1 Mar
2011
1 Mar
'11
4:58 p.m.
Hi all,
I have recently started receiving critical alerts from Nagios
regarding the ntp service on my 2 VPS. On both, ntpd is functioning
perfectly fine, and iptables has rules to allow traffic through on
port 123, but /etc/ntp.conf contains:
# and admin.curacao.bitfolk.com (nagios)
restrict 212.13.194.71
It looks like the recent scheduled maintenance work caused the IP of
admin.curacao.bitfolk.com to change, although I see that
nagios.bitfolk.com still points to the old IP. Assuming that my
diagnosis is correct, would it be possible to update the entry for
nagios.bitfolk.com so that our ntp.conf files can refer to
nagios.bitfolk.com rather than a hard-coded IP to prevent future
reoccurrences?
On a related note, is the nagios service is set up to check UDP or TCP
or both?
Thanks!
Adam
1 Mar
1 Mar
6:27 p.m.
Hi Adam,
On Tue, Mar 01, 2011 at 11:58:54AM -0500, Adam Spiers wrote:
I have recently started receiving critical alerts from
Nagios
regarding the ntp service on my 2 VPS. On both, ntpd is functioning
perfectly fine, and iptables has rules to allow traffic through on
port 123, but /etc/ntp.conf contains:
# and admin.curacao.bitfolk.com (nagios)
restrict 212.13.194.71
You will need to allow monitoring access from the following IPs:
http://bitfolk.com/customer_information.html#toc_3_Which_IP_addresses_will_…
At some point 212.13.194.71 will be dropped from this list, and I
will post an announcement nearer to the time this is to happen.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
6:42 p.m.
On 1 March 2011 13:27, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Adam,
On Tue, Mar 01, 2011 at 11:58:54AM -0500, Adam Spiers wrote:
Thanks - not sure how I missed these when reading that page. Are
there corresponding DNS entries? And is the NTP probe TCP or UDP?
I have recently started receiving critical alerts
from Nagios
regarding the ntp service on my 2 VPS. On both, ntpd is functioning
perfectly fine, and iptables has rules to allow traffic through on
port 123, but /etc/ntp.conf contains:
# and admin.curacao.bitfolk.com (nagios)
restrict 212.13.194.71
You will need to allow monitoring access from the following IPs:
http://bitfolk.com/customer_information.html#toc_3_Which_IP_addresses_will_…
2 Mar
2 Mar
1:20 a.m.
Hi Adam,
On Tue, Mar 01, 2011 at 01:42:06PM -0500, Adam Spiers wrote:
Are there corresponding DNS entries?
There aren't yet because I haven't actually deployed any other
monitoring nodes, and I'm not 100% sure how I'm going to do it. I
just know that we need to have more than one because:
- It's starting to get to the point where one host can't do every
check in a timely manner, and;
- If that one host is down there is no monitoring[1], which is less
than ideal
Also because at some point everything needs to renumber into
85.119.80.0/21 so might as well start with infrastructure.
If it helps, the intention is for 85.119.80.0/24 to only have
BitFolk infrastructure in it, not any customer-controlled stuff.
And is the NTP probe TCP or UDP?
Sorry, meant to answer that before.. AFAIK ntpd uses only 123/UDP
however /etc/services reserves both UDP and TCP for this protocol.
Personally I only open 123/UDP for this.
Cheers,
Andy
[1] There are other, remote hosts that check if the main nagios host
is up and working, but that's all they check
--
http://bitfolk.com/ -- No-nonsense VPS hosting
You dont have to be illiterate to use the Internet, but it help's.
-- Mike Bristow
4:08 p.m.
On 1 March 2011 20:20, Andy Smith <andy(a)bitfolk.com> wrote:
Gotcha, thanks.
Hi Adam,
On Tue, Mar 01, 2011 at 01:42:06PM -0500, Adam Spiers wrote:
Makes sense, although I still think it would be helpful to have
DNS entries for those IPs, e.g. monitor{1,2,3}.bitfolk.com.
Are there corresponding DNS entries?
There aren't yet because I haven't actually deployed any other
monitoring nodes, and I'm not 100% sure how I'm going to do it. I
just know that we need to have more than one because:
- It's starting to get to the point where one host can't do every
check in a timely manner, and;
- If that one host is down there is no monitoring[1], which is less
than ideal
Also because at some point everything needs to renumber into
85.119.80.0/21 so might as well start with infrastructure. If it helps, the intention is for 85.119.80.0/24 to
only have
BitFolk infrastructure in it, not any customer-controlled stuff.
Yeah thanks.
And is the NTP
probe TCP or UDP?
Sorry, meant to answer that before.. AFAIK ntpd uses only 123/UDP
however /etc/services reserves both UDP and TCP for this protocol.
Personally I only open 123/UDP for this.
3 Mar
3 Mar
10:31 a.m.
Hi Adam,
On Wed, Mar 02, 2011 at 11:08:18AM -0500, Adam Spiers wrote:
On 1 March 2011 20:20, Andy Smith
<andy(a)bitfolk.com> wrote:
Fair enough. I can't do it for 85.119.80.244 / 212.13.194.71 because
the version of Nagios currently in use can't be told to use a
specific IP address, so it just uses the main IP of the host (which
is what that IP is), and it's a multi-purpose host[1].
Additional hosts will be solely for monitoring so that problem won't
exist, and I'll retire 85.119.80.244 from monitoring then.
I've added sensible reverse DNS for the other IP ahead of time
although nobody should see anything from it yet.
Cheers,
Andy
[1] This was a massive but very old mistake from about 2005. I
learnt very soon afterwards to use service IPs not main host IPs
on any host that had a chance of becoming multi-purpose, but by
then it was too late for 212.13.194.71.
--
http://bitfolk.com/ -- No-nonsense VPS hosting
"It is I, Simon Quinlank. The chief conductor on the bus that is called
hobby." -- Simon Quinlank
On Tue, Mar 01, 2011 at 01:42:06PM -0500, Adam
Spiers wrote:
Makes sense, although I still think it would be helpful to have
DNS entries for those IPs, e.g. monitor{1,2,3}.bitfolk.com. Are there corresponding DNS entries?
There aren't yet because I haven't actually deployed any other
monitoring nodes, and I'm not 100% sure how I'm going to do it. I
just know that we need to have more than one because:
- It's starting to get to the point where one host can't do every
check in a timely manner, and;
- If that one host is down there is no monitoring[1], which is less
than ideal
Also because at some point everything needs to renumber into
85.119.80.0/21 so might as well start with infrastructure.
5042
days inactive
5044
days old
5 comments
2 participants
participants (2)
-
Adam Spiers -
Andy Smith