July 5, 2012

How to configure Smokeping alerts

From http://oss.oetiker.ch/smokeping/

SmokePing keeps track of your network latency:
  • Best of breed latency visualisation.
  • Interactive graph explorer.
  • Wide range of latency measurement plugins.
  • Master/Slave System for distributed measurement.
  • Highly configurable alerting system.
  • Live Latency Charts with the most 'interesting' graphs.
  • Free and OpenSource Software written in Perl written by Tobi Oetiker, the creator of MRTG and RRDtool

Another great feature of smokeping is the ability to write your own Alert rules and them have smokeping email when a rule is fired. Very useful :D The guide for this is taken from an Ubuntu 10.04 server but the config should be pretty much the same on any *nix (some linux versions contain all these elements in a single config file).

First off we write our rules in /etc/smokeping/config.d/Alerts. I only use two rules at the moment for basic checking/alerting. Not the use of edgetrigger. This means a rule only send alerts when its state changes I.e one email to report the fault raised and one to report cleared. If you dont use this a mail will be sent every 5 minutes when the rule is triggering.

*** Alerts *** # This is an Alias on the machine to = smokealert@localhost from = smokealert@m00nie.com

This rule checks for 3 periods (3 * 5min default) where

the rtt is >70ms

+rttdetect
type = rtt

in milli seconds

pattern = >70,>70,>70
edgetrigger = yes
comment = On backup circuit maybe?

This rule checks for one period (1 * 5mins) of >60% loss

+hostdown
type = loss

in percent

pattern = >60%
edgetrigger = yes
comment = Massive loss for 5 mins

From the rules above I send Alerts to a local alias. This is so I can easily send mails to multiple mailboxes. I do this by editing the aliases file vi /etc/aliases adding the line below then running the newaliases command to register the aliase

smokealert: :include:/etc/smokeping/config.d/userstoalert

Then I have a file with an email address on each line at /etc/smokeping/config.d/userstoalert. So e.g.

noc@customer1.hello netops@customer2.wee me@m00nie.moon

Now just edit the Targets and apply the rules to the hosts you want /etc/smokeping/config.d/Targets.

++ Google menu = Google title = Google.com host = google.com alerts = hostdown

++ m00nie
menu = m00nie
title = m00nie
host = m00nie.com
alerts = rttdetect,hostdown

Now simply restart the smokeping service (service smokeping restart) and your good to go :)

Example of an email alert received.

Thu Jul 5 02:28:17 2012

Alert "hostdown" was raised for http://m00nie.com/cgi-bin/smokeping.cgi?target=m00nie

Pattern

60%

Data (old --> now)

loss: 0%, 0%, 0%, 100%
rtt: 21ms, 22ms, 21ms, U

Comment

Massive loss for 5 mins

m00nie :D