monitor red hat/centos updates

[acalvo]

Hello,
I'm trying to figure out how to monitor the update status for Red Hat or CentOS servers.

So far I'm using this:

UserParameter=redhat.security,yum list updates --security | awk '{print $1;}' | grep x86_64 | wc -l
UserParameter=redhat.updates,yum list updates | awk '{print $1;}' | grep x86_64 | wc -l

Anyone has figured out how to get this status?


Thanks

[nelsonab]

Ok you'll need to do a few things first off you need the security plugin for yum:

yum install yum-security

Next you'll need to rewrite your user parameters as follows:

UserParameter=redhat.updates,yum list updates | grep `uname -p` | wc -l
UserParameter=redhat.security,yum list updates --security | grep "needed for security" | awk '{print $1}'

I would recomend you don't run this as a user parameter, but rather as a cron job once a day and then use the zabbix_sender to push the data back to Zabbix. The main reason for this is timeouts. If you have to download a repo update it may take longer than Zabbix is willing to wait.

Alternatively, if you have RHEL in your environment you can use Satellite. Satellite is Red Hat's configuration management tool for RHEL and Solaris systems. Spacewalk is the Open Source version of Satellite with some small feature set differences.

[nelsonab]

More information can be found here:

http://www.cyberciti.biz/faq/redhat-...urity-updates/

[acalvo]

Ok you'll need to do a few things first off you need the security plugin for yum:

yum install yum-security

Next you'll need to rewrite your user parameters as follows:

UserParameter=redhat.updates,yum list updates | grep `uname -p` | wc -l
UserParameter=redhat.security,yum list updates --security | grep "needed for security" | awk '{print $1}'

I would recomend you don't run this as a user parameter, but rather as a cron job once a day and then use the zabbix_sender to push the data back to Zabbix. The main reason for this is timeouts. If you have to download a repo update it may take longer than Zabbix is willing to wait.

Alternatively, if you have RHEL in your environment you can use Satellite. Satellite is Red Hat's configuration management tool for RHEL and Solaris systems. Spacewalk is the Open Source version of Satellite with some small feature set differences.

In my scenario, the server is the only allowed to open connections, so it must be run as an active check.

I've modified my User Parameters to include the `uname -p`.

However, I'm not receiving any output from this command.

I've added a new one:

UserParameter=redhat.security,yum list updates --security | awk '{print $1;}' | grep `uname -p` | wc -l
UserParameter=redhat.updates,yum list updates | awk '{print $1;}' | grep `uname -p` | wc -l
UserParameter=redhat.test,echo "test123"

This is the output it produces:

saruman ~ # zabbix_get -snwlb01 -k'redhat.test'
test123
saruman ~ # time zabbix_get -snwlb01 -k'redhat.updates'
0

real	0m1.051s
user	0m0.000s
sys	0m0.000s

Timeout on both machines has been raised to 5 sec.
However, it returns 0 (but no ZBX_NOTSUPPORTED).

Any hint?

By the way, the Satellite/Spacewalk is similar to the Red Hat Network; but we'd like to have it all centralized on the same system.

[nelsonab]

However, I'm not receiving any output from this command.

I've added a new one:

UserParameter=redhat.security,yum list updates --security | awk '{print $1;}' | grep `uname -p` | wc -l
UserParameter=redhat.updates,yum list updates | awk '{print $1;}' | grep `uname -p` | wc -l
UserParameter=redhat.test,echo "test123"

This is the output it produces:

saruman ~ # zabbix_get -snwlb01 -k'redhat.test'
test123
saruman ~ # time zabbix_get -snwlb01 -k'redhat.updates'
0

real    0m1.051s
user    0m0.000s
sys    0m0.000s

Timeout on both machines has been raised to 5 sec.
However, it returns 0 (but no ZBX_NOTSUPPORTED).

Any hint?

My best guess from where I'm sitting is either A timeout or B environment issue. How long does it take to execute the check? You might want to consider raising your timeout to 30 or more seconds.

By the way, the Satellite/Spacewalk is similar to the Red Hat Network; but we'd like to have it all centralized on the same system.

Satellite is RHN with the addition of PXE kickstart scripts, and host templating.

[acalvo]

My best guess from where I'm sitting is either A timeout or B environment issue. How long does it take to execute the check? You might want to consider raising your timeout to 30 or more seconds.




Satellite is RHN with the addition of PXE kickstart scripts, and host templating.

With a timeout of 30s still fails.

It takes near to 5s to process the request on the client machine:

[root@LB01 ~]# time yum list updates | awk '{print $1;}' | grep `uname -p` | wc -l
14

real	0m4.095s
user	0m2.631s
sys	0m0.250s

But the server responds in less than 2s:

saruman ~ # time zabbix_get -snwlb01 -k'redhat.updates'
0

real	0m1.086s
user	0m0.000s
sys	0m0.000s

Maybe I'm missing something, but the User Parameter 'redhat.test' works:

saruman ~ # time zabbix_get -snwlb01 -k'redhat.test'
test123

real	0m0.006s
user	0m0.000s
sys	0m0.000s

Any hint or any workaround?
Can't use zabbix_sender in this environment.

[nelsonab]

What about environment? If your Zabbix user does not have a shell assigned assign one to that user (by default Zabbix should not have a login shell). Become the Zabbix user and try to execute the check as the user zabbix.

The connection back to the zabbix server is irrelevant to the timeout. I forget the option but there is an option to clear out the cached data, try executing your yum commands with that flag in addition, or run that command first. You want to run your tests in a worst case scenario.

[acalvo]

What about environment? If your Zabbix user does not have a shell assigned assign one to that user (by default Zabbix should not have a login shell). Become the Zabbix user and try to execute the check as the user zabbix.

The connection back to the zabbix server is irrelevant to the timeout. I forget the option but there is an option to clear out the cached data, try executing your yum commands with that flag in addition, or run that command first. You want to run your tests in a worst case scenario.

You were right.
I tweaked the sudoers file to not require a tty for user zabbix and allow it to execute yum.

Now it's working.