2014 Февраль | Записки системного администратора

Архивы за месяц Февраль, 2014

Использование netstat

Февраль 12th, 2014

Evgeniy Kamenev

Использование netstat.

# netstat -na

1	# netstat -na

— просмотр всех открытых портов

# netstat -nat

1	# netstat -nat

– просмотр всех открых TCP-портов

# netstat -nau

1	# netstat -nau

— просмотр всех открых UDP-портов

# netstat -npl

1	# netstat -npl

— просмотр всеx прослушиваемых портов(TCP,UDP,unix-сокеты)

# netstat -nptl

1	# netstat -nptl

— просмотр всеx прослушиваемых портов TCP

# netstat -npul

1	# netstat -npul

— просмотр всеx прослушиваемых портов UDP

# netstat -nplx

1	# netstat -nplx

— просмотр всеx прослушиваемых unix-сокетов

# netstat -s

1	# netstat -s

— просмотр статистики всех протоколов()

# netstat -st

1	# netstat -st

— […]

Опубликовано в рубрике Linux/Unix General, Network tools

Метки: DDoS, DoS, netstat

Комментарии отключены

Установка и настройка Monit на Centos

Февраль 5th, 2014

Evgeniy Kamenev

1.Установка и настройка Monit

# yum install monit

1	# yum install monit

# cp /etc/monit.conf /etc/monit.conf~

1	# cp /etc/monit.conf /etc/monit.conf~

# nano /etc/monit.d/logging

1	# nano /etc/monit.d/logging

set logfile /var/log/monit.log

1	set logfile /var/log/monit.log

# cat /etc/monit.conf | grep -v "#"

1	# cat /etc/monit.conf \| grep -v "#"

set daemon  60 with start delay 240
set logfile /var/log/monit.log
set idfile /var/.monit.id
set statefile /var/.monit.state
set mailserver localhost
set eventqueue
set alert root@localhost not {instance}
set httpd port 2812 and
allow localhost
allow 192.168.1.0/24
allow monit:password
check system lb02.kamaok.org.ua

if loadavg (1min) > 6 then alert
if loadavg (5min) > 3 then alert
if memory usage > 75% then alert
if cpu usage (user) > 70% then alert
if cpu usage (system) > 30% then alert
if cpu usage (wait) > 20% then alert

check file messages with path /var/log/messages
    if match 'OOM killed process' then alert
    if match 'temperature above threshold' then alert
    if match 'table full, dropping packet' then alert
    if match 'OOM killed process' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"
    if match 'temperature above threshold' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"
    if match 'table full, dropping packet' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"

set daemon 60
include /etc/monit.d/*

set daemon 60 with start delay 240

set logfile /var/log/monit.log

set idfile /var/.monit.id

set statefile /var/.monit.state

set mailserver localhost

set eventqueue

set alert root@localhost not {instance}

set httpd port 2812 and

allow localhost

allow 192.168.1.0/24

allow monit:password

check system lb02.kamaok.org.ua

if loadavg (1min) > 6 then alert

if loadavg (5min) > 3 then alert

if memory usage > 75% then alert

if cpu usage (user) > 70% then alert

if cpu usage (system) > 30% then alert

if cpu usage (wait) > 20% then alert

check file messages with path /var/log/messages

if match 'OOM killed process' then alert

if match 'temperature above threshold' then alert

if match 'table full, dropping packet' then alert

if match 'OOM killed process' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"

if match 'temperature above threshold' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"

if match 'table full, dropping packet' for 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor messages && /bin/sleep 3600 && /usr/bin/monit monitor messages'"

set daemon 60

include /etc/monit.d/*

# nano /etc/monit.d/services.conf

1	# nano /etc/monit.d/services.conf

# Мониторинг самого Monit-сервера

#check process httpd with pidfile /var/run/httpd/httpd.pid
#start program = "/etc/init.d/httpd start"  
#stop program  = "/etc/init.d/httpd stop"
#if failed host 127.0.0.1 port 80 protocol http then alert
#if 5 restarts within 5 cycles then timeout

#check process exim with pidfile /var/run/exim.pid
#start program = "/etc/init.d/exim start"  
#stop program  = "/etc/init.d/exim stop"
#if 5 restarts within 5 cycles then timeout

check process nginx with pidfile /var/run/nginx.pid
start program = "/etc/init.d/nginx start"
stop program  = "/etc/init.d/nginx stop"
if failed host 192.168.1.60 port 80 protocol http then alert
if 3 restarts within 3 cycles then timeout

check process named with pidfile /var/run/named.pid
start program = "/etc/init.d/named start"  
stop program  = "/etc/init.d/named stop"
if 5 restarts within 5 cycles then timeout

check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid
start program = "/etc/init.d/fail2ban start"  
stop program  = "/etc/init.d/fail2ban stop"
if 5 restarts within 5 cycles then timeout

#check process proftpd with pidfile /var/run/proftpd.pid
#start program = "/etc/init.d/proftpd start"
#stop program  = "/etc/init.d/proftpd stop"
#if failed port 21 protocol ftp then restart
#if 5 restarts within 5 cycles then timeout

check process dkim-milter with pidfile /var/run/dkim-milter/dkim-milter.pid
start program = "/etc/init.d/dkim-milter start"
stop program  = "/etc/init.d/dkim-milter stop"
if failed host 127.0.0.1 port 8891  then restart
if 5 restarts within 5 cycles then timeout

check process memcached with pidfile /var/run/memcached/memcached.pid
start program = "/etc/init.d/memcached start"
stop program  = "/etc/init.d/memcached stop"
if failed host 127.0.0.1 port 11211  then restart
if 3 restarts within 5 cycles then timeout

check process redis-server with pidfile /var/run/redis/redis.pid
start program = "/etc/init.d/redis start"
stop program  = "/etc/init.d/redis stop"
if failed host 127.0.0.1 port 6379  then restart
if 3 restarts within 5 cycles then timeout

check process rsyslog with pidfile /var/run/syslogd.pid
start program = "/etc/init.d/rsyslog start"
stop program  = "/etc/init.d/rsyslog stop"
if 3 restarts within 5 cycles then timeout

check process php-fpm with pidfile /var/run/php-fpm/php-fpm.pid
start program = "/etc/init.d/php-fpm start"
stop program  = "/etc/init.d/php-fpm stop"
if failed unixsocket /var/run/php5-fpm.sock then restart
#if failed host 127.0.0.1 port 9000 then restart
if 3 restarts within 5 cycles then timeout

check process atop with pidfile /var/run/atop.pid
start program = "/etc/init.d/atop start"
stop program  = "/etc/init.d/atop stop"
if 3 restarts within 5 cycles then timeout

check process munin-node with pidfile /var/run/munin/munin-node.pid
start program = "/etc/init.d/munin-node start"
stop program  = "/etc/init.d/munin-node stop"
if failed host 127.0.0.1 port 4949  then restart
if 3 restarts within 5 cycles then timeout

check process openvpn with pidfile /var/run/openvpn/openvpn.pid
start program = "/etc/init.d/openvpn start"
stop program  = "/etc/init.d/openvpn stop"
if failed host 192.168.1.60 port 1194  then restart
if 3 restarts within 5 cycles then timeout

check process keepalived with pidfile /var/run/keepalived.pid
start program = "/etc/init.d/keepalived start"  #with timeout 60 seconds
stop program  = "/etc/init.d/keepalived stop"

check process sshd with pidfile /var/run/sshd.pid
start program = "/etc/init.d/sshd start"  
stop program  = "/etc/init.d/sshd stop"
if failed port 22 protocol ssh then restart
if 5 restarts within 5 cycles then timeout

check process dovecot with pidfile /var/run/dovecot/master.pid
start program = "/etc/init.d/dovecot start"  
stop program  = "/etc/init.d/dovecot stop"
if 3 restarts within 3 cycles then timeout

check process ntpd with pidfile /var/run/ntpd.pid
start program = "/etc/init.d/ntpd start"  
stop program  = "/etc/init.d/ntpd stop"
if failed host 127.0.0.1 port 123 type udp then alert
if 5 restarts within 5 cycles then timeout

check process crond with pidfile /var/run/crond.pid
start program = "/etc/init.d/crond start"  
stop program  = "/etc/init.d/crond stop"

check process postfix with pidfile /var/spool/postfix/pid/master.pid
start program = "/etc/init.d/postfix start"
stop  program = "/etc/init.d/postfix stop"
if failed port 25 protocol smtp then restart
if 5 restarts within 5 cycles then timeout

check process mmm_agentd with pidfile /var/run/mysql-mmm/mmm_agentd.pid
start program = "/etc/init.d/mysql-mmm-agent start"
stop  program = "/etc/init.d/mysql-mmm-agent stop"
if 5 restarts within 5 cycles then timeout

check process mysql with pidfile /var/lib/mysql/lb02.kamaok.org.ua.pid
start program = "/etc/init.d/mysql start"
stop program = "/etc/init.d/mysql stop"
if 5 restarts within 5 cycles then timeout



#Подключения оповещения при недоступности определенных портов на различных удаленных серверах

check host lb01.kamaok.org.ua  with address 192.168.1.61
if failed icmp type echo count 5 with timeout 10 seconds then alert
if failed port 22 protocol ssh then alert
if failed port 4949  then alert
if failed port 80 then alert
if failed port 11211  then alert
if failed port 25  then alert
if failed port 143  then alert
if failed port 11211  then alert

check host app01.kamaok.org.ua  with address 192.168.1.63
if failed icmp type echo count 5 with timeout 10 seconds then alert
if failed port 22 protocol ssh then alert
if failed port 4949  then alert
if failed port 9989  then alert
if failed port 80 protocol HTTP then alert
if failed port 11211  then alert
if failed port 25  then alert
if failed port 8080  then alert

check host app02.kamaok.org.ua  with address 192.168.1.64
if failed icmp type echo count 5 with timeout 10 seconds then alert
if failed port 22 protocol ssh then alert
if failed port 4949  then alert
if failed port 9989  then alert
if failed port 80 protocol HTTP then alert
if failed port 11211  then alert
if failed port 25  then alert
if failed port 8080  then alert

alert root@localhost

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

# Мониторинг самого Monit-сервера

#check process httpd with pidfile /var/run/httpd/httpd.pid

#start program = "/etc/init.d/httpd start"

#stop program = "/etc/init.d/httpd stop"

#if failed host 127.0.0.1 port 80 protocol http then alert

#if 5 restarts within 5 cycles then timeout

#check process exim with pidfile /var/run/exim.pid

#start program = "/etc/init.d/exim start"

#stop program = "/etc/init.d/exim stop"

#if 5 restarts within 5 cycles then timeout

check process nginx with pidfile /var/run/nginx.pid

start program = "/etc/init.d/nginx start"

stop program = "/etc/init.d/nginx stop"

if failed host 192.168.1.60 port 80 protocol http then alert

if 3 restarts within 3 cycles then timeout

check process named with pidfile /var/run/named.pid

start program = "/etc/init.d/named start"

stop program = "/etc/init.d/named stop"

if 5 restarts within 5 cycles then timeout

check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid

start program = "/etc/init.d/fail2ban start"

stop program = "/etc/init.d/fail2ban stop"

if 5 restarts within 5 cycles then timeout

#check process proftpd with pidfile /var/run/proftpd.pid

#start program = "/etc/init.d/proftpd start"

#stop program = "/etc/init.d/proftpd stop"

#if failed port 21 protocol ftp then restart

#if 5 restarts within 5 cycles then timeout

check process dkim-milter with pidfile /var/run/dkim-milter/dkim-milter.pid

start program = "/etc/init.d/dkim-milter start"

stop program = "/etc/init.d/dkim-milter stop"

if failed host 127.0.0.1 port 8891 then restart

if 5 restarts within 5 cycles then timeout

check process memcached with pidfile /var/run/memcached/memcached.pid

start program = "/etc/init.d/memcached start"

stop program = "/etc/init.d/memcached stop"

if failed host 127.0.0.1 port 11211 then restart

if 3 restarts within 5 cycles then timeout

check process redis-server with pidfile /var/run/redis/redis.pid

start program = "/etc/init.d/redis start"

stop program = "/etc/init.d/redis stop"

if failed host 127.0.0.1 port 6379 then restart

if 3 restarts within 5 cycles then timeout

check process rsyslog with pidfile /var/run/syslogd.pid

start program = "/etc/init.d/rsyslog start"

stop program = "/etc/init.d/rsyslog stop"

if 3 restarts within 5 cycles then timeout

check process php-fpm with pidfile /var/run/php-fpm/php-fpm.pid

start program = "/etc/init.d/php-fpm start"

stop program = "/etc/init.d/php-fpm stop"

if failed unixsocket /var/run/php5-fpm.sock then restart

#if failed host 127.0.0.1 port 9000 then restart

if 3 restarts within 5 cycles then timeout

check process atop with pidfile /var/run/atop.pid

start program = "/etc/init.d/atop start"

stop program = "/etc/init.d/atop stop"

if 3 restarts within 5 cycles then timeout

check process munin-node with pidfile /var/run/munin/munin-node.pid

start program = "/etc/init.d/munin-node start"

stop program = "/etc/init.d/munin-node stop"

if failed host 127.0.0.1 port 4949 then restart

if 3 restarts within 5 cycles then timeout

check process openvpn with pidfile /var/run/openvpn/openvpn.pid

start program = "/etc/init.d/openvpn start"

stop program = "/etc/init.d/openvpn stop"

if failed host 192.168.1.60 port 1194 then restart

if 3 restarts within 5 cycles then timeout

check process keepalived with pidfile /var/run/keepalived.pid

start program = "/etc/init.d/keepalived start" #with timeout 60 seconds

stop program = "/etc/init.d/keepalived stop"

check process sshd with pidfile /var/run/sshd.pid

start program = "/etc/init.d/sshd start"

stop program = "/etc/init.d/sshd stop"

if failed port 22 protocol ssh then restart

if 5 restarts within 5 cycles then timeout

check process dovecot with pidfile /var/run/dovecot/master.pid

start program = "/etc/init.d/dovecot start"

stop program = "/etc/init.d/dovecot stop"

if 3 restarts within 3 cycles then timeout

check process ntpd with pidfile /var/run/ntpd.pid

start program = "/etc/init.d/ntpd start"

stop program = "/etc/init.d/ntpd stop"

if failed host 127.0.0.1 port 123 type udp then alert

if 5 restarts within 5 cycles then timeout

check process crond with pidfile /var/run/crond.pid

start program = "/etc/init.d/crond start"

stop program = "/etc/init.d/crond stop"

check process postfix with pidfile /var/spool/postfix/pid/master.pid

start program = "/etc/init.d/postfix start"

stop program = "/etc/init.d/postfix stop"

if failed port 25 protocol smtp then restart

if 5 restarts within 5 cycles then timeout

check process mmm_agentd with pidfile /var/run/mysql-mmm/mmm_agentd.pid

start program = "/etc/init.d/mysql-mmm-agent start"

stop program = "/etc/init.d/mysql-mmm-agent stop"

if 5 restarts within 5 cycles then timeout

check process mysql with pidfile /var/lib/mysql/lb02.kamaok.org.ua.pid

start program = "/etc/init.d/mysql start"

stop program = "/etc/init.d/mysql stop"

if 5 restarts within 5 cycles then timeout

#Подключения оповещения при недоступности определенных портов на различных удаленных серверах

check host lb01.kamaok.org.ua with address 192.168.1.61

if failed icmp type echo count 5 with timeout 10 seconds then alert

if failed port 22 protocol ssh then alert

if failed port 4949 then alert

if failed port 80 then alert

if failed port 11211 then alert

if failed port 25 then alert

if failed port 143 then alert

if failed port 11211 then alert

check host app01.kamaok.org.ua with address 192.168.1.63

if failed icmp type echo count 5 with timeout 10 seconds then alert

if failed port 22 protocol ssh then alert

if failed port 4949 then alert

if failed port 9989 then alert

if failed port 80 protocol HTTP then alert

if failed port 11211 then alert

if failed port 25 then alert

if failed port 8080 then alert

check host app02.kamaok.org.ua with address 192.168.1.64

if failed icmp type echo count 5 with timeout 10 seconds then alert

if failed port 22 protocol ssh then alert

if failed port 4949 then alert

if failed port 9989 then alert

if failed port 80 protocol HTTP then alert

if failed port 11211 then alert

if failed port 25 then alert

if failed port 8080 then alert

alert root@localhost

2.Проверка синтаксиса, запуск Monit-сервера, добавление в автозагрузку, просмотр логов Monit.

# monit –t

1	# monit –t

# /etc/init.d/monit start

1	# /etc/init.d/monit start

# chkconfig --level 2345 monit on

1	# chkconfig --level 2345 monit on

# tail -f /var/log/monit.log

1	# tail -f /var/log/monit.log

3.Доступ к Web-интерфейсу Monit

http://<IP-address Monit-server>:2812

1	http://<IP-address Monit-server>:2812

с логином и паролем согласно настройкам в /etc/monit.conf (monit password) Источник: http://mmonit.com/wiki/Monit/ConfigurationExamples#ssh http://habrahabr.ru/company/centosadmin/blog/266971/

Опубликовано в рубрике Centos, Monitoring

Метки: monit

Комментарии отключены

Установка и настройка Munin на Centos

Февраль 2nd, 2014

Evgeniy Kamenev

1.Установка и настройка Munin

# yum install munin munin-node

1	# yum install munin munin-node

# cp /etc/munin/munin.conf /etc/munin/munin.conf~

1	# cp /etc/munin/munin.conf /etc/munin/munin.conf~

# nano /etc/httpd/conf.d/munin.conf

1	# nano /etc/httpd/conf.d/munin.conf

Alias /munin /var/www/html/munin

# Если нужно ограничить доступ к статистике по паролю
<Directory /var/www/html/munin>
AuthUserFile /etc/munin/munin-htpasswd
AuthName "Munin"
AuthType Basic
Require valid-user
</Directory>

Alias /munin /var/www/html/munin

# Если нужно ограничить доступ к статистике по паролю

AuthUserFile /etc/munin/munin-htpasswd

AuthName "Munin"

AuthType Basic

Require valid-user

</Directory>

# htpasswd /etc/munin/munin-htpasswd munin

1	# htpasswd /etc/munin/munin-htpasswd munin

Конфигурационный файл Munin-сервера /etc/munin/munin.conf

# cat /etc/munin/munin.conf | grep -v '#' | grep -v '^$'

1	# cat /etc/munin/munin.conf \| grep -v '#' \| grep -v '^$'

dbdir   /var/lib/munin
htmldir /var/www/html/munin
logdir /var/log/munin
rundir  /var/run/munin
tmpldir /etc/munin/templates
staticdir /etc/munin/static
includedir /etc/munin/conf.d
graph_period second
graph_strategy cron
cgiurl_graph /munin-cgi/munin-cgi-graph
html_strategy cron

#определяем клиентов, с которых снимаем статистику
# 127.0.0.1 – Munin-сервер также снимает статистику с себя.

[lb01.kamaok.org.ua]
address 127.0.0.1
use_node_name yes

[lb02.kamaok.org.ua]
address 192.168.1.62
use_node_name yes

[app01.kamaok.org.ua]
address 192.168.1.63
use_node_name yes

[app02.kamaok.org.ua]
address 192.168.1.64
use_node_name yes

dbdir /var/lib/munin

htmldir /var/www/html/munin

logdir /var/log/munin

rundir /var/run/munin

tmpldir /etc/munin/templates

staticdir /etc/munin/static

includedir /etc/munin/conf.d

graph_period second

graph_strategy cron

cgiurl_graph /munin-cgi/munin-cgi-graph

html_strategy cron

#определяем клиентов, с которых снимаем статистику

# 127.0.0.1 – Munin-сервер также снимает статистику с себя.

[lb01.kamaok.org.ua]

address 127.0.0.1

use_node_name yes

[lb02.kamaok.org.ua]

address 192.168.1.62

use_node_name yes

[app01.kamaok.org.ua]

address 192.168.1.63

use_node_name yes

[app02.kamaok.org.ua]

address 192.168.1.64

use_node_name yes

Логи для munin-сервера смотрим в

# tail -f /var/log/munin/munin-update.log

1	# tail -f /var/log/munin/munin-update.log

Проверяем наличие задания в крон,которое автоматически добавляется при установке munin-сервера

# cat /etc/cron.d/munin

1	# cat /etc/cron.d/munin

MAILTO=root
*/5 * * * *     munin test -x /usr/bin/munin-cron && /usr/bin/munin-cron

1 2	MAILTO=root /5 * * * munin test -x /usr/bin/munin-cron && /usr/bin/munin-cron

Проверка работы munin-сервера

# su -m munin  -c /usr/bin/munin-cron

1	# su -m munin -c /usr/bin/munin-cron

2.На клиентах, с которых будет сниматься статистика

# yum install munin-node

1	# yum install munin-node

# cat /etc/munin/munin-node.conf | grep -v '#' | grep -v '^$'

1	# cat /etc/munin/munin-node.conf \| grep -v '#' \| grep -v '^$'

log_level 4
log_file /var/log/munin-node/munin-node.log
pid_file /var/run/munin/munin-node.pid
background 1
setsid 1
user root
group root
ignore_file DEADJOE$
ignore_file \.bak$
ignore_file %$
ignore_file \.dpkg-(tmp|new|old|dist)$
ignore_file \.rpm(save|new)$
ignore_file \.pod$
allow ^127\.0\.0\.1$
allow ^::1$
allow ^192\.168\.1\.61$ # Ip-adress Munin-мастера, на котором смотрим всю статистику
host *
port 4949

log_level 4

log_file /var/log/munin-node/munin-node.log

pid_file /var/run/munin/munin-node.pid

background 1

setsid 1

user root

group root

ignore_file DEADJOE$

ignore_file \.bak$

ignore_file %$

ignore_file \.dpkg-(tmp|new|old|dist)$

ignore_file \.rpm(save|new)$

ignore_file \.pod$

allow ^127\.0\.0\.1$

allow ^::1$

allow ^192\.168\.1\.61$ # Ip-adress Munin-мастера, на котором смотрим всю статистику

host *

port 4949

# /etc/init.d/munin-node start

1	# /etc/init.d/munin-node start

# chkconfig --level 2345 munin-node on

1	# chkconfig --level 2345 munin-node on

[…]

Опубликовано в рубрике Centos, Monitoring

Метки: munin

Комментарии отключены

Архивы за месяц Февраль, 2014

Использование netstat

Установка и настройка Monit на Centos

Установка и настройка Munin на Centos

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель