elmau
/
iredmail-doc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
iredmail-doc/html_bk/integration.netdata.linux.html

440 lines
17 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Integrate netdata monitor (on Linux server)</title>
<link rel="stylesheet" type="text/css" href="./css/markdown.css" />
</head>
<body>
<div id="navigation">
<a href="https://www.iredmail.org" target="_blank">
<img alt="iRedMail web site"
src="./images/logo-iredmail.png"
style="vertical-align: middle; height: 30px;"
/>&nbsp;
<span>iRedMail</span>
</a>
&nbsp;&nbsp;//&nbsp;&nbsp;<a href="./index.html">Document Index</a></div><h1 id="integrate-netdata-monitor-on-linux-server">Integrate netdata monitor (on Linux server)</h1>
<div class="toc">
<ul>
<li><a href="#integrate-netdata-monitor-on-linux-server">Integrate netdata monitor (on Linux server)</a><ul>
<li><a href="#whats-netdata">What's netdata</a></li>
<li><a href="#install-packages-required-by-netdata">Install packages required by netdata</a></li>
<li><a href="#install-netdata">Install netdata</a></li>
<li><a href="#configure-netdata">Configure netdata</a><ul>
<li><a href="#monitor-openldap">Monitor OpenLDAP</a></li>
<li><a href="#monitor-nginx-and-php-fpm">Monitor Nginx and php-fpm</a></li>
<li><a href="#monitor-dovecot">Monitor Dovecot</a></li>
<li><a href="#monitor-mysqlmariadb-server">Monitor MySQL/MariaDB server</a></li>
<li><a href="#monitor-postgresql-server">Monitor PostgreSQL server</a></li>
</ul>
</li>
<li><a href="#system-tuning">System tuning</a></li>
<li><a href="#configure-nginx-to-forward-requests-to-netdata">Configure Nginx to forward requests to netdata</a></li>
<li><a href="#update-netdata">Update netdata</a></li>
<li><a href="#see-also">See Also</a></li>
</ul>
</li>
</ul>
</div>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<ul>
<li>This tutorial has been tested on CentOS 7, Debian 9, Ubuntu 16.04/18.04.
For FreeBSD, please check this tutorial instead:
<a href="./integration.netdata.freebsd.html">Integrate netdata on FreeBSD</a>.</li>
<li>netdata is an optional component since iRedMail-0.9.8.</li>
</ul>
</div>
<h2 id="whats-netdata">What's netdata</h2>
<p>netdata (<a href="http://my-netdata.io">http://my-netdata.io</a>) is a "Simple. Effective. Awesome!" monitor
which can monitor almost everyting on your Linux/FreeBSD system. You can visit
its website to check online demo.</p>
<p>We will show you how to install and configure netdata on iRedMail server
(Linux) to monitor mail service related softwares.</p>
<h2 id="install-packages-required-by-netdata">Install packages required by netdata</h2>
<p>netdata requires some tools to get stastics data from other softwares, let's
install it first.</p>
<ul>
<li>On RHEL/CentOS:</li>
</ul>
<pre><code>yum install curl libmnl libuuid lm_sensors nc PyYAML zlib iproute MySQL-python python-psycopg2
</code></pre>
<ul>
<li>On Debian/Ubuntu:</li>
</ul>
<pre><code>apt-get install zlib1g libuuid1 libmnl0 curl lm-sensors iproute netcat python-mysqldb python-psycopg2
</code></pre>
<h2 id="install-netdata">Install netdata</h2>
<ul>
<li>
<p>Download the latest netdata from its github project page, and upload to
iRedMail server: <a href="https://github.com/firehol/netdata/releases">https://github.com/firehol/netdata/releases</a></p>
<p>We use version <code>1.10.0</code> for example in this tutorial, the package we download
is: <a href="https://github.com/firehol/netdata/releases/download/v1.10.0/netdata-latest.gz.run">https://github.com/firehol/netdata/releases/download/v1.10.0/netdata-latest.gz.run</a></p>
<p>We assume you upload the package to <code>/root/netdata-latest.gz.run</code>.</p>
</li>
<li>
<p>Install netdata:</p>
</li>
</ul>
<pre><code>cd /root/
chmod +x netdata-latest.gz.run
./netdata-latest.gz.run --accept
</code></pre>
<p>netdata installs its files under <code>/opt/netdata/</code> by default, let's create
symbol link of the configuration and log directories:</p>
<pre><code>ln -s /opt/netdata/etc/netdata /etc/netdata
ln -s /opt/netdata/var/log/netdata /var/log/netdata
</code></pre>
<p>netdata will create required systemd script for service control, also logrotate
config file, so there's not much we need to do after the package installation.</p>
<h2 id="configure-netdata">Configure netdata</h2>
<p>Main config file of netdata is <code>/etc/netdata/netdata.conf</code>, it contains many
parameters with detailed comments. Here's the
<a href="https://github.com/iredmail/iRedMail/blob/1.0/samples/netdata/netdata.conf">config file</a>
used by iRedMail:</p>
<ul>
<li>It binds to address <code>127.0.0.1</code> and port <code>19999</code> by default. Since it doesn't
have ACL control, we will run netdata behind Nginx to get ACL control done in
Nginx.</li>
</ul>
<pre><code>[registry]
enabled = no
[global]
bind to = 127.0.0.1
run as user = netdata
default port = 19999
update every = 3
[plugin:proc]
# Disable IPVS check since iRedMail doesn't use ipvs by default
/proc/net/ip_vs/stats = no
# inbound packets dropped
/proc/net/dev = no
</code></pre>
<p>netdata ships a lot modular config files to gather information of softwares
running on the server, they have very good default settings and most config
files don't need your attention at all, including:</p>
<ul>
<li>System resources (CPU, RAM, disk I/O, etc)</li>
<li>Nginx log file monitoring</li>
<li>Fail2ban jails</li>
<li>Memcached</li>
<li>...</li>
</ul>
<p>But some applications do require extra settings, we will cover them below.</p>
<h3 id="monitor-openldap">Monitor OpenLDAP</h3>
<p>OpenLDAP supports an optional monitoring interface you can use to obtain
information regarding the current state of your OpenLDAP server. For instance,
the interface allows you to determine how many clients are connected to the
server currently. The monitoring information is provided by a specialized
backend, the <code>monitor</code> backend. A manual page, <code>slapd-monitor(5)</code> is available.</p>
<p>netdata-1.11.1 (released on 23 Nov 2018) supports monitoring OpenLDAP through
its <code>monitor</code> backend.</p>
<p>To enable <code>monitor</code> backend in OpenLDAP, please append lines below in
<code>slapd.conf</code>:</p>
<ul>
<li>on RHEL/CentOS, it's <code>/etc/openldap/slapd.conf</code></li>
<li>on Debian/Ubuntu, it's <code>/etc/ldap/slapd.conf</code></li>
</ul>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<p>You must replace <code>dc=example,dc=com</code> by the real LDAP suffix that you use.</p>
</div>
<pre><code>database monitor
access to dn=&quot;cn=monitor&quot;
by dn.exact=&quot;cn=Manager,dc=example,dc=com&quot; read
by dn.exact=&quot;cn=vmail,dc=example,dc=com&quot; read
by * none
</code></pre>
<p>It enables OpenLDAP backend <code>monitor</code>, also grant <code>read</code> access to dn
<code>cn=Manager,dc=example,dc=com</code> and <code>cn=vmail,dc=example,dc=com</code>. Again, you
must replace <code>dc=example,dc=com</code> by the real LDAP suffix that you use.</p>
<p>On Debian/Ubuntu, please also find lines in <code>slapd.conf</code> like below:</p>
<pre><code>modulepath /usr/lib/ldap
moduleload back_mdb
</code></pre>
<p>Append a new <code>moduleload</code> directive right after <code>moduleload back_mdb</code> like
below:</p>
<pre><code>moduleload back_monitor
</code></pre>
<p>Now restart OpenLDAP service.</p>
<p>Create file <code>/opt/netdata/etc/netdata/python.d/openldap.conf</code> with content below:</p>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<ul>
<li>You must replace <code>dc=example,dc=com</code> by the real LDAP suffix that you use.</li>
<li>You must replace <code>&lt;password-of-vmail&gt;</code> by the real password of
<code>cn=vmail</code>. You can find it in files under <code>/etc/postfix/ldap/</code>.</li>
</ul>
</div>
<pre><code>update_every: 5
local:
username : &quot;cn=vmail,dc=example,dc=com&quot;
password : &quot;&lt;password-of-vmail&gt;&quot;
server : &quot;localhost&quot;
port : 389
timeout : 1
</code></pre>
<p>Now restart netdata service.</p>
<h3 id="monitor-nginx-and-php-fpm">Monitor Nginx and php-fpm</h3>
<p>We need to enable <code>stub_status</code> in Nginx to get detailed server info, also
update php-fpm config file to enable similar feature.</p>
<ul>
<li>Create Nginx config snippet <code>/etc/nginx/templates/stub_status.tmpl</code> with
content below:</li>
</ul>
<pre><code>location = /stub_status {
stub_status on;
access_log off;
allow 127.0.0.1;
deny all;
}
location = /status {
include fastcgi_params;
fastcgi_pass php_workers;
fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
access_log off;
allow 127.0.0.1;
deny all;
}
</code></pre>
<ul>
<li>Update default virtual host config file <code>/etc/nginx/sites-enabled/00-default.conf</code>,
include new snippet config file <code>stub_status.tmpl</code> after the
<code>redirect_to_https.tmpl</code> line like below:</li>
</ul>
<pre><code>server {
...
include /etc/nginx/templates/redirect_to_https.tmpl;
include /etc/nginx/templates/stub_status.tmpl; # &lt;- add this line
...
}
</code></pre>
<ul>
<li>Update php-fpm pool config file <code>www.conf</code>, enable parameter <code>pm.status_path</code>
like below:<ul>
<li>On RHEL/CentOS, it's <code>/etc/php-fpm.d/www.conf</code></li>
<li>On Debian, it's <code>/etc/php5/fpm/pool.d/www.conf</code></li>
<li>On Ubuntu, it's <code>/etc/php/7.0/fpm/pool.d/www.conf</code> (note: php version number may be different on your server)</li>
</ul>
</li>
</ul>
<pre><code>pm.status_path = /status
</code></pre>
<ul>
<li>Restart both php-fpm and Nginx service.</li>
</ul>
<h3 id="monitor-dovecot">Monitor Dovecot</h3>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>Netdata supports monitoring Dovecot-2.2 or before, not 2.3.</p>
</div>
<p>We need to enable statistics module in Dovecot.</p>
<ul>
<li>Please open Dovecot config file <code>/etc/dovecot/dovecot.conf</code>, append plugin
<code>stats</code> in global parameter <code>mail_plugins</code>, and <code>imap_stats</code> for imap protocol:</li>
</ul>
<pre><code>mail_plugins = ... stats
protocol imap {
mail_plugins = ... imap_stats
...
}
</code></pre>
<ul>
<li>Append settings below in Dovecot config file:</li>
</ul>
<pre><code>plugin {
# how often to session statistics (must be set)
stats_refresh = 30 secs
# track per-IMAP command statistics (optional)
stats_track_cmds = yes
}
service stats {
fifo_listener stats-mail {
user = vmail
mode = 0644
}
inet_listener {
address = 127.0.0.1
port = 24242
}
}
</code></pre>
<ul>
<li>Restart Dovecot service.</li>
</ul>
<h3 id="monitor-mysqlmariadb-server">Monitor MySQL/MariaDB server</h3>
<p>netdata requires a SQL user (we use <code>netdata</code> here) with privilege <code>USAGE</code> to
gather MySQL server information.</p>
<ul>
<li>Create the SQL user with a strong password (please replace <code>&lt;password&gt;</code> in
command below by the real (and strong) password).</li>
</ul>
<pre><code># mysql -u root
sql&gt; GRANT USAGE ON *.* TO netdata@localhost IDENTIFIED BY '&lt;password&gt;';
sql&gt; FLUSH PRIVILEGES;
</code></pre>
<ul>
<li>
<p>Create file <code>/etc/netdata/python.d/mysql.conf</code> with content below.</p>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<ul>
<li>This file already exists, feel free to remove all content in this file
and copy content below as its new content.</li>
<li>Please replace <code>&lt;password&gt;</code> below by the real password.</li>
</ul>
</div>
</li>
</ul>
<pre><code>tcp:
name: 'local'
host: '127.0.0.1'
port: '3306'
user: 'netdata'
pass: '&lt;password&gt;'
</code></pre>
<h3 id="monitor-postgresql-server">Monitor PostgreSQL server</h3>
<p>netdata requires a SQL user (we use <code>netdata</code> here) to gather PostgreSQL server
information.</p>
<ul>
<li>Create the SQL user with a strong password (please replace <code>&lt;password&gt;</code> in
command below by the real (and strong) password).</li>
</ul>
<pre><code># su - postgres
$ psql
sql&gt; CREATE USER netdata WITH ENCRYPTED PASSWORD '&lt;password&gt;' NOSUPERUSER NOCREATEDB NOCREATEROLE;
</code></pre>
<ul>
<li>
<p>Create file <code>/etc/netdata/python.d/postgres.conf</code> with content below.</p>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<ul>
<li>This file already exists, feel free to remove all content in this file
and copy content below as its new content.</li>
<li>Please replace <code>&lt;password&gt;</code> below by the real password.</li>
</ul>
</div>
</li>
</ul>
<pre><code>socket:
name : 'local'
user : 'netdata'
password : '&lt;password&gt;'
database : 'postgres'
</code></pre>
<h2 id="system-tuning">System tuning</h2>
<p>To get better performance, netdata requires few sysctl settings. Please add
lines below in <code>/etc/sysctl.conf</code>:</p>
<pre><code>vm.dirty_expire_centisecs=60000
vm.dirty_background_ratio=80
vm.dirty_ratio=90
</code></pre>
<p>Also increase max open files limit.</p>
<pre><code>mkdir -p /etc/systemd/system/netdata.service.d
</code></pre>
<p>Create file <code>/etc/systemd/system/netdata.service.d/limits.conf</code>:</p>
<pre><code>[Service]
LimitNOFILE=30000
</code></pre>
<p>Reload systemd daemon:</p>
<pre><code>systemctl daemon-reload
</code></pre>
<h2 id="configure-nginx-to-forward-requests-to-netdata">Configure Nginx to forward requests to netdata</h2>
<ul>
<li>Create Nginx config snippet <code>/etc/nginx/templates/netdata.tmpl</code> with
content below:</li>
</ul>
<pre><code># Running netdata as a subfolder to an existing virtual host
# FYI: https://github.com/firehol/netdata/wiki/Running-behind-nginx
location = /netdata {
return 301 /netdata/;
}
location ~ /netdata/(?&lt;ndpath&gt;.*) {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_pass_request_headers on;
proxy_set_header Connection &quot;keep-alive&quot;;
proxy_store off;
proxy_pass http://127.0.0.1:19999/$ndpath$is_args$args;
gzip on;
gzip_proxied any;
gzip_types *;
auth_basic &quot;Authentication Required&quot;;
auth_basic_user_file /etc/nginx/netdata.users;
}
</code></pre>
<ul>
<li>Update default virtual host (https site) config file
<code>/etc/nginx/sites-enabled/00-default-ssl.conf</code>,
include new snippet config file <code>netdata.tmpl</code> before the
<code>misc.tmpl</code> line like below:</li>
</ul>
<pre><code>server {
...
include /etc/nginx/templates/netdata.tmpl; # &lt;- add this line
include /etc/nginx/templates/misc.tmpl;
...
}
</code></pre>
<ul>
<li>Create new file <code>/etc/nginx/netdata.users</code> used for basic http auth:</li>
</ul>
<pre><code>touch /etc/nginx/netdata.users
</code></pre>
<ul>
<li>Run command below to generate a SSHA password hash. NOTE: Please replace
<code>&lt;password&gt;</code> below by a real, strong password.</li>
</ul>
<pre><code>doveadm pw -s SSHA -p '&lt;password&gt;'
</code></pre>
<p>The password looks like this <code>{SSHA}Tama1midwSV6XWTlonR6n6sNM8yuEPvv</code>.</p>
<ul>
<li>Now open <code>/etc/nginx/netdata.users</code> with your faviourite text
editor, add a line like below to create an account used to access netdata.
The format is <code>&lt;username&gt;:&lt;password&gt;</code>.</li>
</ul>
<pre><code>postmaster@domain.com:{SSHA}Tama1midwSV6XWTlonR6n6sNM8yuEPvv
</code></pre>
<ul>
<li>Restart nginx service.</li>
</ul>
<p>Now open a web browser and access url <code>https://your-server/netdata/</code> (please
replace <code>your-server</code> by the real domain name), it will ask you to input
username and password for authentication, please use the account we just added
in file <code>/etc/nginx/netdata.users</code> to login.</p>
<p>This is what you see after successfully logged in:</p>
<p><img alt="" src="./images/netdata/system-overview.png" width="900px" /></p>
<h2 id="update-netdata">Update netdata</h2>
<p>To update netdata, just download new version of the prebuilt package from its
<a href="https://github.com/netdata/netdata/releases">github page</a>, then run it:</p>
<pre><code>chmod +x netdata-latest.gz.run
./netdata-latest.gz.run --accept
</code></pre>
<p>That's it.</p>
<h2 id="see-also">See Also</h2>
<ul>
<li><a href="./integration.netdata.freebsd.html">Integrate netdata monitor (on FreeBSD server)</a></li>
</ul><div class="footer">
<p style="text-align: center; color: grey;">All documents are available in <a href="https://github.com/iredmail/docs/">GitHub repository</a>, and published under <a href="http://creativecommons.org/licenses/by-nd/3.0/us/" target="_blank">Creative Commons</a> license. You can <a href="https://github.com/iredmail/docs/archive/master.zip">download the latest version</a> for offline reading. If you found something wrong, please do <a href="https://www.iredmail.org/contact.html">contact us</a> to fix it.</p>
</div></body></html>
Reference in New Issue View Git Blame Copy Permalink