Install Monit in CentOS Linux for Monitoring

Monit is an open source utility for managing and monitoring, processes, files, directories and filesystems on a UNIX system. Monit conducts automatic maintenance and repair and can execute meaningful causal actions in error situations. However, you are the master and monit would only do what you define in the config file for it to do. We will discuss here how to install and configure a basic monit installation in Centos or Redhat Linux.


Monit can start a process if it does not run, restart a process if it does not respond and stop a process if it uses too much resources. You can use Monit to monitor files, directories and filesystems for changes, such as timestamp changes, checksum changes or size changes. You can also monitor remote hosts; Monit can ping a remote host and can check TCP/IP port connections and server protocols. Monit is controlled via an easy to use control file based on a free-format, token-oriented syntax. Monit logs to syslog or to its own log file and notifies you about error conditions and recovery status via customizable alert. For more infop on monit you can visit their official site http://mmonit.com/monit/

Install Monit

The first, you need to enable EPEL (Extra Packages for Enterprise Linux) to install monit package. Login as root and type the following command:

[root@superman ~]# vi /etc/yum.repos.d/epel.repo

Add or uncomment the following content at end of the file

[epel] 

name=Extra Packages for Enterprise Linux 5 - $basearch 

mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?

repo=epel-5&arch=$basearch

failovermethod=priority 

enabled=1 

gpgcheck=0

Save and close the file. And type the following command

[root@superman ~]# yum clean all

To install monit, type the following command

[root@superman ~]# yum install monit

Turn on monit when system start up

[root@superman ~]# chkconfig --levels 235 monit on

Configure Monit

The configuration file of monit in Centos or RedHat is /etc/monit.conf. Type the following command to edit

[root@superman ~]# vi /etc/monit.conf

Sampe configuration file

set daemon 60 

set logfile /var/log/monit.log 

set mailserver localhost 

set mail-format { from: alert@domain.com 

subject: $SERVICE $EVENT at $DATE 

message: Monit $ACTION $SERVICE at $DATE on $HOST: $DESCRIPTION.  } 

set alert admin@domain.com  include /etc/monit.d/*

Now to monitor Apache, create a file /etc/monit.d/httpd, enter

[root@superman ~]# vi /etc/monit.d/httpd

Add following content

check process httpd with pidfile /var/run/httpd.pid 

group apache  start program = "/etc/init.d/httpd start" 

stop program = "/etc/init.d/httpd stop"  if failed host 127.0.0.1 port 80 

protocol http then restart  if 5 restarts within 5 cycles then timeout

MySQL server restart configuration directives

check process mysqld with pidfile /var/run/mysqld/mysqld.pid 

group mysql  start program = "/etc/init.d/mysqld start" 

stop program = "/etc/init.d/mysqld stop"  if failed host 127.0.0.1 port 3306 

then restart  if 5 restarts within 5 cycles then timeout

SSH server configuration directives

check process sshd with pidfile /var/run/sshd.pid  start program "/etc/init.d/sshd start"  stop program "/etc/init.d/sshd stop"  if failed host 127.0.0.1 port 22 protocol ssh then restart  if 5 restarts within 5 cycles then timeout

Setup Monit Mail Alerts via SMTP: 

 set mailserver mail.yoursmtp.com, mail.foo.bar port 25 

 username "superman" password "binpip" using tlsv1, localhost 

 with timeout 15 seconds

Type the following command to start monit

[root@superman ~]# /etc/init.d/monit start

You can verify that monit is started from /var/log/monit.log log file:

[root@superman ~]# tail -f /var/log/monit.log  

Sample ouputs:

[IST June 17 14:51:18] info     : 'system_server2.domain.com' Monit started

To understand Monit config file better follow this link : http://mmonit.com/monit/documentation/monit.html
  
Do share your comments below.

 

Installing HAProxy Loadbalancer in CentOS, Redhat or Ubuntu

HAProxy is fast evolving as a dependable Loadbalancing solution. Here I have outlined the steps to install HAProxy to build your own software load balancer.

Installing HAProxy
For most distributions you can install haproxy using your distribution's package manager.  For example, to install on Debian or Ubuntu, run:

sudo aptitude install haproxy

CentOS 5
We will need to set up access to the EPEL software repository to download haproxy on CentOS 5.  Run the commands:

[root@LB01 ~]# rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
[root@LB01 ~]# yum -y install haproxy

CentOS 6
We will need to set up access to the EPEL software repository to download haproxy on CentOS 6, but the address for the RPM is different from CentOS 5.  Run the commands:

[root@LB01 ~]# rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-6.noarch.rpm
[root@LB01 ~]# yum -y install haproxy

Install a base config
Once installed backup the HAProxy config file and download the managed cloud config:

[root@LB01 ~]# cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bak
[root@LB01 ~]# wget http://c818095.r95.cf2.rackcdn.com/haproxy.cfg -O /etc/haproxy/haproxy.cfg
chkconfig haproxy on

Configuring HAProxy

Configuring HAProxy can only come after you have your web heads configured as you will need to utilize their 10.x service net IP address's. The reason we use the service net is because the customer will not be charged for bandwidth overage, and the service net is also faster in terms of throughput as shown in the chart at the top.

Editing /etc/haproxy/haproxy.cfg - There are a number of items that need to be changed in order to get HAProxy functional. These will be outlined below. Keep in mind you need to edit these values to reflect the server's IP's.

First and foremost change

listen webfarm 0.0.0.0:80
to

listen webfarm 127.0.0.1:80
Edit 127.0.0.1 to reflect your server's eth0 or public IP.

Now you can add your web servers. In the following you will want to replace the 10.0.0.X IP address with that of the eth1 or private IP address of web servers"

   server WWW1 10.0.0.1:80 check # Active in rotation
   server WWW2 10.0.0.2:80 check # Active in rotation
   server WWW3 10.0.0.3:80 check # Active in rotation
   server WWW4 10.0.0.4:80 check backup # Not active "sorry server" - this one comes live if all web heads are  down

Above is an example of what a four server config would look like. Once you have completed this portion you can then start HAProxy and start serving pages(assuming your web servers are ready).

service haproxy start

Below is the default configuration template for haproxy.cfg:

   #global options
   global
      
       #logging is designed to work with syslog facility's due to chrooted environment
       #log loghost    local0 info - By default this is commented out
      
       #chroot directory
       chroot /usr/share/haproxy
      
       #user/group id
       uid 99
       gid 99
      
       #running mode
       daemon
   defaults
      
       #HTTP Log format
       mode http
       #number of connection retries for the session
       retries 3
      
       #try another webhead if retry fails
       option redispatch
       #session settings - max connections, and session timeout values
       maxconn 10000
       contimeout 10000
       clitimeout 50000
       srvtimeout 50000
   #Define your farm
   #listen webfarm 0.0.0.0:80 - Pass only HTTP traffic and bind to port 80
   listen webfarm 0.0.0.0:80
      
       #HTTP Log format
       mode http
       #stats uri /haproxy - results in http://<load balancer ip>/haproxy (shows load balancer stats)
       stats uri /haproxy
       #balance roundrobin - Typical Round Robin
       #balance leastconn - Least Connections
       #balance static-rr - Static Round Robin - Same as round robin, but weights have no effect
       balance roundrobin
       #cookie <COOKIENAME> prefix - Used for cookie-based persistence
       cookie webpool insert
       #option httpclose - http connection closing
       option  httpclose
       #option forwardfor - best stated as "Enable insertion of the X-Forwarded-For header to requests sent to the web heads" aka send EU IP
       option forwardfor
          
       #Web Heads (Examples)
       #server WEB1 10.0.0.1:80 check - passes http traffic to this server and checks if its alive
       #server WEB1 10.0.0.1:80 check port 81 - same as above but checks port 81 to see if its alive (helps to remove servers from rotation)
       #server WEB1 10.0.0.1:80 check port 81 weight 100 - same as the above with weight specification (weights 1-256 / higher number higher weight)
       #server WEB1 10.0.0.1:80 check backup - defines this server as a backup for the other web heads
       #Working Example: *USE THIS HOSTNAME FORMAT*
       server WWW1 10.0.0.1:80 cookie webpool_WWW1 check port 81 # Active in rotation   
       server WWW2 10.0.0.2:80 cookie webpool_WWW2 check port 81 # Active in rotation
       server WWW3 10.0.0.3:80 check # Active in rotation
       server WWW4 10.0.0.4:80 check backup # Not active "sorry server" - this one comes live if all web heads are down
   #SSL farm example
   #listen https 0.0.0.0:443
   #    mode tcp
   #    server WEB1 10.0.0.1:443 check

Session Persistence with SSL

If the you wish to also balance SSL traffic, you will need to set the balance mode to "source" This setting takes a hash of the client's IP address and the number of servers in rotation, sending traffic from one IP address to the same web server consistently. The persistence will be reset if the number of servers is changed.:

listen https 0.0.0.0:443
mode tcp
balance source
server WEB1 10.0.0.1:443 check
 

Postfix as SMTP Relay

If you need to install Postfix and use it as a SMTP relay, you can follow these steps below:
Install Postfix and cyrus-sasl with your application manager of choice. If you're compiling from source, be sure to make Postfix with the -DUSE_SASL_AUTH flag for SASL support and -DUSE_TLS for TLS support.

$ yum install postfix cyrus-sasl

Stop the sendmail service

$ /etc/init.d/sendmail stop

Remove sendmail from the startup runlevels

$ chkconfig --del sendmail

Configre the Postfix as I have mentioned here:
Edit /etc/postfix/main.cf

# Set this to your server's fully qualified domain name.

# If you don't have a internet domain name,

# use the default or your email addy's domain - it'll keep

# postfix from generating warnings all the time in the logs

mydomain = local.domain

myhostname = host.local.domain

# Set this to your email provider's smtp server.

# A lot of ISP's (ie. Cox) block the default port 25

# for home users to prevent spamming.  So we'll use port 80

relayhost = yourisp.smtp.servername:80

smtpd_sasl_auth_enable = yes

smtpd_sasl_path = smtpd

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

smtp_sasl_type = cyrus

smtp_sasl_auth_enable = yes

# optional: necessary if email provider uses load balancing and

# forwards emails to another smtp server

# for delivery (ie: smtp.yahoo.com --> smtp.phx.1.yahoo.com)

smtp_cname_overrides_servername = no

# optional: necessary if email provider

# requires passwords sent in clear text

smtp_sasl_security_options = noanonymous

There's roughly a 99.9% chance that your email provider's SMTP server requires authentication. We need to set that up with the username and password given by your email provider.
Add the following line to /etc/postfix/sasl_passwd

yourisp.smtp.servername:80 username:password

The above server hostname and port must exactly match the value for "relayhost" in /etc/postfix/main.cf.
Generate a postfix lookup table from the previous file

$ postmap hash:/etc/postfix/sasl_passwd

Test the lookup table, if all is good then the following will return the specified username:password

$ postmap -q yourisp.smtp.servername:80 /etc/postfix/sasl_passwd

Make sure the sasl_passwd and sasl_passwd.db files are readable/writable only by root

$ chmod 600 /etc/postfix/sasl_passwd

$ chmod 600 /etc/postfix/sasl_passwd.db

Add postfix to be started at boot

$ chkconfig --add postfix

Fire up Postfix

$ /etc/init.d/postfix start

Test it out using sendmail alias from the command prompt

$ sendmail email@example.com

Postfix is good to go.


--The Below Steps are specifics. Please ignore if nor required.--

If you're attempting to relay mail using Gmail, then it will be necessary to use TLS with Postfix. You'll have to point Postfix at your server's trusted CA root certificate bundle. If that is the case then read below or else ignore.
First, double-check that Postfix was configured with SSL support (ie. ldd should return at least one line starting with libssl):

$ whereis -b postfix

postfix: /usr/sbin/postfix /etc/postfix /usr/libexec/postfix

$ ldd /usr/sbin/postfix

...

libssl.so.6 => /lib/libssl.so.6 (0x00111000)

...

Now we need to find your server's CA root certificate bundle, which is typically distributed with openssl. The bundle file is used by Postfix to verify Gmail's SSL certificate (signed by Thawte). On my CentOS server, this file was located at /etc/pki/tls/certs/ca-bundle.crt, but may be in a different location on your box (ie. /etc/ssl/certs).

$ locate ca-bundle.crt

/etc/pki/tls/certs/ca-bundle.crt

Edit /etc/postfix/main.cf with the following values:

relayhost = smtp.gmail.com:587

# your FQDN, or default value below

mydomain = local.domain

# your local machine name, or default value below

myhostname = host.local.domain

myorigin = $myhostname

# SASL

smtpd_sasl_path = smtpd

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

smtp_sasl_type = cyrus

smtp_sasl_auth_enable = yes

smtp_sasl_security_options = noanonymous

# TLS

smtp_sasl_tls_security_options = noanonymous

smtp_use_tls  = yes

smtp_tls_CAfile = /path/to/your/ca-bundle.crt

smtp_sasl_tls_security_options = noanonymous

If you haven't already, add the following to /etc/postfix/sasl_passwd

smtp.gmail.com:587 username:password

Generate a postfix lookup table from the previous file

$ postmap hash:/etc/postfix/sasl_passwd

Make sure the sasl_passwd and sasl_passwd.db files are readable/writable only by root

$ chmod 600 /etc/postfix/sasl_passwd

$ chmod 600 /etc/postfix/sasl_passwd.db

Restart postfix and send a test email

$ postfix reload

$ sendmail email@example.com

Test relay thru Gmail


If you need to do some debugging please read below or ignore:

Monitor postfix mail log in a separate session with the following command

$ tail -f /var/log/maillog

If the log is displaying the following error

(Authentication failed: cannot SASL authenticate to server ...: no mechanism available)

then set this variable in /etc/postfix/main.cf

smtp_sasl_security_options = noanonymous

If the log is displaying this error

553 Sorry, that domain isn't in my list of allowed rcpthosts. (in reply to RCPT TO command)

check your username and password in /etc/postfix/sasl_passwd. Your user name is usually your full email address. If you have to fix it, don't forget to use postmap to generate a new lookup table.