Tag Info

New answers tagged

0

Thank you for your help. The whole idea was to track changes not in real time, as processes can access the registry before user login. In my case it happened to be a new GPO set on my OU.


3

The nagios web front end is capable of implementing this minimal work flow using nagios acknowledgements, but it's not what I would call a ticketing system. Any ticketing system that has a programmable API should be able to do what you want. The key nagios concepts that you'll need to understand to implement this are escalations - Nagios uses these to ...


0

Don't use disown... I don't know the full contents of the script, but you should really try to use a PID file if possible. But you can use Monit to start and stop the process regardless. check process Backend matching "PluginHandler" start program = "/path/to/rundaemon.sh" as uid user stop program = "/usr/bin/pkill -f PluginHandler" ...


0

If you want simple, I'd go with runit. It will restart the service once a second until it is consistently up, can replace scripts in /etc/init.d with a tiny bit of handywork, and has consistent handling all the way around. The only shortcoming I've had is figuring out single-shot always-on services (services that "start" but in reality exit while leaving a ...


0

That card has a Marvell 88SE9230 chipset. I don't know which driver gets loaded in your kernel but you may be lucky and have compatibility with the Marvell support in smartctl. Then you can script something based around smartctl -a -d marvell /dev/sda to monitor drive status in your array.


1

This is a consumer oriented adapter card, and should not be used in professional systems. I doubt there is any monitoring solution available for this. I recommend that you get a proper server RAID adapter, or use Linux software RAID instead.


3

For systems that are short-lived or where the infrastructure changes often, I use two different tools to handle monitoring. I added a comment asking which metrics were most important to you, and it seems like you're looking for basic "what happened when?" monitoring stats with some alerting... As systems and hardware are abstracted more via cloud services ...


0

I'm not actually sure that this is answerable as cloud systems are so diverse (I've actually flagged it as too broad), but my thoughts are below. As far as system metrics go, you will need an agent on your servers that pushes metrics up to a central collection endpoint to ensure that new servers are automatically added and old servers are either pruned or ...


0

If you're talking about cloud standard software, aka Openstack, the components are well known. To collect historic data on a cloud scale: https://wiki.openstack.org/wiki/Ceilometer To monitor - sensu EDIT: Ceilometer is openstack specific, but sensu is a generic monitoring framework. Besides, collectd is quite a standard system for gathering metrics, ...


1

Monitor it like any other server (Nagios, opennms etc). The output of top etc. will be specific to your container, rather than the hypervisor. As for the second part of your question; that is personal preference. I would not personally set up alerting based off CPU load, as it does not definitively indicate a problem.


2

Through the Security event logs, you can identify who tried to access a specific registry key if you have enabled auditing. Read more about it here.


2

The Microsoft site sysinternals.com has a utility call regmon (apparently now combined with processmonitor) utility program that will track changes to the registry in real time. A warning, there is a LOT of things that change the registry so be prepared for the output to be very lengthy. However, after the fact, there is nothing that will provide this ...


3

This is possible, but it lacks tool support. I found a library which speaks the SSH protocol well enough to let me write a tool to extract the host cert valid_before time without a full ssh login. Here it is, in the Go language. I hope it helps. package main import "code.google.com/p/go.crypto/ssh" import "fmt" import "os" import "time" func ...


1

Unfortunately I don't know of any open-source tool. It seems nmap would be able to retrieve it somehow with NSE scripts (but needs some tweaking -- check /usr/share/nmap/scripts). SSH's Tectia SSH server includes a tool called ssh-fetchkey that will retrieve the certificate and then you can use ssh-certview to view the details.


0

I'm afraid the answer is "that's not possible". At least not in any way I found, using either the openssh client or the paramiko SSH library for python. I would suggest a local check as you described, combined with a simpler remote check that verifies that the key used by SSHD is the key you just checked the certificate lifetime of.


0

AFAIK, Cacti minmum interval is 1 minute, and you have to change that in the configuration and the poller cron job. You can install a real-time plugin which can poll faster, but it uses a temp RRD files. EDIT: I know that Zabbix support customized polling intervals down to 1 sec, and you can set this per item and not system wide (unlike cacti).


0

The first approach that comes to mind is to have your web servers simply log the requests they handle and use a log parser to generate usage statistics. The combined log format is a standard commonly supported by log parsing web analytics software. access_log /path/to/log combined; If your web servers run as cluster rather than have each server maintain ...


1

The one-liner wraps for your convenience, the following steps: Step 1): Add this to /etc/yum.repos.d/datadog.repo [datadog] name = Datadog, Inc. baseurl = http://yum.datadoghq.com/rpm/ enabled=1 gpgcheck=0 Please note that packages are not GPG-signed and come over https! Step 2): Install Datadog agent sudo yum install datadog-agent Please note that ...


1

Try something like this: sudo lsof -i -n -P | egrep sshd.*ESTABLISHED | egrep `who -a|grep pts|awk '{print $7}'|sed ':a;N;$!ba;s/\n/\\|/g'` To clarify, the objective of this command is to match the lsof hits (which show the port used) with the sessions from who with pts (extracting the PIDs from the output) in order to filter out the false positives. In ...


3

Using lsof -n -i TCP:22 -a -c sshd -a -u ^root,^sshd you can get a list of sshd processes and user names with their sockets on port 22. It is skipping those owned by root or sshd because they do not correspond to logged in users. A completely different approach would be to add some commands to /etc/ssh/sshrc, which will parse $SSH_CONNECTION and log it: ...


0

This is not possible in JBoss AS7 - all users with access to the management interface have all privileges. In Wildfly 8 which is the successor to AS7, there is new role-based access control to administration interfaces including the web console. Have a look at these guides: http://planet.jboss.org/post/role_based_access_control_in_wildfly_8_tech_tip_120 ...


1

Writing your own server attribute discovery system will be more work to maintain than you realize. Consider using an orchestration tool like Mcollective with Facter to perform this task. e.g., Install Facter and Mcollective, and setup a central queue. Make sure you can do "mco ping" and see all of your servers. Then, to discover facts from the servers, you ...


0

One way to do it -- you could have a cron job execute 'top' - which should work, and send it to a text file (or html file in a web server directory) command: top -n 1 -b | head -n 10 > index.html run n=1 iteration of top, head gives n=10 lines (you don't have to have the head command, i just like the control) be sure to use exact paths for the ...


0

There are several solutions available which are able to give you a good overview of a current network status and sends out alerts (SMS, Mail, ...) Check_mk + Nagios: https://mathias-kettner.de/check_mk.html this is a common implementation for monitoring networked services and the network itself. It is not very easy to install, but experience shows that it ...


2

Some ISPs might provide a looking glass server, which provides limited info for public access. These info generally include traceroute/ping from ISP router to specific location, as well as basic BGP info. One can check out sites like lookinglass.org or bgp4.net wiki to see if concerned ISP is listed. However note that those info are very limited, and may ...


10

Usually for a large contract you should be able to negotiate at least read only access to their edge router. However even as building a new data center near one of our ISP connection (~40m cable) and a pretty big contract back then i was unable to get that. There was often some data leaking which you could get. Depending on your local laws this might ...


1

Maybe some RUM monitoring tool would do the job, as it monitors performance from the perspective of users. You could try simple RUM tools like http://www.gear5.me (requires only simple js snippet) or more complex such as http://www.newrelic.com ,which requires a module on server for data acquisition.


0

If you have a vcenter server, and have upgraded to Zabbix 2.2 - the vmware monitoring is now a feature of Zabbix. Read more here in the documentation: https://www.zabbix.com/documentation/2.2/manual/vm_monitoring


1

Without knowing how you are "calling the cluster", we can't answer this. If you are using something that can get you a local shell, you can ask for the system variable COMPUTERNAME. And then however you do that, you can configure your monitoring solution to connect the same way and issue the same query. There are protocols that return a name (often ...


2

You can combine any check with the negate plugin to invert the check logic. You can redefine CRIT, WARN, UNKNOWN, and OK to other states, for example. See the --help output for more info. If you're concerned about DROP policies increasing the check time, you can just shorten the timeout. For a check like this, you probably don't need to check every 5 ...


10

Yes, of course. The job of a monitoring system is to ensure that the business requirements are currently being met by the IT infrastructure, whatever those requirements are. My gut feeling is that there's no easy limit (well, 65535) to the number of ports you're monitoring to ensure that they don't suddenly become open, and that the best way to achieve ...



Top 50 recent answers are included