Hi guys,
Anyone got this working?
And if so, how did you do it?
I know I can monitor the components separately, but if you know of anything that can do it easier I'd be happy to know about it.
/tony
Hi Tony,
I'm monitoring using the following userparameter (basically run "ipactl status" and grep out lines which are known good so only errors are returned):
UserParameter=ipa.status,sudo /usr/sbin/ipactl status 2>&1 | egrep -v "(INFO: The ipactl command was successful$|: RUNNING$)"
ipactl needs root access so I have a file in /etc/sudoers.d/zabbix with these lines to allow the zabbix user to sudo the ipactl status command only without a password:
## Allow zabix to query ipa status Defaults:zabbix !requiretty zabbix ALL = (root) NOPASSWD: /usr/sbin/ipactl status
The final challenge I had was selinux which I had to create a custom rule for (but most people seem to just disable selinux).
Then just create a trigger to alert if the returned value contains any characters. eg this matches on any char apart from whitespace:
{Custom Template IPA Server:ipa.status.regexp([^\s],1200)}=1
If anyone else has a better way to do this I'd be interested to hear it.
Regards,
Neal.
________________________________ From: Tony Brian Albers via FreeIPA-users freeipa-users@lists.fedorahosted.org Sent: 24 August 2018 10:50 To: freeipa-users@lists.fedorahosted.org Cc: Tony Brian Albers Subject: [Freeipa-users] zabbix for monitoring FreeIPA server?
Hi guys,
Anyone got this working?
And if so, how did you do it?
I know I can monitor the components separately, but if you know of anything that can do it easier I'd be happy to know about it.
/tony -- -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316 _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...
Hi Tony, The solution of Neal Harrington works perfectly! Here the full steps to implement his solution: 1) open with an editor on ipa server /etc/sudoers.d/zabbix and fill with: ## Allow zabix to query ipa status Defaults:zabbix !requiretty zabbix ALL = (root) NOPASSWD: /usr/sbin/ipactl status
2) open with an editor an ipa server /etc/zabbix/zabbix_agentd.d/userparameter-ipa.conf and fill with: UserParameter=ipa.status,sudo /usr/sbin/ipactl status 2>&1|egrep -v "(INFO: The ipactl command was successful$|: RUNNING$)"
3) execute on ipaserver: systemctl restart zabbix-agent
4) execute on ipaserver to verify zabix-agent config: zabbix_agentd -p|grep ipa.status
5) execute on zabbix server to verify the item can be queried (Where 192.168.0.1 is the ip of the ipa server): zabbix_get -s 192.168.0.1 -k ipa.status
(The result should be an empty line!)
6) Then on the zabbix server open a new textfile template.xml and fill it with: <zabbix_export> <version>4.0</version> <date>2019-05-24T06:58:01Z</date> <groups> <group> <name>Templates/Applications</name> </group> </groups> <templates> <template> <template>Template IPA server application</template> <name>Template IPA server application</name> <description/> <groups> <group> <name>Templates/Applications</name> </group> </groups> <applications/> <items> <item> <name>Custom Template IPA Server</name> <type>0</type> <snmp_community/> <snmp_oid/> <key>ipa.status</key> <delay>30s</delay> <history>90d</history> <trends>0</trends> <status>0</status> <value_type>4</value_type> <allowed_hosts/> <units/> <snmpv3_contextname/> <snmpv3_securityname/> <snmpv3_securitylevel>0</snmpv3_securitylevel> <snmpv3_authprotocol>0</snmpv3_authprotocol> <snmpv3_authpassphrase/> <snmpv3_privprotocol>0</snmpv3_privprotocol> <snmpv3_privpassphrase/> <params/> <ipmi_sensor/> <authtype>0</authtype> <username/> <password/> <publickey/> <privatekey/> <port/> <description/> <inventory_link>16</inventory_link> <applications/> <valuemap/> <logtimefmt/> <preprocessing/> <jmx_endpoint/> <timeout>3s</timeout> <url/> <query_fields/> <posts/> <status_codes>200</status_codes> <follow_redirects>1</follow_redirects> <post_type>0</post_type> <http_proxy/> <headers/> <retrieve_mode>0</retrieve_mode> <request_method>0</request_method> <output_format>0</output_format> <allow_traps>0</allow_traps> <ssl_cert_file/> <ssl_key_file/> <ssl_key_password/> <verify_peer>0</verify_peer> <verify_host>0</verify_host> <master_item/> </item> </items> <discovery_rules/> <httptests/> <macros/> <templates/> <screens/> </template> </templates> <triggers> <trigger> <expression>{Template IPA server application:ipa.status.regexp([^\s],1200)}=1</expression> <recovery_mode>0</recovery_mode> <recovery_expression/> <name>IPA service status trigger</name> <correlation_mode>0</correlation_mode> <correlation_tag/> <url/> <status>0</status> <priority>2</priority> <description/> <type>0</type> <manual_close>0</manual_close> <dependencies/> <tags/> </trigger> </triggers> </zabbix_export>
7) Import the template in zabbix and add it to your ipa server.
Wow!
I haven't had the time yet to get on with it, but you sure saved me a lot of time fiddling with this.
Thanks Geert.
/tony
On Fri, 2019-05-24 at 08:38 +0000, Geert Geurts via FreeIPA-users wrote:
Hi Tony, The solution of Neal Harrington works perfectly! Here the full steps to implement his solution:
- open with an editor on ipa server /etc/sudoers.d/zabbix and fill
with: ## Allow zabix to query ipa status Defaults:zabbix !requiretty zabbix ALL = (root) NOPASSWD: /usr/sbin/ipactl status
- open with an editor an ipa server
/etc/zabbix/zabbix_agentd.d/userparameter-ipa.conf and fill with: UserParameter=ipa.status,sudo /usr/sbin/ipactl status 2>&1|egrep -v "(INFO: The ipactl command was successful$|: RUNNING$)"
- execute on ipaserver:
systemctl restart zabbix-agent
- execute on ipaserver to verify zabix-agent config:
zabbix_agentd -p|grep ipa.status
- execute on zabbix server to verify the item can be queried (Where
192.168.0.1 is the ip of the ipa server): zabbix_get -s 192.168.0.1 -k ipa.status (The result should be an empty line!)
- Then on the zabbix server open a new textfile template.xml and
fill it with:
<zabbix_export> <version>4.0</version> <date>2019-05-24T06:58:01Z</date> <groups> <group> <name>Templates/Applications</name> </group> </groups> <templates> <template> <template>Template IPA server application</template> <name>Template IPA server application</name> <description/> <groups> <group> <name>Templates/Applications</name> </group> </groups> <applications/> <items> <item> <name>Custom Template IPA Server</name> <type>0</type> <snmp_community/> <snmp_oid/> <key>ipa.status</key> <delay>30s</delay> <history>90d</history> <trends>0</trends> <status>0</status> <value_type>4</value_type> <allowed_hosts/> <units/> <snmpv3_contextname/> <snmpv3_securityname/> <snmpv3_securitylevel>0</snmpv3_securitylevel> <snmpv3_authprotocol>0</snmpv3_authprotocol> <snmpv3_authpassphrase/> <snmpv3_privprotocol>0</snmpv3_privprotocol> <snmpv3_privpassphrase/> <params/> <ipmi_sensor/> <authtype>0</authtype> <username/> <password/> <publickey/> <privatekey/> <port/> <description/> <inventory_link>16</inventory_link> <applications/> <valuemap/> <logtimefmt/> <preprocessing/> <jmx_endpoint/> <timeout>3s</timeout> <url/> <query_fields/> <posts/> <status_codes>200</status_codes> <follow_redirects>1</follow_redirects> <post_type>0</post_type> <http_proxy/> <headers/> <retrieve_mode>0</retrieve_mode> <request_method>0</request_method> <output_format>0</output_format> <allow_traps>0</allow_traps> <ssl_cert_file/> <ssl_key_file/> <ssl_key_password/> <verify_peer>0</verify_peer> <verify_host>0</verify_host> <master_item/> </item> </items> <discovery_rules/> <httptests/> <macros/> <templates/> <screens/> </template> </templates> <triggers> <trigger> <expression>{Template IPA server application:ipa.status.regexp([^\s],1200)}=1</expression> <recovery_mode>0</recovery_mode> <recovery_expression/> <name>IPA service status trigger</name> <correlation_mode>0</correlation_mode> <correlation_tag/> <url/> <status>0</status> <priority>2</priority> <description/> <type>0</type> <manual_close>0</manual_close> <dependencies/> <tags/> </trigger> </triggers> </zabbix_export>
- Import the template in zabbix and add it to your ipa server.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahoste d.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelin es List Archives: https://lists.fedorahosted.org/archives/list/freeipa-u sers@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org