 45 / 56 12.5.2 Device settings The settings (e.g. time synchronisation or name resolution settings) that have been made independently on the individual devices until now, are synchronised between the two nodes in the cluster. However, you can only execute these settings on the node that is active at the time. The settings are locked on the inactive node. There are some device-specific settings, (e.g. those of the management interface of the Check_MK rack1) which you can adapt to the individual devices at any time. 12.5.3 IP addresses or host names of the nodes To be able to edit the IP configuration of the individual nodes, you must first disband the connection between the nodes. To do this, click on Disband cluster on the cluster page. You can then adapt the desired settings via the web interface of the individual nodes. Once you have made the adjustments, you must now select Reconnect cluster on the cluster page. If the nodes can be successfully reconnected, the cluster will resume operation after a few minutes. You can see the status on the cluster page. 12.5.4 Administrating Check_MK versions and monitoring instances The monitoring instances and Check_MK versions are also synchronised between the two nodes. You can only modify these in the web interface of the active node. If, to do this, you also access the cluster IP address directly, you will always be referred to the device with which you can configure these things. 12.6 Administrative tasks 12.6.1 Firmware updates in the cluster The firmware version of a device is not synchronised in cluster operation. The update is thus carried out for each node. You have the advantage however that one node can continue performing the monitoring while the other node is updated. When updating to a compatible firmware version, you should always proceed as follows: First open the Clustering module in the web interface of the node to be updated. Now click on the heart symbol in the column of this node and confirm the security prompt that follows. This will put the node into maintenance state. Nodes that are in maintenance state release all resources currently active on the node, upon which the other node takes control of them. While a node is in maintenance state, the cluster is not failsafe. So if the active node is now switched off, the inactive node in maintenance state will not take control of the resources. If you now additionally put the second node into maintenance state, all resources will be shut down. These will only be reactivated when a node is taken out of maintenance state. You must always remove the maintenance state again manually. If the cluster page shows the following, you will see that the node is in maintenance state.

Check_MK virt1 - User Manual 46 / 56 You can now perform the firmware update on this node, as on standalone devices also. After you have successfully performed the firmware update, open the cluster page once more and remove the maintenance state of the updated device. The device will then automatically merge into cluster operation, upon which the cluster becomes fully functional again. It is recommended to run the same firmware version on both nodes. You should therefore repeat the same procedure for the other node next.

Check_MK virt1 - User Manual 47 / 56 12.6.2 Disbanding clusters It is possible to disband the nodes from a cluster and continue running them separately. When doing so you can continue using the synchronised configuration on both devices, or reset one of the devices to factory settings and reconfigure it for example. You can remove one or both nodes from the cluster during operation. If you wish to use both nodes, you must ensure that the data synchronisation is in good working order beforehand. You can verify this on the cluster page. In order to disband a cluster, click on Disband cluster on the cluster page of the web interface. Read the text of the confirm prompt that follows. In the different situations, this text contains information as to the state the respective device is in after the disconnection. The disconnection of the devices must be carried out on both nodes separately, so that both devices can be run separately in future. If you only wish to use one of the devices in future, disconnect the cluster on the device you intend to continue using and then restore the factory settings on the other device. Once you have disconnected a node from the cluster, the monitoring instances will not be started automatically. If you wish to start the monitoring instances, you need to do so next via the web interface. 12.6.3 Exchanging a device If the hard drives of the old device are in good order, you can take these from the old device and insert them into the new device, wiring the new device in exactly the same way as the old device was wired and then switching it on. After starting, the new device will merge into the cluster in the same way as the old device. If you want to completely replace an old device with a new one, you should proceed in the same way as when disbanding the cluster completely (see previous chapter). To do this, select one of the previous devices, disconnect this device from the cluster and create a new cluster with this device and the new device. 12.7 Diagnostics and troubleshooting 12.7.1 Logging Cluster administration is a largely automatic function, whereby automatic processes on the nodes decide which device which resources are to be started and stopped on. This behaviour is logged in the form of

Check_MK virt1 - User Manual 48 / 56 detailed log entries. You can access these entries from the cluster page by pressing the button Cluster log. Please note that these entries, just like the other system messages, are lost when restarting the device. If you would like to keep the messages for longer, you can download the current log file over your browser or set up a permanent forwarding of log messages to a syslog server.

Check_MK virt1 - User Manual 49 / 56 13. SMS notifications It is possible to attach a GSM modem to the device in order to have SMS notifications sent over it by Check_MK (in the event of critical problems for example). The GSM modem CEP CT63 GSM USB/serial and the UMTS /GSM modem CEP CEP HT63 e are currently supported. You can either order these together with your appliance or purchase them from us later as accessories. 13.1 Starting up the modem In order to put the modem into operation, you must insert a functioning SIM card, attach the modem to a free USB connector on your appliance using the enclosed USB cable and connect the modem to the mains using the enclosed power adapter. As soon as this has been done, the device will automatically detect the modem and set it up. Open the web interface of the device and select the module SMS administration. The current state of the modem as well as the connection with the mobile phone network will be displayed on this page. If you need to enter a PIN to use your SIM card, you can specify this PIN under SMS settings.

Check_MK virt1 - User Manual 50 / 56 13.2 Diagnostics If sent messages do not reach you, you can view all sent or non-sent messages and messages awaiting sending on the page SMS administration. The entries in these lists will be kept for a maximum of 30 days and then automatically deleted. It is possible, via the menu item Send test SMS, to send a test SMS to a number of your choice. You will find further information on possible SMS sending errors in the SMS log.

Check_MK virt1 - User Manual 51 / 56 14. Diagnostics 14.1 Logs Despite careful tests, it cannot be altogether ruled out that unexpected errors may occur, which are difficult to diagnose without looking at the operating system. One option is to have the log entries that are generated on the system sent via syslog to a syslog server. However, the log entries of the individual monitoring instances are not processed via syslog, meaning they are not forwarded and can only be viewed on the device. In order to make diagnostics on the device easier, there is a view that displays the device s various log files. You can go to this view by clicking on the menu item Log files in the main menu of the web interface. You can select the logs of the device here and view their current content. Note The system log is reinitialised each time the device is started up. If you would like to keep the log entries, you must send them to a syslog server. You can also view the system log on the local console. The last entries of the system log are displayed on the second terminal. You can get to this terminal via the key combination CTRL + ALT + F2. All

Check_MK virt1 - User Manual 52 / 56 kernel messages are displayed on the third terminal. In the case of hardware problems, you will find the relevant messages here. This terminal can be accessed via the key combination CTRL + ALT + F3. The key combination CTRL + ALT + F1 will take you back to the status screen.

Check_MK virt1 - User Manual 53 / 56 15. Service & support 15.1 Manual If you encounter any problems during start-up or operation, please consult this manual first. 15.2 Internet You can get up-to-date support information from our website 1. You will find the latest version of the documentation here as well as general information which is regularly updated and more detailed than this manual. 15.3 Firmware You will find the latest firmware versions on our website 2. You can access this firmware using the access data of your current support contract. 15.4 Hardware support In the event of hardware failure, please contact us by email at cma-support@ or call us on +49 89 18 90 435-20. The problem will be handled by the distributor directly and in accordance with the maintenance agreed upon. 15.5 Software support In the case of a software fault, whether firmware or Check_MK monitoring software, please contact us via your company s own support address. Support will be provided based on the support contract concluded. 1 http:///check_mk_monitoring_appliance.html 2 http:///check_mk_appliance_download.php?html=yes

Check_MK virt1 - User Manual 54 / 56 16. Appendices.1 CE declaration of conformity Mathias Kettner GmbH declares that the device described in this document is in accordance with the essential requirements and other relevant provisions of the directive 1999/5/EC..2 Licences The Check_MK appliance contains both software developed by Mathias Kettner GmbH itself and open source software from various sources. Despite selecting the components carefully, we cannot guarantee that components not developed by us are free from defects of title. The following table will provide you with information on the respective software licences of the components used. Designation Version Licence information Debian 7 (Wheezy) Free Software 1 OMD 1.2.4 2 GPL v2 3 pnp4nagios 0.6.21 GPL v2 3 nagvis 1.8 GPL v2 3 rrdtool 1.4.8 GPL v2 3 check_mk 1.2.4 GPL v2 3 mk-livestatus 1.2.4 GPL v2 3 cmc 1.2.4 Proprietary dokuwiki 2013-05-10a GPL v2 3 nagios 3.5.0 GPL v2 3 nagios-plugins 1.5 GPL v3 4 pyasn1 0.1.7 BSD-Style 5 pysnmp 4.2.4 BSD-Style 6 pysphere 0.1.7 New BSD License 7 net-snmp 5.7.2 BSD / BSD like 8 mod_python 3.3.1 Apache License, Version 2.0 9 patch 2.6 GPL v3 4 nail 11.25 Free, Custom 10

Check_MK virt1 - User Manual 55 / 56 You can get the source codes for the open source components mentioned and any adjustments created by us in the download center of your subscription (excludes Debian 7). You can get the source codes for Debian 7 either at the address specified in the table or through us at a fee..3 VMware Tools The firmware of the Check_MK appliance comes with the software VMware Tools (version 8.6.10.18555) of the manufacturer VMWare 11. This software is activated as soon as the firmware is started as Check_MK virt1 in a virtual machine on a VMware hypervisor. The software is needed in order to improve the performance and functionality of the virtual machine. If you use the VMware Tools software, you must take care to do so in accordance with (EULA) licensing conditions 12..4 VirtualBox Guest Additions The firmware of the Check_MK Appliance is delivered with the software VirtualBox Guest Additions (version 4.3.18) from the manufacturer ORACLE 13. This software is activated as soon as the firmware is started as Check_MK virt1 in a virtual machine on a VirtualBox hypervisor. The software is used to improve the performance and functionality of the virtual machine. The VirtualBox Guest Additions software is licensed under GPLv2..5 Legal notice All information contained in this documentation has been compiled with great care, but must not be construed as a warranty for product characteristics. Mathias Kettner GmbH shall only be liable to the extent set forth in the Terms and Conditions of Sale and Delivery. This manual is the property of Mathias Kettner GmbH and is protected by copyright. This document may be neither copied, translated, transmitted, duplicated nor passed on to third parties for commercial purposes without the prior written permission of Mathias Kettner GmbH, neither completely nor in excerpts. Product names mentioned in this document may be the trademarks and/or registered trademarks of their respective owners. 1 http://www.debian.org/legal/licenses/ 2 OMD is preinstalled in one or several versions, along with all components included in it. You can delete or replace these versions at any time. Depending on the version, the included components and versions may vary. 3 http://www.gnu.org/licenses/gpl.html 4 https://www.gnu.org/copyleft/gpl.html 5 http://pyasn1.sourceforge.net/license.html 6 http://pysnmp.sourceforge.net/license.html 7 http://opensource.org/licenses/bsd-3-clause 8 http://www.net-snmp.org/about/license.html 9 http://www.apache.org/licenses/license-2.0 10 http://heirloom.sourceforge.net/mailx.html 11 https://www.vmware.com/ 12 http://www.vmware.com/download/eula/universal_eula 13 http://www.oracle.com/

Check_MK virt1 - User Manual 56 / 56 Index C Check_MK agent, 25 Check_MK version, 21 Cluster, 36 console, 13, 15, 26 console via SSH, 26 D default configuration, 23 default gateway, 14, 23, 37 default web page, 24 device password, 14 Diagnostics, 51 DNS, 23 DNS server, 23 DNS servers, 18 domain name, 23 E emails, 18, 24 F factory configuration, 35 firmware update, 22 FQDN, 23 H host name, 23 HTTPS, 30 I instance, 19 instance administration, 19 instance login via SSH, 26 IP address, 37 IP-address, 14, 23 netmask, 14, 23, 37 network, 37 network configuration, 14 NTP, 24 NTP server, 24 NTP servers, 18 O OVA file, 2, 6 R Restarting, 34 root, 27 S Shutting down, 34 SMS, 49 SMTP, 24 SMTP relay server, 18, 24 SSH, 26, 27 SSL, 30 status screen, 13 syslog, 24 syslog server, 24 T time synchronisation, 24 V VirtualBox, 2 VMware ESX, 6 VMware ESXi, 6 W Web access type, 30 L LAN, 37 language, 12, 23 Logs, 51 M monitoring instances, 19 N name resolution, 23

Mathias Kettner GmbH Kellerstraße 29 81667 München, Germany http://