Nagios and Cloud Computing

Presentation by William Leibzon (william@leibzon.org)

Thanks for being here!

Nagios

Nagios 2011 Conference in Saint Paul, Minnesota

Cloud Computing

What is Cloud Computing?

Virtualized systems independent of hardware and leased to various customers in what is referred to as Infrastructure as a Service

Image courtesy of thetechlabs.com

Virtualization andCloud Computing

Virtualization Separates Hardware from User Software - either

one can be upgraded independent of the other Efficient use of modern multi-core processors Micro-Kernel design is simpler, easier to support

More Servers with Less Hardware Unused system resources can be utilized in other

types of servers with different resource usage Less energy, more power efficient use of resources Less rack space in expensive datacenters

Virtualization is the core of Cloud Computing

Cloud Computing Architecture

Virtualized Systems in a Cloud Can be managed entirely remotely Can move (even live) from one hardware to another Can be shutdown, saved to disk and started again

when required Can be easily cloned to have another alike system

started exactly when it is needed

Cloud allows to automate scaling up of infrastructure to handle peak traffic load while scaling down after to keep overall cost low

This requires monitoring of all system resources !

Cloud Solutions and Vendors Hypervisors (Viritualization Kernels):

Commercial: VMware ESX, IBM Z/VM, Microsoft VirtualPC Open-Source: Xen, KVM, OpenVZ, Quemu, VirtualBox

Xen originally implimented paravirtualization, which required modified OS and limited it to Linux. KVM and new Xen-HVM can do full virtualization, but require Quemu and CPU virtualization extensions (Intel's VT or AMD's SVM)

Virtualization and Cloud Software Suites

Commercial: VMware vCloud, Microsoft Azure Open-Source: Eucalyptus, OpenNebula, OpenStack, Baracus Commercial based on Open-Source: Citrix XenServer, Oracle VM,

Ubuntu Enterprise Cloud, Redhat CloudForms, Parallels Virtuozzo Cloud Infrastructure providers

Amazon EC2 (modified Xen), Rackspace (Xen), Linode (Xen), Savvis (Vmware), many many more...

Open-Source Cloud Software

Open-Source Hypervisors used in Cloud Systems Xen - http://www.xen.org/ KVM - http://www.linux-kvm.org/ OpenVZ - http://www.openvz.org/

Open-Source Cloud Management Software Eucalyptus - http://open.eucalyptus.com/ OpenNebula - http://www.opennebula.org/ OpenStack – http://www.openstack.org/ Baracus – http://baracus-project.org/ Proxmox - http://pve.proxmox.com/

Monitoring for the Cloud

Monitoring of hardware (host OS) & hypervisor More static, hardware does not change as often Monitoring of system resources often integrated into

virtualizer and info not available to cloud customer

Monitoring of virtual systems Dynamic, should be able to handle addition and

removal of server instances Focus on application and network performance Ideally should monitor utilization and be able to

launch new server instances (auto-scaling) Monitoring system should itself be robust and

handle more servers without impacting performance

Cloud Monitoring Architecture

Horizontal ScalingClouds can be as small as 10 servers and as as large as 10,000+. When developing architecture, you need to support its future growth from the start.

Scaling on DemandA pro-active system should handle big changes in the number of cloud instances. You may have 2 webserver instances at 6am and grow to 20 at 10pm.

High AvailabilityGood system design should be fully fault-tolerant and application as a whole should continue to function without interruption if any one server instance dies

This means cluster !!!

Nagios Cluster Options

The base nagios-core package is for stand-alone monitoring where server does all service checks.

It can be extended to Nagios Cluster with : Passive Service Checks (Classic Distributed Model)

”Old Way” - NCSA used to forward results of checks from client servers to main nagios server, not robust

Shared database (Central Dashboard Model)

NDO-Mod and Merlin projects implement this with a combination of NEB modules, daemon & database

Worker Nodes (Load Balancing of Checks)

DNX and Mod-Gearman do it with combination of loaded NEB module, server daemon & client servers

Passive Service Checks How

- One central server with all services, it does not do any checks listing them all passive

- Separate client nagios servers run plugins and do checks for specific sets of hosts, each has its own subset of full nagios config

- Scripts are setup that capture results from each client host and send them to central server using NSCA, it puts them into nagios command queue

Advantages

This will work with any nagios server, organizations have been doing it from at least 2002

DisadvantagesNagiosClientServer

NagiosClientServer Requires a lot of custom scripting to organize nagios

configs. Not reliable if server dies. Not robust to automate cloud instances being added and deleted

NCSA NCSA

DNX and Mod-GearmanWorker Nodes

How

- Similarly to Passive Service Checks, there is a central Nagios Server, it does not execute any plugins.

- Unlike with Passive Checks, nagios does schedule checks. Thereafter NEB module takes over.

- Module passes information on which plugin(s) to run to DNX server (or Gearman server for Mod-Gearman) which manages worker nodes.

- Worker nodes are separate servers, each has special worker daemon running. The daemon communicates with management server and gets information (plugin command) on what to run. It then passes results back to management server and NEB module writes these results directly into nagios memory.

Advantages of DNX and Mod-Gearman Robust and Scalable

Checks are automatically distributed among all cluster worker nodes (round-robin on equal basis by default)

All worker nodes are essentially the same and there is no additional re-configuration necessary to add a new node

This fully achieves Horizontal Scaling of nagios checks

Easy to Use in a Cloud Environment As nodes are the same. Existing worker node can be

replicated with no special config to start it Adding node lets expand cluster on demand

Efficient Integration with Nagios Using NEB loaded modules achieves low-level integration

with nagios, much better than NCSA and command queue

Disadvantages ofDNX and Mod-Gearman Single Instance of Nagios Server

The solution has no direct disadvantages however it only achieves horizontal scaling of nagios checks.

This still relies on a single central nagios server to processes the results, send alerts and schedule new checks.

Does not achieve fault-tolerance If central nagios server dies entire system is out Author of this presentation does have a patch to

DNX that allows results to be multicast to multiple instances of a nagios servers (second one of them would be stand-by and not scheduling checks only receiving results). This is experimental.

DNX Architecture DNX Server and DNX Client (Worker) Daemons are

multi-threaded. Client thread model is controlled by these commands:

Communication between Server and Client using own UDP protocol passing XML packets.

Almost all communication is from client to server. Client contacts DNX server dispatcher port, receives list of checks to run, runs them and returns results on collector port

DNX Client can support having common checks built into client. check_nrpe was included before, but was pulled out of a package as it required nagios source.

#poolInitial = 20#poolMin = 20#poolMax = 100#poolGrow = 10

channelDispatcher = udp://10.1.1.1:12480channelCollector = udp://10.1.1.1:12481

DNX System Internals

DNX Server System Internals DNX Client (Worker Node)System Internals

DNX vs Mod-Gearman

Single package, no external dependencies. Includes all job cluster control components

Hard to maintain and test for non-Linux environment

Can use localCheckPattern in server configuration to direct jobs. But it is not documented

Supports nagios-2.x with a patch and nagios-3.x as is

Client can be extended with nagios- specific features. Planned are: - Embedded Perl, check_icmp, - check_snmp, check_nrpe

Mod-Gearman is built around Gearman Project

Better maintained since Gearman has many uses

Enjoys benefits of wider testing on new releases

Easy to configure and direct to separate queues depending on hostgroup & servicegroup

Only supports nagios 3.x

Supports eventhandlers and not just checks !

Nagios-only features are hard to add at node level

DNX Mod-Gearman

Combining Shared Databaseand Worker NodesNagios cluster options can be combined !

DNX or Mod-Gearman with Merlin or ADO are great fit :

- DNX offers horizontal scaling for all checks and relieaves Nagios of need to run them- Merlin provides horizontal scaling and failover for Nagios itself for infrastructure of thousands of hosts

Ideal Fully Fault-TolerantNagios Cluster Architecture

NagiosServer

Merlin/ADO DBMerlin/ADO DB

Backup

Replication

DB Proxy

NagiosWeb Interface

Server

Backup NagiosWeb Interface

Server

Standby DB Proxy

Worker Node Worker Node Worker Node Worker Node

BackupNagiosServer

Performance Data (RRD) Server

(like NagiosGrapher)udpecho

Backup Performance Data (RRD) Server

cross-monitor

Ideally you would have each of the above as a separate cloud server, but even those with 1000s of servers may find this hard to maintain

udp udp

heartbeat

Nagios Cloud Cluster with 4 hosts

Nagios Daemon

Apache

Mysql DB

Merlin

PNP w/ RRD

NPCD

DNX Server

DNX Client DNX Client

Nagios Daemon

Apache

Mysql DB

Merlin

PNP w/ RRD

NPCD

DNX Server

MAIN NAGIOS SERVER STANDBY NAGIOS SERVER

Standby Server has all checks disabled (except checking main nagios host)

Cross-monitor of other nagios does not use DNX cluster

If main server dies, backup takes over and registers itself in dynDNS server replacing primary.

DNX Clients use dynDNS address, they are restarted on server switch

replication

cross-monitor

Configuration of a cloud host

The best way to configure monitoring of cloud hosts with multiple instances is to have a template and define all services by hostgroups

Then starting new host of same type is just a matter of adding config like above but for w2, etc

One of the alternatives is to add a few extra hosts to nagios config and disable all service checks on those hosts, enabling them using script when server is launched

define host { use wprod-server <--- Template for all Webservers host_name w1 alias webserv1 <---- This is second way to search address w1.dynamic.cloud1.mydomain <---- Local DNS hostgroups production,loadbalanced,linux_centos5,webserv parents loadbalancer1,loadbalancer2 contact_groups admins }

Auto-Scaling Event handlers can be used or custom check. Trigger based on total number of open http sockets

(check_netstat, check_apache_status) from all servers Write custom script that keeps number of currently active

servers in DB or local file to set name of new server. Have new server name as a parameter for launching cloud

instance. Write startup scripts that use this to set hostname and register ip in local dynamic dns server.

For Amazon EC2, aws utility is very useful to automate launching of new servers. Get it at http://timkay.com/aws/

Extra nagios worker node is launched similarly and this is triggered when enough servers have been launched.Can also do it based on nagios stats (check_nagios)

Scale down after an hour or more of low resource usage,you can do it with a check that relies on RRD data

Use of SQL DB for Auto-ScalingThis is for illustration of logic only. Not real code.

CREATE TABLE ServerData ( id bigint(10) unsigned NOT NULL, name varchar(50) unsigned default NULL, connections bigint(20) unsigned default 0, started_on date default NULL, PRIMARY KEY(id));

After you got results of server check (like event handler that runs): UPDATE ServerData SET connections=<data from nagios check> WHERE name=<server host>

Custom check to see if new server should be started: $count=sqlexec("SELECT COUNT(id) FROM ServerData") $sumit=sqlexec("SELECT SUM(Connections) FROM ServerData") $lastlaunched=sqlexec("SELECT MAX(started_on) FROM ServerData") if $sumit/$count > $threshold && ($now-$lastlatched)<600 { <figure out the name and id> launch_new_server_instance($newname) sqlexec(”INSERT INTO ServerData VALUES ($newid, $newname,0,CURDATE())”) enable_nagios_service_checks($newname) }

Additional Cloud Monitoring Tips

Cloud Servers are not entirely independent, and other servers on same hardware server may effect yours

For Virtualized OS System load checks are less useful and can show ”false” spikes in load. Put larger emphasis on 15-minute load and do more checks before alerts are sent

But if you control the cloud, find way to get cloud hardware system load. Write check showing physical server name

For load issues rely more on a number of connections (TCP session) and time to process each request. Do prior tests on how many connections one server should handle

Remember, you can always just launch a new server Do not spend too much time investigating cause, take it

out of production first, replace, and investigate later

Nagios Cluster Software Nagios, NDO-Utils, NCSA – http://www.nagios.org/ DNX (Distributed Nagios eXecutor) -

http://dnx.sourceforge.net/ Mod-Gearman -

http://labs.consol.de/lang/de/nagios/mod-gearman/ Gearman - http://gearman.org/ Merlin (Module for Effortless Redundancy and

Loadbalancing by OP5) – http://www.op5.org/community/plugin-inventory/op5-projects/merlin

Check-Multisite (collect data from multiple servers) – http://www.my-plugin.de/check_multi/

Ganglia (open-source computing cluster monitoring, can be integrated with nagios) – http://www.ganglia.info

Demo & Questions

Questions ?

More Questions? Feedback? William Leibzon <william@leibzon.org>

My Nagios Page (mostly plugins) :

http://william.leibzon.org/nagios/