1

my company is beginning to offer managed services agreements for our customers, meaning that we remotely administer small clusters of servers at the customer site. The hosts we're managing are behind the customer firewall, and our access is via VPN. This works fine for troubleshooting or interactive tasks.

However, I'm not sure how to manage monitoring. I could just write a bunch of monitoring scripts that email me when there are problems. I would rather, though, use a "real" monitoring framework (e.g., Nagios, which I'm most familiar with), that can give me a unified view of the health of all customer sites.

I'm not sure how I would do this, though, since the sites I want to monitor are only accessible by VPN -- and it's not practical to keep the vpn connections up constantly just for the sake of monitoring.

I'd be interested to hear any ideas.

3 Answers 3

2

What's wrong with keeping the VPN connections up all the time? They're not going to wear out. Sounds like a great way of monitoring the health of your VPN endpoint. In fact, if you were to use Nagios you would probably want to configure all your checks to have the VPN endpoint as a dependency (so that your VPN going down wouldn't trigger a flood of erroneous alerts).

You may also want to read the Nagios docs on distributed monitoring, which may provide you with what you want -- install a monitoring host at each customer site, and have them report back to a "master monitor" using the techniques discussed in this document. Assuming that your customer networks don't block your outbound access, this seems to meet your goals:

  • You're not relying on VPNs for inbound access
  • You have a central place to check all your monitoring
2
  • +1, although you'll want to grease your VPN bearings every 50,000,000,000 packets to ensure they don't seize up.
    – womble
    Dec 21, 2009 at 22:17
  • Thanks, that link about distributed monitoring looks like exactly what I want: passive checks via nsca from the customer sites, to a Nagios server at my site. It looks like something that would be acceptable to my customers' infosec departments. And it looks fun to configure :-)
    – JS.
    Dec 22, 2009 at 0:16
2

If all you care about is issue notifications:

  1. Install Nagios at the customer site.
  2. Configure Nagios to send e-mail to you should anything happen.
  3. To make sure that you receive notifications about problems with customers' e-mail systems or Internet access, set up your Nagios instances with WWAN communication capabilities, for example, this little GPRS modem and send SMS along with e-mail or as an alternative to e-mail.

If you want to pull monitoring data too, you will find that your solution will be limited by the customers' security requirements: I'm sure in some cases they'll refuse to provide incoming connections outside of your VPN setup. But if not, then you could put together some perl scripts and place them on externally available web site - this kind of setup is easy to build, manage, and control access. If you look at Pingdom for example, you'll see they use this approach to enable monitoring of pretty much anything inside your environment.

2

i think there is nothing wrong with keeping vpns up for the monitoring.

or maybe you have security concerns.

you can use check_by_ssh and communicate with single host in monitored company [ eg router or anything else that has both access to the lan and public internet ], to call nagios agents on internal machines.

i would relay much more on active - eg nagios based - monitoring than on problem reports sent by mails.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .