[PLUG] Monit instead of Nagios

[JP Vossen <jp@jpsdomain.org>]

Everyone has heard of the monitoring tool Nagios, and perhaps some of 
you have been put off by its reputation for being difficult and time 
consuming to get working right.  I know I have.  Here is another tool to 
consider.  http://tildeslash.com/monit/

Monit is intended to monitor processes and resources on a *single host*, 
but it can also monitor various aspects of remote hosts.  For a 
relatively small and simple environment, such as mine, this is Good Enough.

DISCLAIMER 1: I have never actually attempted a Nagios install; even 
though I want a monitoring tool, its reputation was enough to keep me 
putting off tackling it.

DISCLAIMER 2: I actually did RTFM 
(http://tildeslash.com/monit/doc/manual.php) a bit, but it turns out I 
shouldn't have bothered; at least for my good enough, first pass.


I'm now monitoring 8 daemons on my main server, 3 of which are trivial 
copy & paste & tweak "custom" monitors.  I'm also monitoring 14 other 
hosts, 2 of which are firewalls, 1 is remote in NJ, and 2 are W2KPro. 
The host "monitoring" is an ICMP ping at worst, or that plus checking 
various daemons and ports (SSH, NTP, etc.) at best.


Details
=======
Monit is in the default repos for Debian and in Universe for Ubuntu.  It 
literally took me longer to figure out *what* to monitor that it did to 
fudge up a basic config, using a combination of the the stock Debian 
Etch /etc/monit/monitrc file and 
http://tildeslash.com/monit/doc/examples.php.

Here is the complete process:

# aptitude install monit
# vi /etc/default/monit
	Change to "startup=1"
# vi /etc/monit/monitrc
	Tweak settings as needed
	Copy & paste examples from in config file
	  and http://tildeslash.com/monit/doc/examples.php
# monit -T /etc/monit/monitrc
# vi /etc/monit/monitrc
	Fix all the stuff that copy & paste got wrong *
# monit -T /etc/monit/monitrc
# /etc/init.d/monit start

Then browse to: http://myserver.example.com:2812/

That's it!

* The config code I copy & pasted had a few things like wrong PID file 
paths and init script names (e.g., named --> bind9, sshd --> ssh). 
These were trivial to find and fix using monit -t (test).

Finally, this tool really is intended for local machine monitoring, 
process restarting, and such.  For example, I don't see an easy way to 
monitor disk space or CPU load on a remote machine.  I can think of a 
few ways to hack that in, but it isn't Just There like it is for the 
local machine.  I'd also guess you could goof around with SSH commands 
in the "start/stop program" lines to get some limited remote service 
restart functions, but that adds a lot of moving parts.  You'd probably 
be better off running a local copy, or moving to a monitoring tool 
intended for such things, like Nagios <ducks>.

However, it also have a wide variety of other local checks, such as file 
and directory checksum, timestamp, permissions and more.  You could make 
it a mini tripwire, but more interesting is its ability to restart a 
daemon if that daemon's config file has changed, for example.  The PDF 
preso at http://tildeslash.com/monit/doc/monit.pdf isn't bad, though I 
did get more out of skimming the actual manual.

For my purposes Monit is quite Good Enough, and I'm *very* pleased with 
the product and the return on my time investment for implementing it.  YMMV.

Later,
JP
----------------------------|:::======|-------------------------------
JP Vossen, CISSP            |:::======|        jp{at}jpsdomain{dot}org
My Account, My Opinions     |=========|      http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
Microsoft has single-handedly nullified Moore's Law.
Innate design flaws of Windows make a personal firewall, anti-virus
and anti-malware software mandatory. The resulting software arms race
has effectively flattened Moore's Law on hardware running Windows.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug