diff options
-rw-r--r-- | README | 49 | ||||
l--------- | files/configs/cgi.cfg | 1 | ||||
l--------- | files/configs/nagios.cfg | 1 | ||||
-rw-r--r-- | files/nrpe/nrpe_commands.cfg | 5 | ||||
-rw-r--r-- | files/nsca/nsca.cfg | 12 | ||||
-rw-r--r-- | manifests/command/nrpe.pp | 14 | ||||
-rw-r--r-- | manifests/command/nrpe_timeout.pp | 11 | ||||
-rw-r--r-- | manifests/nrpe.pp | 22 | ||||
-rw-r--r-- | manifests/nrpe/base.pp | 50 | ||||
-rw-r--r-- | manifests/nrpe/command.pp | 33 | ||||
-rw-r--r-- | manifests/nrpe/freebsd.pp | 16 | ||||
-rw-r--r-- | manifests/nrpe/linux.pp | 9 | ||||
-rw-r--r-- | manifests/nrpe/xinetd.pp | 11 | ||||
-rw-r--r-- | manifests/nsca/server.pp | 7 | ||||
-rw-r--r-- | manifests/service.pp | 21 | ||||
-rw-r--r-- | templates/nrpe/nrpe.cfg | 205 |
16 files changed, 456 insertions, 11 deletions
@@ -51,9 +51,9 @@ Services Services can be monitored by using the "nagios::service" component. -The simplest form is:: +The simplest form is: - nagios::service { 'check_http': + nagios::service { 'check_http': check_command => 'http_port!80', } @@ -65,6 +65,29 @@ Obviously, the check command must either be defined using nagios_command objects (some are supplied in nagios::defaults::commands) or in the nagios configuration files directly. +NRPE Services +------------- + +Some Nagios services need to be checked via NRPE. The following will make the +nagios server define a service that will check the NRPE command 'check_cpu' on +the current node: + + nagios::service { 'CPU Usage': + use_nrpe => 'true', + check_command => "check_cpu", + nrpe_args => "-t 60" + } + +NRPE Commands +------------- + +To be able to call NRPE commands on a host, one needs to define that command +and what it is going to execute: + + nagios::nrpe::command { 'debsums': + check_command => '/usr/lib/nagios/plugins/check_debsums openssh-server' + } + Upgrade Notes ============= @@ -134,11 +157,33 @@ Variables Options to change the behavior of the nagios module: +- nagios_parents: Which host(s) are this node's parents in the nagios host map. + - nagios_allow_external_cmd: Set to true, if you'd like to ensure that your http daemon can write to the external command file. You may also need to flip "check_external_commands" in "nagios.cfg" to enable this functionality. +- nagios_cfgdir: specify an alternative directory where Nagios configurations + should be managed. Default value depends of the OS of each + node, but is usually something like '/etc/nagios3'. + +- nagios_plugin_dir: Change the directory where Nagios plugins should be + deployed and pointed to by commands. + +- nagios_nrpe_cfgdir: Change the directory where NRPE configurations should be + managed. The default value depends on the node's OS but + is usually something like '/etc/nagios'. + +- nagios_nrpe_pid_file: Change where the PID file for the Nagios service should + be written to. It's usually a good idea to keep this + file where the init script will find it so that it can + verify the service's status. + +- nagios_nrpe_dont_blame: Set this to 1 to allow arguments to be passed along + with NRPE command calls. Set it to 0 to disable + command arguments. + - nagios_nsa_socket: This optional variable can be used to specify the path to the socket file that the IRC daemon should use. diff --git a/files/configs/cgi.cfg b/files/configs/cgi.cfg new file mode 120000 index 0000000..db9667b --- /dev/null +++ b/files/configs/cgi.cfg @@ -0,0 +1 @@ +Debian/cgi.cfg
\ No newline at end of file diff --git a/files/configs/nagios.cfg b/files/configs/nagios.cfg new file mode 120000 index 0000000..1409b9e --- /dev/null +++ b/files/configs/nagios.cfg @@ -0,0 +1 @@ +Debian/nagios.cfg
\ No newline at end of file diff --git a/files/nrpe/nrpe_commands.cfg b/files/nrpe/nrpe_commands.cfg new file mode 100644 index 0000000..b725a36 --- /dev/null +++ b/files/nrpe/nrpe_commands.cfg @@ -0,0 +1,5 @@ +# default plugins +command[check_users]=/usr/lib/nagios/plugins/check_users $ARG1$ +command[check_disk]=/usr/lib/nagios/plugins/check_disk $ARG1$ -x "/dev" -x "/dev/shm" -x "/lib/init/rw" +command[check_apt]=sudo /usr/lib/nagios/plugins/check_apt -u $ARG1$ +command[check_swap]=/usr/lib/nagios/plugins/check_swap $ARG1$ diff --git a/files/nsca/nsca.cfg b/files/nsca/nsca.cfg index 238869f..0b019ea 100644 --- a/files/nsca/nsca.cfg +++ b/files/nsca/nsca.cfg @@ -21,7 +21,7 @@ pid_file=/var/run/nsca.pid # Port number we should wait for connections on. # This must be a non-priveledged port (i.e. > 1024). -server_port=5677 +server_port=5667 @@ -79,10 +79,15 @@ debug=0 # COMMAND FILE # This is the location of the Nagios command file that the daemon # should write all service check results that it receives. - +# Note to debian users: nagios 1.x and nagios 2.x have +# different default locations for this file. this is the +# default location for nagios 1.x: +#command_file=/var/run/nagios/nagios.cmd +# and this is the default location for nagios2: +#command_file=/var/lib/nagios2/rw/nagios.cmd +# and this is the default location for nagios3: command_file=/var/lib/nagios3/rw/nagios.cmd - # ALTERNATE DUMP FILE # This is used to specify an alternate file the daemon should # write service check results to in the event the command file @@ -96,7 +101,6 @@ command_file=/var/lib/nagios3/rw/nagios.cmd alternate_dump_file=/var/run/nagios/nsca.dump - # AGGREGATED WRITES OPTION # This option determines whether or not the nsca daemon will # aggregate writes to the external command file for client diff --git a/manifests/command/nrpe.pp b/manifests/command/nrpe.pp new file mode 100644 index 0000000..7539a26 --- /dev/null +++ b/manifests/command/nrpe.pp @@ -0,0 +1,14 @@ +class nagios::command::nrpe { + + # this command runs a program $ARG1$ with arguments $ARG2$ + nagios_command { + 'check_nrpe': + command_line => '/usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ -a $ARG2$' + } + + # this command runs a program $ARG1$ with no arguments + nagios_command { + 'check_nrpe_1arg': + command_line => '/usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$' + } +} diff --git a/manifests/command/nrpe_timeout.pp b/manifests/command/nrpe_timeout.pp new file mode 100644 index 0000000..3415566 --- /dev/null +++ b/manifests/command/nrpe_timeout.pp @@ -0,0 +1,11 @@ +class nagios::command::nrpe_timeout { + nagios_command { + 'check_nrpe_timeout': + command_line => '/usr/lib/nagios/plugins/check_nrpe -t $ARG1$ -H $HOSTADDRESS$ -c $ARG2$ -a $ARG3$' + } + + nagios_command { + 'check_nrpe_1arg_timeout': + command_line => '/usr/lib/nagios/plugins/check_nrpe -t $ARG1$ -H $HOSTADDRESS$ -c $ARG2$' + } +} diff --git a/manifests/nrpe.pp b/manifests/nrpe.pp new file mode 100644 index 0000000..5c05ed4 --- /dev/null +++ b/manifests/nrpe.pp @@ -0,0 +1,22 @@ +class nagios::nrpe { + + case $operatingsystem { + 'FreeBSD': { + if $nagios_nrpe_cfgdir == '' { $nagios_nrpe_cfgdir = '/usr/local/etc' } + if $nagios_nrpe_pid_file == '' { $nagios_nrpe_pid_file = '/var/spool/nagios/nrpe2.pid' } + if $nagios_plugin_dir == '' { $nagios_plugin_dir = '/usr/local/libexec/nagios' } + + include nagios::nrpe::freebsd + } + default: { + if $nagios_nrpe_pid_file == '' { $nagios_nrpe_pid_file = '/var/run/nrpe.pid' } + if $nagios_plugin_dir == '' { $nagios_plugin_dir = '/usr/lib/nagios/plugins' } + + case $kernel { + linux: { include nagios::nrpe::linux } + default: { include nagios::nrpe::base } + } + } + } + +} diff --git a/manifests/nrpe/base.pp b/manifests/nrpe/base.pp new file mode 100644 index 0000000..17abb04 --- /dev/null +++ b/manifests/nrpe/base.pp @@ -0,0 +1,50 @@ +class nagios::nrpe::base { + + if $nagios_nrpe_cfgdir == '' { $nagios_nrpe_cfgdir = '/etc/nagios' } + if $processorcount == '' { $processorcount = 1 } + + package { "nagios-nrpe-server": ensure => present; + "nagios-plugins-basic": ensure => present; + "libwww-perl": ensure => present; # for check_apache + } + + # Special-case lenny. the package doesn't exist + if $lsbdistcodename != 'lenny' { + package { "libnagios-plugin-perl": ensure => present; } + } + + file { [ $nagios_nrpe_cfgdir, "$nagios_nrpe_cfgdir/nrpe.d" ]: + ensure => directory } + + if $nagios_nrpe_dont_blame == '' { $nagios_nrpe_dont_blame = 1 } + file { "$nagios_nrpe_cfgdir/nrpe.cfg": + content => template('nagios/nrpe/nrpe.cfg'), + owner => root, group => 0, mode => 644; + } + + # default commands + nagios::nrpe::command { "basic_nrpe": + source => [ "puppet:///modules/site-nagios/configs/nrpe/nrpe_commands.${fqdn}.cfg", + "puppet:///modules/site-nagios/configs/nrpe/nrpe_commands.cfg", + "puppet:///modules/nagios/nrpe/nrpe_commands.cfg" ], + } + # the check for load should be customized for each server based on number + # of CPUs and the type of activity. + $warning_1_threshold = 7 * $processorcount + $warning_5_threshold = 6 * $processorcount + $warning_15_threshold = 5 * $processorcount + $critical_1_threshold = 10 * $processorcount + $critical_5_threshold = 9 * $processorcount + $critical_15_threshold = 8 * $processorcount + nagios::nrpe::command { "check_load": + command_line => "${nagios_plugin_dir}/check_load -w ${warning_1_threshold},${warning_5_threshold},${warning_15_threshold} -c ${critical_1_threshold},${critical_5_threshold},${critical_15_threshold}", + } + + service { "nagios-nrpe-server": + ensure => running, + enable => true, + pattern => "nrpe", + subscribe => File["$nagios_nrpe_cfgdir/nrpe.cfg"], + require => Package["nagios-nrpe-server"], + } +} diff --git a/manifests/nrpe/command.pp b/manifests/nrpe/command.pp new file mode 100644 index 0000000..e6ebdae --- /dev/null +++ b/manifests/nrpe/command.pp @@ -0,0 +1,33 @@ +define nagios::nrpe::command ( + $ensure = present, + $command_line = '', + $source = '' ) +{ + if ($command_line == '' and $source == '') { + fail ( "Either one of 'command_line' or 'source' must be given to nagios::nrpe::command." ) + } + + if $nagios_nrpe_cfg_dir == '' { + $nagios_nrpe_cfgdir = $nagios::nrpe::base::nagios_nrpe_cfgdir + } + + file { "$nagios_nrpe_cfgdir/nrpe.d/${name}_command.cfg": + ensure => $ensure, + mode => 644, owner => root, group => 0, + notify => Service['nagios-nrpe-server'], + require => File [ "$nagios_nrpe_cfgdir/nrpe.d" ] + } + + case $source { + '': { + File["$nagios_nrpe_cfgdir/nrpe.d/${name}_command.cfg"] { + content => template( "nagios/nrpe/nrpe_command.erb" ), + } + } + default: { + File["$nagios_nrpe_cfgdir/nrpe.d/${name}_command.cfg"] { + source => $source, + } + } + } +} diff --git a/manifests/nrpe/freebsd.pp b/manifests/nrpe/freebsd.pp new file mode 100644 index 0000000..063b79b --- /dev/null +++ b/manifests/nrpe/freebsd.pp @@ -0,0 +1,16 @@ +class nagios::nrpe::freebsd inherits nagios::nrpe::base { + + Package["nagios-nrpe-server"] { name => "nrpe" } + Package["nagios-plugins-basic"] { name => "nagios-plugins" } + Package["libnagios-plugin-perl"] { name => "p5-Nagios-Plugin" } + Package["libwww-perl"] { name => "p5-libwww" } + + # TODO check_cpustats.sh is probably not working as of now. the package 'sysstat' is not available under FreeBSD + + Service["nagios-nrpe-server"] { + pattern => "^/usr/local/sbin/nrpe2", + path => "/usr/local/etc/rc.d", + name => "nrpe2", + hasstatus => "false", + } +} diff --git a/manifests/nrpe/linux.pp b/manifests/nrpe/linux.pp new file mode 100644 index 0000000..14e007f --- /dev/null +++ b/manifests/nrpe/linux.pp @@ -0,0 +1,9 @@ +class nagios::nrpe::linux inherits nagios::nrpe::base { + + package { + "nagios-plugins-standard": ensure => present; + "ksh": ensure => present; # for check_cpustats.sh + "sysstat": ensure => present; # for check_cpustats.sh + } + +} diff --git a/manifests/nrpe/xinetd.pp b/manifests/nrpe/xinetd.pp new file mode 100644 index 0000000..e13ed76 --- /dev/null +++ b/manifests/nrpe/xinetd.pp @@ -0,0 +1,11 @@ +# This is created only to cope with cases where we're not the only ones +# administering a machine and NRPE is running in xinetd. +class nagios::nrpe::xinetd inherits base { + + Service ["nagios-nrpe-server"] { + ensure => stopped, + } + + # TODO manage the xinetd config file that glues with NRPE + +} diff --git a/manifests/nsca/server.pp b/manifests/nsca/server.pp index 9239f21..238e49e 100644 --- a/manifests/nsca/server.pp +++ b/manifests/nsca/server.pp @@ -1,13 +1,14 @@ class nagios::nsca::server { package { 'nsca': ensure => installed } - + service { 'nsca': ensure => running, hasstatus => false, hasrestart => true, + require => Package['nsca'], } - + file { '/etc/nsca.cfg': source => [ "puppet:///modules/site-nagios/nsca/{$fqdn}/nsca.cfg", "puppet:///modules/site-nagios/nsca/nsca.cfg", @@ -17,5 +18,5 @@ class nagios::nsca::server { mode => '400', notify => Service['nsca'], } - + } diff --git a/manifests/service.pp b/manifests/service.pp index afc8650..55b2254 100644 --- a/manifests/service.pp +++ b/manifests/service.pp @@ -11,16 +11,33 @@ define nagios::service ( $notification_options = '', $contact_groups = '', $use = 'generic-service', - $service_description = 'absent' ) + $service_description = 'absent', + $use_nrpe = '', + $nrpe_args = '', + $nrpe_timeout = 10 ) { # TODO: this resource should normally accept all nagios_host parameters $real_name = "${hostname}_${name}" + if ($use_nrpe == 'true') { + include nagios::command::nrpe_timeout + + if ($nrpe_args != '') { + $real_check_command = "check_nrpe_timeout!$nrpe_timeout!$check_command!\"$nrpe_args\"" + } + else { + $real_check_command = "check_nrpe_1arg_timeout!$nrpe_timeout!$check_command" + } + } + else { + $real_check_command = "$check_command" + } + @@nagios_service { "${real_name}": ensure => $ensure, - check_command => $check_command, + check_command => $real_check_command, host_name => $host_name, use => $use, notify => Service[nagios], diff --git a/templates/nrpe/nrpe.cfg b/templates/nrpe/nrpe.cfg new file mode 100644 index 0000000..5368bc8 --- /dev/null +++ b/templates/nrpe/nrpe.cfg @@ -0,0 +1,205 @@ +############################################################################# +# Sample NRPE Config File +# Written by: Ethan Galstad (nagios@nagios.org) +# +# Last Modified: 02-23-2006 +# +# NOTES: +# This is a sample configuration file for the NRPE daemon. It needs to be +# located on the remote host that is running the NRPE daemon, not the host +# from which the check_nrpe client is being executed. +############################################################################# + + +# PID FILE +# The name of the file in which the NRPE daemon should write it's process ID +# number. The file is only written if the NRPE daemon is started by the root +# user and is running in standalone mode. + +pid_file=<%= nagios_nrpe_pid_file %> + + + +# PORT NUMBER +# Port number we should wait for connections on. +# NOTE: This must be a non-priviledged port (i.e. > 1024). +# NOTE: This option is ignored if NRPE is running under either inetd or xinetd + +server_port=5666 + + + +# SERVER ADDRESS +# Address that nrpe should bind to in case there are more than one interface +# and you do not want nrpe to bind on all interfaces. +# NOTE: This option is ignored if NRPE is running under either inetd or xinetd + +<%- if has_variable?("nagios_nrpe_server_address") then %> +<%- if not nagios_nrpe_server_address.to_s.empty? then %> +server_address=<%= nagios_nrpe_server_address %> +<%- end %> +<%- end %> + + +# NRPE USER +# This determines the effective user that the NRPE daemon should run as. +# You can either supply a username or a UID. +# +# NOTE: This option is ignored if NRPE is running under either inetd or xinetd + +nrpe_user=nagios + + + +# NRPE GROUP +# This determines the effective group that the NRPE daemon should run as. +# You can either supply a group name or a GID. +# +# NOTE: This option is ignored if NRPE is running under either inetd or xinetd + +nrpe_group=nagios + + + +# ALLOWED HOST ADDRESSES +# This is an optional comma-delimited list of IP address or hostnames +# that are allowed to talk to the NRPE daemon. +# +# Note: The daemon only does rudimentary checking of the client's IP +# address. I would highly recommend adding entries in your /etc/hosts.allow +# file to allow only the specified host to connect to the port +# you are running this daemon on. +# +# NOTE: This option is ignored if NRPE is running under either inetd or xinetd + +<%- if nagios_nrpe_allowed_hosts.to_s.empty? then %> +allowed_hosts=127.0.0.1 +<%- else %> +allowed_host=127.0.0.1,<%= nagios_nrpe_allowed_hosts %> +<%- end %> + +# COMMAND ARGUMENT PROCESSING +# This option determines whether or not the NRPE daemon will allow clients +# to specify arguments to commands that are executed. This option only works +# if the daemon was configured with the --enable-command-args configure script +# option. +# +# *** ENABLING THIS OPTION IS A SECURITY RISK! *** +# Read the SECURITY file for information on some of the security implications +# of enabling this variable. +# +# Values: 0=do not allow arguments, 1=allow command arguments + +dont_blame_nrpe=1 + + +# COMMAND PREFIX +# This option allows you to prefix all commands with a user-defined string. +# A space is automatically added between the specified prefix string and the +# command line from the command definition. +# +# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! *** +# Usage scenario: +# Execute restricted commmands using sudo. For this to work, you need to add +# the nagios user to your /etc/sudoers. An example entry for alllowing +# execution of the plugins from might be: +# +# nagios ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/ +# +# This lets the nagios user run all commands in that directory (and only them) +# without asking for a password. If you do this, make sure you don't give +# random users write access to that directory or its contents! + +# command_prefix=/usr/bin/sudo + + + +# DEBUGGING OPTION +# This option determines whether or not debugging messages are logged to the +# syslog facility. +# Values: 0=debugging off, 1=debugging on + +debug=0 + + + +# COMMAND TIMEOUT +# This specifies the maximum number of seconds that the NRPE daemon will +# allow plugins to finish executing before killing them off. + +command_timeout=60 + + + +# WEEK RANDOM SEED OPTION +# This directive allows you to use SSL even if your system does not have +# a /dev/random or /dev/urandom (on purpose or because the necessary patches +# were not applied). The random number generator will be seeded from a file +# which is either a file pointed to by the environment valiable $RANDFILE +# or $HOME/.rnd. If neither exists, the pseudo random number generator will +# be initialized and a warning will be issued. +# Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness + +#allow_weak_random_seed=1 + + + +# INCLUDE CONFIG FILE +# This directive allows you to include definitions from an external config file. + +#include=<somefile.cfg> + + + +# INCLUDE CONFIG DIRECTORY +# This directive allows you to include definitions from config files (with a +# .cfg extension) in one or more directories (with recursion). + +#include_dir=<somedirectory> +#include_dir=<someotherdirectory> +include_dir=<%= nagios_nrpe_cfgdir %>/nrpe.d + + + +# COMMAND DEFINITIONS +# Command definitions that this daemon will run. Definitions +# are in the following format: +# +# command[<command_name>]=<command_line> +# +# When the daemon receives a request to return the results of <command_name> +# it will execute the command specified by the <command_line> argument. +# +# Unlike Nagios, the command line cannot contain macros - it must be +# typed exactly as it should be executed. +# +# Note: Any plugins that are used in the command lines must reside +# on the machine that this daemon is running on! The examples below +# assume that you have plugins installed in a /usr/local/nagios/libexec +# directory. Also note that you will have to modify the definitions below +# to match the argument format the plugins expect. Remember, these are +# examples only! + +# The following examples use hardcoded command arguments... + +#command[check_users]=/usr/lib/nagios/plugins/check_users -w 5 -c 10 +#command[check_load]=/usr/lib/nagios/plugins/check_load -w 15,10,5 -c 30,25,20 +#command[check_disk1]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hda1 +#command[check_disk2]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hdb1 +#command[check_zombie_procs]=/usr/lib/nagios/plugins/check_procs -w 5 -c 10 -s Z +#command[check_total_procs]=/usr/lib/nagios/plugins/check_procs -w 150 -c 200 + +# The following examples allow user-supplied arguments and can +# only be used if the NRPE daemon was compiled with support for +# command arguments *AND* the dont_blame_nrpe directive in this +# config file is set to '1'... + +#command[check_users]=/usr/lib/nagios/plugins/check_users -w $ARG1$ -c $ARG2$ +#command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$ +#command[check_disk]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$ +#command[check_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$ + +# +# local configuration: +# if you'd prefer, you can instead place directives here + |