MSSQL databases from Icinga Web 2

Disclaimer: This guide is only for RedHat and CentOS 7, using the PHP SCL packages with the official icingaweb2 package.

Often when we help customers implement Icinga 2, Icinga Web 2 and Director, they use custom imports to pull in data to their monitoring config. Whenever data is in need to be pulled from a MSSQL database, this can be challenging. Their are multiple guides around the Internet, even from Microsoft.

This post should clear things how to achieve this with the official Icinga packages and their requirements.

Requirements

Basic Installation Icinga Web 2

First of all icingaweb2 and PHP needs to be installed – usually you should have this already…

# on RedHat
subscription-manager repos --enable rhel-7-server-optional-rpms
subscription-manager repos --enable rhel-server-rhscl-7-rpms
yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

# on CentOS
yum install centos-release-scl epel-release

yum install httpd icingaweb2

systemctl start httpd.service
systemctl enable httpd.service

echo "date.timezone = Europe/Berlin" > /etc/opt/rh/rh-php71/php.d/timezone.ini
systemctl start rh-php71-php-fpm.service
systemctl enable rh-php71-php-fpm.service

Please also see the official documentation.

MSSQL PDO driver for PHP

Their are multiple ways to install a MSSQL compatible driver, but with icingaweb2 and the ZendFramework below in mind, we need to use pdo_dblib with FreeTDS as driver implementation. I prepared a RPM spec file for you to build and install, it is based on the php-extras packages shipped with Fedora’s EPEL, only updated for PHP 7.1 SCL.

You can setup a small RPM build environment on a RedHat or CentOS machine with the required repositories.

sudo yum install rpm-build rpmdevtools yum-utils gcc gcc-c++ scl-utils scl-utils-build
rpmdev-setuptree

cd ~/rpmbuild/SPEC
wget https://github.com/lazyfrosch/rpm-php-extras/raw/epel7/php-extras.spec
cd ../SOURCES
spectool -gf ../SPECS/php-extras.spec

cd ~/rpmbuild
rpmbuild -bs SPECS/php-extras.spec
sudo yum-builddep SRPMS/rh-php71-php-extras*.src.rpm

rpmbuild --rebuild SRPMS/rh-php71-php-extras*.src.rpm

With the built RPM files under RPMS/ you are good to go to your Icinga machine. Basically you only need to copy rh-php71-php-mssql*.rpm over and install it there.

yum install rh-php71-php-mssql*.rpm
scl enable rh-php71 -- php -m

After restarting php-fpm the driver has been loaded.

systemctl restart rh-php71-php-fpm.service

Patching Icinga Web 2

In Icinga Web 2.5.1 and before there is an error in detecting MSSQL correctly, detection only works in PHP 5.x. A fix has been suggested in PR#3400.

To manually patch this, you only need to fix a single line in /usr/share/php/Icinga/Application/Platform.php

--- /usr/share/php/Icinga/Application/Platform.php.orig 2018-03-27 06:02:59.454240788 -0400
+++ /usr/share/php/Icinga/Application/Platform.php 2018-03-27 00:38:15.967639651 -0400
@@ -351,7 +351,7 @@
 */
 public static function hasMssqlSupport()
 {
- return static::extensionLoaded('mssql') && static::classExists('Zend_Db_Adapter_Pdo_Mssql');
+ return static::extensionLoaded('pdo_dblib') && static::classExists('Zend_Db_Adapter_Pdo_Mssql');
 }
 
 /**

I hope this helps you getting started, feel free to ask questions in the comments.

NETWAYS offers professional support for Icinga and other Open Source tools, check our Website about Support.

The image used in this article is from johnmartel.blogspot.de, we assume fair use by mentioning the author.

Markus Frosch

Autor: Markus Frosch

Markus arbeitet bei NETWAYS als Principal Consultant und unterstützt Kunden bei der Implementierung von Nagios, Icinga und anderen Open Source Systems Management Tools. Neben seiner beruflichen Tätigkeit ist Markus aktiver Mitarbeiter im Debian Projekt.

Running RedHat SCL PostgreSQL with Puppet

On a test system for a customer I wanted to bring up a newer PostgreSQL version on CentOS 7 (same for RHEL 7). Software Collections (also for RedHat) gives you a neat distribution method that is not very invasive into your existing distribution. So you can install a PostgreSQL 9.4 under RHEL 7 without replacing any of the existing packages. This is a bit tricky in terms of paths, but just works.

I found a relatively simple way to install, configure and run such a SCL with Puppet, with just using the existing PostgreSQL module.

Have fun trying it out and let me know what you think.

Markus Frosch

Autor: Markus Frosch

Markus arbeitet bei NETWAYS als Principal Consultant und unterstützt Kunden bei der Implementierung von Nagios, Icinga und anderen Open Source Systems Management Tools. Neben seiner beruflichen Tätigkeit ist Markus aktiver Mitarbeiter im Debian Projekt.

May I introduce the Rubocop

When you are into developing Ruby code, or even Ruby near stuff like Puppet modules, or Chef cookbooks, there is a nice tool you should have a look at.

The RuboCop can help you writing better Ruby code, it certainly did it for me.

In short words, RubyCop is a code analyzer that checks Ruby code against common style guidelines and tries to detect a lot of mistakes and errors that you might write into your code.

There are a lot of configuration options, and even an auto-correct functionality, that updates your code.

Simple usage

Either install the gem, or add it to your Gemfile:

gem 'rubocop', require: false

You can just run it without configuration, and it will look for all Ruby files in your work directory.

$ rubocop
Inspecting 19 files
....C............CC

Offenses:

lib/test/cli.rb:3:3: C: Missing top-level class documentation comment.
 class CLI
 ^^^^^
lib/test/cli.rb:36:1: C: Extra empty line detected at method body beginning.
lib/test/cli.rb:41:1: C: Extra empty line detected at block body beginning.
lib/test/cli.rb:45:4: C: Final newline missing.
end
 
bin/test:12:1: C: Missing space after #.
#api.login('username', 'Passw0rd') unless api.logged_in?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
bin/test:15:3: C: Missing space after #.
 #puts response.code
 ^^^^^^^^^^^^^^^^^^^
bin/test:19:1: C: Missing space after #.
#session.save(file)
^^^^^^^^^^^^^^^^^^^

18 files inspected, 7 offenses detected

You can add it as a rake job to your Rakefile:

require 'rubocop/rake_task'
RuboCop::RakeTask.new

task default: [:spec, :rubocop]

And run the test via your rake tests:

$ rake
$ rake rubocop

Configuration galore

There are a lot of options to modify the behavior and expectations of RuboCop.

Here is a short example I used with recent Puppet module.

require: rubocop-rspec
AllCops:
  TargetRubyVersion: 1.9
  Include:
    - ./**/*.rb
  Exclude:
    - vendor/**/*
    - .vendor/**/*
    - pkg/**/*
    - spec/fixtures/**/*

# We don't use rspec in this way
RSpec/DescribeClass:
  Enabled: False

RSpec/ImplicitExpect:
  Enabled: False

# Example length is not necessarily an indicator of code quality
RSpec/ExampleLength:
  Enabled: False

RSpec/NamedSubject:
  Enabled: False

Where to go next

Markus Frosch

Autor: Markus Frosch

Markus arbeitet bei NETWAYS als Principal Consultant und unterstützt Kunden bei der Implementierung von Nagios, Icinga und anderen Open Source Systems Management Tools. Neben seiner beruflichen Tätigkeit ist Markus aktiver Mitarbeiter im Debian Projekt.

Telegram Notifications von Icinga 2

Ich nutze nun Telegram privat schon seit einiger Zeit, mir gefällt der Messenger und man kann dort auch sehr schön Bots einbinden.

Für meine privaten Systeme hat mich E-Mail für Notifications immer ein bisschen gestresst. Man möchte doch eigentlich nur kurz die Info sehen, was zählt ist doch eh der aktuelle Status im Dashboard. Mails muss man immer wegräumen/löschen.

Warum also nicht die Notifications via Bot an mich in Telegram schicken? Nichts einfacher als das.

In einem GitHub Repository habe ich alles nötige (auf Englisch) zusammengefasst. Doch hier gerne noch ein wenig auf Deutsch erklärt.

(more…)

Markus Frosch

Autor: Markus Frosch

Markus arbeitet bei NETWAYS als Principal Consultant und unterstützt Kunden bei der Implementierung von Nagios, Icinga und anderen Open Source Systems Management Tools. Neben seiner beruflichen Tätigkeit ist Markus aktiver Mitarbeiter im Debian Projekt.

SNMPv3 INFORM in a high available setup

SNMP is, and will be for a long time, one of the key protocols in monitoring. Widely used in hardware and appliance monitoring, and for sending events and alerts via TRAP or INFORM.

Now the problem of SNMPv1 or v2 is, that it has no real security. SNMPv3 offers that, but might cause you headaches, trying to understand, how it works.

With this post I want to explain, how snmptrapd can be used in a high availability setup, with the security of SNMPv3. I hope this gives you an inside and a quick start guide to try it out.

Security model

If you never worked with SNMPv3, just a quick introduction to authentication and security. There are no communities anymore, but a few other parameters are required:

  • securityName (username)
  • authProtocol (MD5 or SHA hashing algorithm)
  • authKey (secret to authenticate the peer)
  • privProtocol (AES or DES to encrypt the data)
  • privKey (secret to encrypt data)

Note: All keys are symmetric, which means both ends of the communication need to use the same keys (and protocol settings).

You can also disable authKey and/or privKey, but than why use SNMPv3? Check the manpage of snmptrapd for how to configure it in detail.

TRAP or INFORM?

With SNMPv3 a new notification type got introduced, called “INFORM”. The main differences between both types are:

  • INFORM is using a protocol to ensure delivery (Receiver sends an ack)
  • TRAP is working similar to v1/2, but its tricky with SNMPv3 security
  • INFORM has protection against message replay

(more…)

Markus Frosch

Autor: Markus Frosch

Markus arbeitet bei NETWAYS als Principal Consultant und unterstützt Kunden bei der Implementierung von Nagios, Icinga und anderen Open Source Systems Management Tools. Neben seiner beruflichen Tätigkeit ist Markus aktiver Mitarbeiter im Debian Projekt.