First steps with Monit

After sucessfully installed monit, the next step is coming close to it. You should getting familiar with some things related to monit.

1. How to start and stop monit

To start monit, you just have to type:

# monit

And to stop it:

# monit quit

2. monit configuration file

As the same with many services on Linux, monit operation is controlled by a configuration file. This file named: monitrc and have a sample file right in the extracted folder you configured. monit will try to search and use this file in priority order:

1. ~/.monitrc
2.  /etc/monitrc (Debian based)
3. $sysconfdir/monitrc ( $sysconfdir is examined while configured as ./configure --sysconfdir)
4. ./monitrc

This file is devided into 2 main parts: global part and service part.

• Global part is place where you control everything about monit. monit will see and execute this part first to set appropriate configurations. The global set entry starts with keyword set and the item to configure. 

• Service part is where you put your services under controlled by monit. Service entry starts with keyword check followed by  the service type to monitor.

3. Logging

An important part is monitoring monit, this should be the very first step to work with every service you attempt to control. With monit, you just have to make a set statement in monitrc file. Using this set statement:

set logfile [path/to/logfile]

4. monit httpd

monit allows us to control it via web interface with a tiny web service running at (default) port 2812. You can then determine any unused port you want. To enable this function, using a global set statement in monitrc file:

set httpd port 2812

After enabling web service for monit, you can access monit via the URL:

http://localhost:2812

You can permit monit using ssl with this tiny web service if you compiled monit with ssl supported, the steps as follow:
Generate a self-signed ceritificate: (You must have openssl installed or something providing the similar functioning. )

• +Export environment variable for OpenSSL

• #export OPENSSL_CONF=/etc/ssl/openssl.cnf (default path in Debian)

• +Generate  private key and certificate

• #openssl req -new -x509 -days 365 -nodes -out /opt/monit/monit.pem -keyout /opt/monit/monit.pem
•  using $man openssl for more details about options

• +Generate Diffie-Hellman parameters

• #openssl gendh 512 >> /opt/monit/monit.pem 

• +Change mod for .pem file to 0700

• #chmod 0700 /opt/monit/monit.pem

After configuring self-signed certificate for monit web service, go to monitrc file and indicate monit to use SSL connection:

set httpd port 2812
    ssl enable
    pemfile /opt/monit/monit.pem

To this time, my monitrc file contains:

set httpd port 2812 and

        use address 192.168.56.101 # accept connection from remote host
        ssl enable
        pemfile         /opt/monit/monit.pem
        allow admin:monit      # require user 'admin' with password 'monit'
## Enbale logging
set logfile /var/log/monit.log

OK, bring up the browser, access to monit web service, using username/password: admin/monit

Monit - Installation issues

Today, I started installing and using Monit   on Debian Squeeze system. Actually, this is the second time I use Debian system (the first time when I decided to switch to Debian from a long time using Fedora), so there are some issues I met when installing Monit.

1. Repositories
• I'm using these repos for testing server:
• deb http://security.debian.org/ squeeze/updates main contrib
• deb-src http://security.debian.org/ squeeze/updates main contrib
• deb http://ftp.debian.org/debian/ squeeze-updates main contrib non-free
• deb http://ftp.jp.debian.org/debian/ squeeze-updates main contrib non-free
• deb-src http://ftp.jp.debian.org/debian/ squeeze-updates main contrib non-free
• deb http://ftp.jp.debian.org/debian squeeze main
2.  Dependencies
• When building monit from source file, it requires you to install PAM and SSL libraries to support its functions.  If you don't want to install these functions, you can skip them from installing by specify appropriate options when configure. Executing ./configure -h for more details.
• In this case, I want to install both PAM and SSL, the packages needed are: libssl-dev and libpam0g-dev

OK, if you can install it successfully, something like this will appear:

BGP terminologies - Part 1

1. BGP neighborship states

Before a BGP peer forming neighborship with a remote BGP peer, it must pass through several states:

• Idle
• Connect
• Active
• OpenSent
• OpenConfirm
• Established

 Before enabling BGP process, both R1 and R2 in Idle state and ignore all incoming requests. When R1 enables BGP process, it sends TCP request to R2 and waits for reply. At this time, R1 goes to Connect state. If connection establishes, R1 will send an Open message to R2 and goes to OpenSent state. If fails, R1 transitions to Active state.
To view the state of local router, use command:

In Active state, R1 is trying to send TCP request to R2, if connection establishes successfully, R1 will send Open message and transitions to OpenSent state.

When R1 reaches OpenSent state, it will send to R2 Open message, if valid Open message received, Keepalive message will be sent to negotiate session parameters and R1 goes to OpenConfirm state.
In OpenConfirm state, R1 keeps sending Keepalive message, and when it received Keepalive from R2, final state Established reached.

2. BGP Attributes

BGP choose route highily based on the values of path attributes. This post considers some well-known attributes which router must regconize.

• Origin: this attribute states out the originally of route, maybe the route from IGP - i, or EGP - e, or undetermined - ?. i < e < ? and lower value is prefered.

• AS Path: lists all traversed AS, used to choose the best route and prevents routing loop. This value is only changed when advertised through eBGP. 
• Next hop: next hop address, only modified when received from an eBGP peer. Must appear in routing table.

• Multiple Exit Discriminator (MED): optional, nontransitive, eBGP advertises to iBGPs to help choosing route when multiple routes exist. iBGP does not readvertise to eBGP.

• Local Preference: locally value, never advertised to eBGP. This value is used to consider routes in the same AS. Higher value is prefered.

3. Route selection process

The route selection process depends on each vendor. For Cisco, it is:

• Weight - highest (Cisco proprietary)
• Local preference - highest
• locally originated
• AS Path - shortest
• Origin (i
• MED - lowest
• eBGP>iBGP
• IGP metric - lowest
• oldest route
• neighbor with lowest RID
• neighbor with lowest IP address.

For Juniper:

• Highest Local preference
• AS Path - shortest
• Origin - smallest
• MED - smallest
• eBGP > iBGP
• IGP metric - smallest

Policy-Based Routing

1. Introduction to PBR

PBR is a tool provides a way to change the normal processing of packet routing function. After checking frame from errors, PBR intercepts packet before router performs routing decision. Some benifits when implementing PBR:

• Transit packets based on source informations: dealing with packets from various sources.
• QoS: setting precedence or TOS value in IP packet header.
• Cost saving: manual distribute traffic over low-bandwidth, low-cost links
• Load sharing: distribute traffic over multiple paths.

2. How PRB works

PRB decides how to forward packets by refering to route map for matching logic. The steps as following:

• Create a route map for matching criterias to choose the route.
• Enable route map to use in PBR, apply to incoming interface.

Route map definition was covered about in previous post plus a set condition with next-hop attribute. The ACLs used in route map can be standard or extended ACL, that means, we can define various requirements: source/dest address or both, TCP/UDP port number, ...

3. PBR configurations

Requirement: Direct traffic from R5 goes through R2, traffic from R6 goes through R3 to reach R4.

Before applying PBR, traffic from R5, R6 destine to R4 both via 10.0.0.2 (R2).

R6#trace 12.0.0.3

Type escape sequence to abort.
Tracing the route to 12.0.0.3

  1 172.16.1.3 32 msec 20 msec 24 msec
  2 10.0.0.2 40 msec 40 msec 40 msec
  3 12.0.0.3 60 msec *  60 msec

 R5#trace 12.0.0.3

Type escape sequence to abort.
Tracing the route to 12.0.0.3

  1 172.16.1.3 32 msec 20 msec 20 msec
  2 10.0.0.2 40 msec 44 msec 40 msec
  3 12.0.0.3 60 msec *  48 msec

 Define an extended ACL to match traffic from each host:

R1#show run | section access-list
access-list 101 permit ip host 172.16.1.1 host 12.0.0.3
access-list 102 permit ip host 172.16.1.2 host 12.0.0.3

Create a route-map for matched traffic and control direction of packets:

R1#show run | section route-map
route-map PBR permit 10
 match ip address 101
 set ip next-hop 10.0.0.2
route-map PBR permit 20
 match ip address 102
 set ip next-hop 11.0.0.2
 

 Apply route-map to interface:

R1#show run | section Ethernet0/0
interface Ethernet0/0
 ip address 172.16.1.3 255.255.255.0
 ip policy route-map PBR
 half-duplex

 Verifying traffic from R5 and R6:

R5#trace 12.0.0.3

Type escape sequence to abort.
Tracing the route to 12.0.0.3

  1 172.16.1.3 20 msec 12 msec 12 msec
  2 10.0.0.2 40 msec 56 msec 44 msec
  3 12.0.0.3 72 msec *  56 msec

R6#trace 12.0.0.3

Type escape sequence to abort.
Tracing the route to 12.0.0.3

  1 172.16.1.3 24 msec 16 msec 20 msec
  2 11.0.0.2 28 msec 44 msec 40 msec
  3 12.0.0.3 60 msec *  72 msec

 The set command can use "default" keyword to add more functions. With this command, there are two cases could be happen:

• Omitting this parameter: " try PBR first, of PBR's route does not work, using routing table."
• Including this parameter: " try routing table first, if routing table fails, use PBR."

Above example is just one of many ways using PBR, you can adjust requirements by mixing some tools together to achieve your goal.