<style type="text/css">a[data-mtli~="mtli_filesize150MB"]:after {content:" (1.50 MB)"}</style><style type="text/css">a[data-mtli~="mtli_filesize150MB"]:after {content:" (1.50 MB)"}</style>{"id":2326,"date":"2017-12-20T11:32:03","date_gmt":"2017-12-20T11:32:03","guid":{"rendered":"https:\/\/pandorafms.com\/library\/?p=2326"},"modified":"2017-12-20T11:43:57","modified_gmt":"2017-12-20T11:43:57","slug":"linux-monitoring-manual","status":"publish","type":"post","link":"https:\/\/pandorafms.com\/library\/linux-monitoring-manual\/","title":{"rendered":"Linux Monitoring Manual"},"content":{"rendered":"<p>This is a manual which helps you to monitor Linux\/Unix based devices using Pandora FMS.<\/p>\n<h2>Module data<\/h2>\n<p><strong>1. CPU Free<\/strong><br \/>\nThis module returns the free CPU percentage. The syntax for the module would be this:<\/p>\n<pre>module_begin\r\nmodule_name CPU Free\r\nmodule_type generic_data\r\nmodule_exec echo $(( 100 - `vmstat 1 2 | tail -1 | awk '{ print $15 }'`))\r\nmodule_max 100\r\nmodule_min 0\r\nmodule_description Percentage CPU Free\r\nmodule_end<\/pre>\n<p><strong>2. Last Login<\/strong><br \/>\nModule that returns a text string with the last user connected. It is defined as a module of asyncrhonous type.<br \/>\nIts syntax is the following:<\/p>\n<pre>module_begin\r\nmodule_name Last Login\r\nmodule_type async_string\r\nmodule_exec last | head -1\r\nmodule_description User last logged\r\nmodule_end<\/pre>\n<p><strong>3. Load Average<\/strong><br \/>\nIt measures the CPU average load. The module definition would be like this:<\/p>\n<pre>module_begin\r\nmodule_name Load Average\r\nmodule_type generic_data\r\nmodule_exec uptime | awk -F \",\" '{print $3}' | awk '{print $3}' | tr -d \u201cn\u201d\r\nmodule_description Average load last minute\r\nmodule_end<\/pre>\n<p>For Suse 11.4 : (carriage return)<\/p>\n<pre>module_exec uptime | awk -F \":\" '{print $4}' | awk -F \" \" '{print $1}' | sed \"s\/.$\/\/\" | tr -d \u201cn\u201d<\/pre>\n<p><strong>4. Process Running<\/strong><br \/>\nChecks if an specific process is being executed in the machine. For it, we should created one module in this way:<\/p>\n<pre>module_begin\r\nmodule_name Process xxx\r\nmodule_type generic_proc\r\nmodule_service xxx\r\nmodule_description Process XXX running\r\nmodule_end<\/pre>\n<p>Replacing xxx by the specific process that we want to monitor.<\/p>\n<p><strong>5. Physical mem. Free<\/strong><br \/>\nThis module returns the percentage of free space of the physical memory. The definition for this module would be this:<\/p>\n<pre>module_begin\r\nmodule_name Physical mem. free\r\nmodule_type generic_data\r\nmodule_freepercentmemory\r\nmodule_description Percentage Mem Free Phys\r\nmodule_end<\/pre>\n<p><strong>6. Free swap<\/strong><br \/>\nReturns in percentage the free space of swap memory. Its definition in the configuration file would be this:<\/p>\n<pre>module_begin\r\nmodule_name Free swap\r\nmodule_type generic_data\r\nmodule_exec free -m | grep Swap | awk '{print (($4 \/ $2)*100)}'\r\nmodule_description Percentage Mem Swap Free\r\nmodule_end<\/pre>\n<p><strong>7. Pagination memory<\/strong><br \/>\nQuantity of paginated memory:<\/p>\n<pre>module_begin\r\nmodule_name Pagination memory\r\nmodule_type generic_data\r\nmodule_exec vmstat 1 2 | tail -1 | awk '{ print $8 }' | tr -d \u201cn\u201d\r\nmodule_description Mem Paged\r\nmodule_end<\/pre>\n<p><strong>8. Free Disk<\/strong><br \/>\nIt returns the number of processes that are running in the machine. The module syntax is this:<\/p>\n<pre>module_begin\r\nmodule_name Free Disk\r\nmodule_type generic_data\r\nmodule_freepercentdisk \/\r\nmodule_description Percentage Free Disk\r\nmodule_end<\/pre>\n<p><strong>9. Free inodes<\/strong><br \/>\nIt returns the percentage of free i-nodes of one partition:<\/p>\n<pre>module_begin\r\nmodule_name Free inodos \/\r\nmodule_type generic_data\r\nmodule_exec df -i | grep -E \"\/$\" | awk '{print 100-(($3\/$2)*100)}'\r\nmodule_max 100\r\nmodule_min 0\r\nmodule_description Percentage Free i-nodos\r\nmodule_end<\/pre>\n<p>To see the partition \/var for example, you should change the command grep of -E \u201c\/$\u201d to<br \/>\ngrep -E \u201c\/var$\u201d. Besides changing the name of the module from inodo_\/_free to inodo_\/var_free.<\/p>\n<p>For Ubuntu:<\/p>\n<pre>module_exec echo -n $(( 100 - `df -i | grep -E \"\/$\" | awk '{print $5}' | tr -d \u201c%\u201d`))<\/pre>\n<p>For Suse:<\/p>\n<pre>module_exec echo -n $((100 - `df -i | grep -E \u201c\/$\u201d | awk '{print $5}' | tr -d \u201cn\u201d | awk -F \u201c%\u201d '{print $1}' `))<\/pre>\n<p><strong>10. Zombie processes<\/strong><br \/>\nIt counts the number of processes that are in the Zombie status. The structure of the module would be this:<\/p>\n<pre>module_begin\r\nmodule_name Zombie processes\r\nmodule_type generic_data\r\nmodule_exec ps -eos | grep Z | wc -l | tr -d \u201cn\u201d\r\nmodule_description Number of zombie processes\r\nmodule_end<\/pre>\n<p><strong>11. Number processes<\/strong><br \/>\nCounts the number of processes of the system:<\/p>\n<pre>module_begin\r\nmodule_name Number processes\r\nmodule_type generic_data\r\nmodule_exec ps -e | wc -l | tr -d \u201cn\u201d\r\nmodule_description Number of processes\r\nmodule_end<\/pre>\n<p><strong>12. Processes high CPU<\/strong><br \/>\nIt returns the pid of the process that is consume more than the 90% of the CPU. Its syntax:<\/p>\n<pre>module_begin\r\nmodule_name Processes high CPU\r\nmodule_type generic_data_string\r\nmodule_exec ps -eo pcpu,pid | sort -n | grep -v CPU | tail -1 | awk '{if ($1&gt;90) print $2; else print \"NA\"}' | tr -d \"n\"\r\nmodule_description PID Processes &gt; 90% CPU\r\nmodule_end<\/pre>\n<p><strong>13. Used inodes<\/strong><br \/>\nReturns the percentage of free i-nodes of one partition<\/p>\n<pre>module_begin\r\nmodule_name Used inode \/\r\nmodule_type generic_data\r\nmodule_exec df -i | grep -E \"\/$\" | awk '{print $4}' | tr -d \u201c%n\u201d\r\nmodule_max 100\r\nmodule_min 0\r\nmodule_description Percentage use of i-nodes\r\nmodule_end<\/pre>\n<p>To look for the partition \/var , for example, you should change the command grep from grep -E \u201c\/$\u201d to grep -E \u201c\/var$\u201d. Besides, you should also change the name of the module form inodo_\/_free to inodo_\/var_free.<br \/>\nFor Ubuntu:<\/p>\n<pre>module_exec df -i | grep -E \"\/$\" | awk '{print $5}' | tr -d \u201c%n\u201d<\/pre>\n<p>For Suse:<\/p>\n<pre>module_exec df -i | grep -E \u201c\/$\u201d | awk '{print $5}' | tr -d \u201cn\u201d | awk -F \u201c%\u201d '{print $1}' | tr -d \u201cn\u201d<\/pre>\n<p><strong>14. Time sync<\/strong><br \/>\nReturns the schedule difference with the NTP server.<\/p>\n<pre>module_begin\r\nmodule_name Time sync\r\nmodule_type generic_data\r\nmodule_exec ntptrace 2&gt;\/dev\/null | tr -d \u201cn\u201d | awk '{print $5}' | tr -d \u201c,n\u201d\r\nmodule_description Time difference with NTP\r\nmodule_end\r\n\r\n<h2>Files:<\/h2>\r\n\r\n<a href=\"\/library\/files_repository\/1340954906.dario.pandora_linux_v1r1.zip\" class=\"mtli_attachment mtli_zip\" data-mtli=\"mtli_filesize150MB\" target=\"_blank\" rel=\"noopener nofollow\">pandora_linux_v1r1.zip<\/a><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>This is a manual which helps you to monitor Linux\/Unix based devices using Pandora FMS. Module data 1. CPU Free This module returns the free CPU percentage. The syntax for the module would be this: module_begin module_name CPU Free module_type generic_data module_exec echo $(( 100 &#8211; `vmstat 1 2 | tail -1 | awk &#8216;{ [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25,6],"tags":[73],"_links":{"self":[{"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/posts\/2326"}],"collection":[{"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/comments?post=2326"}],"version-history":[{"count":0,"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/posts\/2326\/revisions"}],"wp:attachment":[{"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/media?parent=2326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/categories?post=2326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pandorafms.com\/library\/wp-json\/wp\/v2\/tags?post=2326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}