Monitoring Linux systems using SSH

[Richard Hsu 5]

We request another way for Logic Monitor to gather information from Linux based systems besides SNMP. Using SNMP involves installing NET-SNMP so taking up additional storage space. It would be better if Logic Monitor had an option for monitoring Linux systems like we had using Sitescope. In Sitescope all it needed was SSH and a dedicated login credential for the system. The Monitor would connect to the Linux based system through SSH and run scripts pertaining to what aspects were monitoring on that system. Then stores the results to be displayed on the console. Similar to using WMI in Windows.

[mnagel 108]

I agree we need a non-SNMP method to monitor Linux, even if that entails deploying a collector on each server.  Leveraging other tools like collectd would also be nice options.  We have run into various environments where SNMP (even SNMPv3) is verboten due to perceived security concerns.  Even if allowed, manually configuring SNMP on many servers to enable basic data collection seems like a bad plan.

[Martin Rausch 1]

I would very much like to see this as well. If ssh based monitoring is to be supported it should support ssh keys as well as passwords.

[Sam Gendler 0]

Are ssh keys supported yet?  Better yet would be the ability to fetch an ssh key, by name, from a key management service such as those offered by AWS and others.  I don't want to have to encode passwords into the logicmonitor interface, and I certainly don't want to have to leave a private key with access to all my production resources on my collector, but my collector runs on an ec2 instance that has an instance role assigned to it, so it would be trivial to give that role a policy which allows it to fetch a key by name.  If the basic ssh functionality included in scripts were to include the ability to look up an ssh key, or could receive the output of a different data source (I could write a script to fetch the key easily enough), that would be ideal, since modifying every data source to use a different script would be a drag.  This would give me the ability to use key-based authentication for ssh while still allowing me to do key management without having to update filesystems and logicmonitor properties.  I could simply rotate in a fresh key in the key management service and everything would continue to function normally.

[Mosh 124]

Could be done now using the Expect library (as is used by Config modules).

I would still like SNMP as well, not to replace it.  As we have black box Linux appliances too.

Edited April 27, 2018 by Mosh

[Jake Cohen 0]

There is now a collection of SSH based datasources for monitoring Linux: 

Linux_CPU_Cores, Linux_Block_DevicePerformance, Linux_Memory_Usage, Linux_Host_Uptime, Linux_Filesystem_Usage, Linux_CPU_Load, Linux_Network_TCPUDP, Linux_Network_Interfaces

They work in tandem with the Linux_Monitoring_SSH PropertySource.

These can all be added via the LogicMonitor DataSource Repository. 

[Mosh 124]

Hi @Jake Cohen

I can't see the SSH Linux_FIlesystem_Usage datasource in the repository?

[Jake Cohen 0]

Hey @Mosh - You can find it with locator code: CGWHNZ

[Kerry DeVilbiss 0]

FYI for those tracking here - I believe we are currently working on updated versions of these that will provide the ability to use SSH keys for authentication. Stay tuned ... !

[Mosh 124]

Thanks @Jake Cohen

[SeanC 2]

On 6/27/2018 at 1:14 AM, Jake Cohen said:

Hey @Mosh - You can find it with locator code: CGWHNZ

I can't find any of these except the one you gave the code for.

Does anyone have the codes for the other linux SSH datasources?

[Kerry DeVilbiss 0]

Hey @SeanC,

You should be able to pull down all the modules via the UI - they are all published to our core repository and start with Linux_SSH_*

See https://www.logicmonitor.com/support/logicmodules/about-logicmodules/keeping-your-datasources-up-to-date/ for additional information.

Let me know if you can't pull them into your account and we can share the locator codes, if need be(!)

Cheers,

Kerry

[SeanC 2]

Hi Kerry

I had a look there first and the only ones starting with 'Linux' in my list are:

Linux Disk Inodes
Linux_Sensors_Fans
Linux_Sensors_Temperature
Linux_Sensors_Voltage

Do I need to look at a different server than v128.core.logicmonitor.com ?

[Kerry DeVilbiss 0]

They should be available for all accounts - I would try reaching out to our chat support - they should be able to help with this right away.

If you run out of luck there, let me know and I can grab those locator codes for you.

Thanks,

Kerry

* Just in case, I went ahead and grabbed these. FYI though, the latest/ greatest will always be the repository (!)

Module Name	Version	Locator Code
Linux_SSH_CPUCores	1.2	HTHH4C
Linux_SSH_CPUMemory	1.1	C3KH9F
Linux_SSH_Filesystems	1.1	EJHMRX
Linux_SSH_NetworkInterfaces	1.2	E693TD
Linux_SSH_NetworkTCPUDP	1.1	CLMGCE
Linux_SSH_Uptime	1.1	7ADDAY

Edited December 3, 2019 by Kerry DeVilbiss
added locator codes / modules

[SeanC 2]

Thanks Kerry, turns out my problem was er... me.

I didn't realise that someone else had already added them and I wasn't aware they no longer appear in the repository if they're already added XD

[Murali 0]

I successfully added datasource Linux_SSH_Filesystems on Linux server. But not able to provide ssh username and password anywhere. Is there anything that we need to do.

[raul.rtr 0]

Hi,

Currently starting the implementation of Logicmonitor in our organization, replacing an old agent based monitoring tool. Probably one of the main reasons to select LM has been the agent-less monitoring capabilities.

SNMP based linux monitoring is not an option for us, neither installing LM collectors in each monitored server.

So with current SSH based Linux datasources we miss important required capabilities:

- Linux text log monitoring: Basically, we need to be able to monitor specific log files in a target server for the appearance of specific error patterns on them, and raise an alert in case any of this error occurs. The rule to trigger the alarm must manage the triggering of the alarm depending on the recurrence of the errors and probably other rules. The datasource should be able to manage checkpoints in order to be aware what was the last log line read ensuring that always read only new content in monitored files.

- OS process monitoring: we need to be able to monitor the presence of OS processes and if the number of processes instances required are in execution and probably other rules.

Thanks.

Raúl

 

[Mike Moniz 44]

On 4/18/2020 at 8:30 AM, Murali said:

I successfully added datasource Linux_SSH_Filesystems on Linux server. But not able to provide ssh username and password anywhere. Is there anything that we need to do.

You would add the ssh.user and ssh.pass as properties to the device or group that contains the device. You can see the link for details but basically choose the device/group and then the Manage button, on the bottom will be a section for Properties.

https://www.logicmonitor.com/support/getting-started/advanced-logicmonitor-setup/defining-authentication-credentials

[Stuart Weenig 3]

On 4/18/2020 at 1:55 PM, raul.rtr said:

Hi,

Currently starting the implementation of Logicmonitor in our organization, replacing an old agent based monitoring tool. Probably one of the main reasons to select LM has been the agent-less monitoring capabilities.

SNMP based linux monitoring is not an option for us, neither installing LM collectors in each monitored server.

So with current SSH based Linux datasources we miss important required capabilities:

- Linux text log monitoring: Basically, we need to be able to monitor specific log files in a target server for the appearance of specific error patterns on them, and raise an alert in case any of this error occurs. The rule to trigger the alarm must manage the triggering of the alarm depending on the recurrence of the errors and probably other rules. The datasource should be able to manage checkpoints in order to be aware what was the last log line read ensuring that always read only new content in monitored files.

- OS process monitoring: we need to be able to monitor the presence of OS processes and if the number of processes instances required are in execution and probably other rules.

Thanks.

Raúl

This has been split into this thread.