[sllug-members]: Which Network Monitoring Solution?

[Knight Walker]

On Wed, 2007-11-28 at 08:40 -0700, Nathan Lane wrote:
> Hi I am trying to get a network monitoring solution.  In the past
> we've attempted to use Nagios, but couldn't figure out how to get it
> to monitor whether a specific web page is accessible on a certain
> server.  Today I am trying to set up an OpenNMS server to do the same
> thing, and I am still running into road blocks - I can't find a
> straight forward solution and I've been working on it for two days
> (same problem as with Nagios).  I just found another one - Zenoss -
> and I'm wondering if it's any better/easier/simpler to configure, or
> if it stands up to Nagios and OpenNMS. 

Where I work, we use two Nagios boxes to monitor fifty-three servers and
over 1100 websites.  We monitor all services, including NRPE-based
checks on Linux and Windows servers.  Yeah, configuration isn't
particularly easy, but once it's setup, it's rock solid.

> Our platform is Ubuntu server 7.

Ours is RHEL, but I'm sure Ubuntu has packages available.

> Our environment is a mostly Windows XP/Server 2003 network

Then you may want NRPE-NT, though stay away from the Event Log monitor.
It's WAY too whiny.

> We want to monitor ICMP, HTTP, FTP, SNMP, and most important and
> difficult (apparently) whether or not specific websites are accessible
> constantly. 

Nagios can do all of that plus more.

> Now I know that these [probably] all use slightly different models for
> monitoring - Nagios is mostly SNMP, but has other capabilities and
> it's easy to write plugins for using Perl.  OpenNMS has automatic
> "discovery" of services, which we could really care less about, but it
> seems to be difficult to make it check services that aren't
> "discovered", like this website problem (discussed briefly above).  I
> haven't tried Zenoss yet, I just discovered it on Sourceforge, and
> I've been lurking on their IRC channel.  We currently use a commercial
> system called ipMonitor, which is very pricey, and it doesn't even do
> everything that we want (though I can't pinpoint what it was exactly
> that it doesn't do)  but the configuration part of it is very self
> explanatory and straight forward. 

Actually, Nagios can monitor anything you can get/write/cobble-together
a plugin for (We've got plugins in C, Perl, BASH, and PHP).  We've got
ours monitoring MySQL, Apache 2, load, users, Bacula, network latency,
hardware health, etc.  We don't use the SNMP checks (yet).  And
actually, if you've got a good config (The hardest part is getting one
put together), then you can monitor new services just by adding the
machine to particular groups.  Plus, we've got ours setup on boxes with
other duties and it doesn't bog them down, and it alerts different
groups for different servers.

We're actually about to start replacing our ipMonitor box with Nagios
because ipMon is flaky (Good in pastry, bad in server monitoring
software) and coughs up bogus errors on a daily basis.

> So I need some help - in two areas, which system should I use, or is
> there one the one-ups all of these, and can anybody help me configure
> it to check whether a specific web page is accessible from the server
> (following redirects automatically)? 

Now that I'm mostly done cheer-leading for Nagios, I must state that I
haven't used any of the other FOSS monitoring solutions.  I've worked
with Nagios for years and so it's easy for me to get it to do what I
want.

If you do decide to use Nagios, you may want your employer to pick up a
good Nagios book for you.  They help, and they're cheaper than yearly
licensing for ipMon.

Finally, yes, Nagios can monitor specific URLs.  It can even look for
particular keywords/phrases on those URLs.  That's one of its primary
duties at my job.  We use it to catch website problems where Apache is
still up, but something else in the website code is broken (Or the
database is swamped).  Our check looks like this:

define service {
        service_description     SiteValidator
        use                     website-service
        hostgroup_name          web-pool
        check_command           check_uri!"SiteValidator"!/global/validateV1.js
}

With the underlying command looking like this:

define command {
        command_name    check_uri
        command_line    $USER1$/check_http -H $HOSTADDRESS$ -t 30 -u $ARG2$ -s $ARG1$
}

We've also got a service that checks the default index page on sites for
a string, and it succeeds if the server returns an agreeable HTTP code
and if the string is found.  It's the same as above, but without the
path in the service and the -u option in the command.

-KW