For some reason when I started using Network Security Toolkit v2.13.0 (NST) [Fedora 13] for its NTop 4.0.3 installation the service would crash due to apparent "kernel: device eth0 entered promiscuous mode". I am guessing this is due to my virtualization environment an the host hardware/configuration more than NTop application. However, I have heard others on the Ntop mailing list speak of the same error.
So a light bulb went off and I decided to look into service monitoring tools or scripts that would restart a service if it crashed. I found Monit (GNU General Public License v3).
I have had it installed for only a day so far but ntop has stayed alive for me. So far so good. below are the steps I did to install it. Some might find the ntop config for the Services section useful. I am not an expert in Monit so I am sure there may better configurations for ntop then the one I have below. Feel free to share yours so we can see.
1) Install Monit
fedora: # yum monit
debian: # sudo apt-get install monit
2) Next, edit the config file
/etc/monit/monitrc
on Fedora
/etc/monit.conf
--------------------------------
### Monit control file /etc/monit.conf
set daemon 120 # Poll in 2-minute intervals
set logfile syslog facility LOG_daemon # Default facility is LOG_USER
set mailserver mail.foo.bar # Default smtp server is localhost
set alert sysadm@foo.bar # Alert system admin on any event
set httpd port 2812 address localhost
allow localhost
allow admin:monit
## Services
### NTOP on NST 2.13.0 ###
check process ntop with pidfile /var/run/ntop.pid
start program = "/etc/init.d/ntop start" with timeout 60 seconds
stop program = "/etc/init.d/ntop stop"
if failed port 3000
with timeout 15 seconds
then restart
if 3 restarts within 5 cycles then timeout
group server
--------------------------------
3) Save the monit.conf file
4) Now check the syntax with:
moint -t
(fix the syntax if you need to)
http://mmonit.com/monit/documentation/monit.html
5) Make sure Ntop is running (ports 3000 and 3001 for my installation); I use
# nmap localhost
6) Start Monit
# /etc/init.d/monit start
7) Login into the web admin http://localhost:2812
with u:admin p:monit as configured in the monit.conf
8) Enable monitoring of ntp by clicking on 'ntop' or navigate to
http://localhost:2812/ntop
on the bottom of the page click the "Enable monitoring" button.
It will take some time but the "Monitoring status" go into "monitored" mode.
You don't need access to monit web interface for start service monitoring.
ReplyDeleteWith monit start ntop is enough
This comment has been removed by the author.
ReplyDelete