Insights
Labs Repository GPG Key Rotation (2026)
Monday, April 13, 2026 in Insights
Starting on April 13 2026 all .deb and .rpm files in the labs repository will use the monitoring-repo-consol-de-gpg-2026.asc instead of the old GPG-KEY-4096 or RPM-GPG-KEY keys. For consistency all existing rpm and deb files have been resigned to use the new key as well. File Size ID Old RPM-GPG-KEY 1024 F8C1CA08A57B9ED7 Old GPG-KEY-4096 4096 F0CA212FF1FFE778 New monitoring-repo-consol-de-gpg-2026.asc 4096 CBB9B38BE1B9D330 Debian / Ubuntu In Debian and Ubuntu you will probably notice warnings like this when running apt update #>apt update Hit:1 http://labs.consol.de/repo/stable/debian trixie InRelease Err:1 http://labs.consol.de/repo/stable/debian trixie InRelease Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key E1C8FD55CA5EEEFF05E93DD3CBB9B38BE1B9D330, …
Monitoring vSphere cluster health with check_vsphere
Wednesday, April 01, 2026 in Insights
What’s new? The cluster-health command in check_vsphere looks at the members of a vSphere cluster, checks their state and decides whether the whole cluster is healthy. By default it treats nodes that are disconnected or in maintenance as faulty, but you can tweak that list. Use --faulty to customize what counts as a failure. How the threshold works You tell the command when to raise a warning or a critical alert with the --cluster-threshold flag: [max_members:]warn_threshold:crit_threshold max_members (optional) - Apply the rule to clusters with up to this many members. warn_threshold – Number or percent of faulty nodes that triggers a WARN. crit_threshold – Number or percent that triggers a CRIT. You can give several --cluster-threshold flags for different cluster sizes. Rules apply to …
Reliable RKE2 Certificate Expiry Alerts for Clusters Managed by SUSE Rancher
Tuesday, March 24, 2026 in Insights
This shows how to combine Kubernetes Events and Rancher Metadata for precise, actionable alerting. Alert ManagedClusterRKE2ExpiringCertificates SUSE Rancher provides an RKE2 cluster management platform for application teams. As an infrastructure team operating a SUSE Rancher instance, we want to notify teams about expiring RKE2 certificates, as their rotation requires manual intervention. Unfortunately, the information about expiring certificates is only available in the Kubernetes Events of the Rancher-managed RKE2 clusters. Hence, we need to automatically install Kubernetes Event log collection via Fleet on the managed clusters. For notification purposes, we need additional information about the cluster owner. This cannot be easily propagated down to managed clusters, so the event logs …
Using check_sap_health with SNC
Tuesday, December 02, 2025 in Insights
To use check_sap_health with SNC (Secure Network Communication), you need to install the SAP NetWeaver RFC SDK and the SAP Cryptographic Library, along with the Perl module sapnwrfc. This guide walks you through the complete setup process within an OMD site. Prerequisites You need to download the following archives from the SAP Software Download Center: SAP NetWeaver RFC SDK: nwrfc750P_17-70002752.zip (or newer version) SAP Cryptographic Library: SAPCRYPTOLIBP_8561-20011697.SAR SAPCAR: Tool to extract SAR archives Place these files in a preparation directory within your OMD site: OMD[sapmon@omdmuc08]:~$ cd prep_sap/ OMD[sapmon@omdmuc08]:~/prep_sap$ ls -l total 27488 -rw-r--r--. 1 demo demo 20054340 Dec 2 10:14 nwrfc750P_17-70002752.zip -rwxr-xr-x. 1 demo demo 5712584 Dec 2 10:14 SAPCAR* …
A Brief Overview Of The check_vsphere Plugin
Tuesday, November 18, 2025 in Insights
What is it? check_vsphere is a plugin for Naemon, Icinga, and Nagios-compatible systems. It checks various aspects of VMwareBroadcom vCenter or ESX hosts. For a long time, this was done using check_vmware_esx.pl or check_esx.pl. However, Broadcom (formerly VMware) has decided to deprecate the Perl SDK for vCenter. Therefore, we decided to rewrite the parts our customers use in Python using the pyVmomi library. In this article, I will provide an overview of what the plugin can do and delve into some of its features. Development happens at Github. Feel free to open issues or pull requests. Authentication Currently, only user/password-based authentication is supported. The common options needed to establish a connection are: -u USERNAME -p PASSWORD can be omitted in favor of the VSPHERE_PASS …
OMD Labs Edition Not Affected by Recent Nagios XI Vulnerabilities
Tuesday, November 04, 2025 in Insights
OMD Labs Edition Not Affected by Recent Nagios XI Vulnerabilities Several vulnerabilities were recently disclosed in Nagios XI: CVE-2025-34286 – Remote Code Execution in the Core Config Manager (CCM) CVE-2025-34284 – Command Injection in the WinRM Plugin CVE-2025-34134 – Remote Code Execution in the Business Process Intelligence (BPI) Component These issues could allow authenticated administrators to execute arbitrary commands on affected systems, potentially leading to full host compromise. OMD Labs Edition Is Not Affected The OMD Labs Edition (Open Monitoring Distribution) is an open-source monitoring platform maintained by ConSol Labs. While it is compatible with Nagios and related cores such as Naemon and Icinga, it does not include or depend on the proprietary components of Nagios XI …
Tunnel SSH into an OMD server. Proof of Concept
Thursday, July 31, 2025 in Insights
Tunneling SSH over WebSocket with GOST in an OMD server: In this blog post, we’ll walk through a proof-of-concept (POC) setup for tunneling SSH traffic over WebSocket using the GOST tool. This configuration runs inside an OMD (Open Monitoring Distribution) container, leveraging Apache as a reverse proxy for the WebSocket connection. The goal is to securely forward SSH requests from a local client to the container’s SSH daemon (sshd) via an encrypted tunnel. This setup is useful for scenarios where direct SSH access is restricted, but HTTP/HTTPS ports are open (e.g., behind firewalls or in cloud environments). We’ll use Podman to manage the container, self-signed certificates for TLS, and GOST for the tunneling logic. Overview The architecture involves: Client-side (outside the container): …
Coshsh can keep a secret
Thursday, July 17, 2025 in Insights
Coshsh, as a generator for monitoring config files, needs to know which hosts and applications make up an enterprise’s IT landscape. Usually, it fetches this information by querying a CMDB’s API. Access is typically granted by presenting a token, or a username and password. Since this is confidential data, it should not be visible in clear text—especially if you back up your Coshsh config in a public Git repository. In an OMD setup, you can store secrets in a vault, which is used by the Naemon core. Since the release of Coshsh 11.0, Coshsh can use the vault too. Imagine the following scenario: you have two OMD sites, prod and nonprod—for production and testing, respectively. Coshsh collects inventory data by querying the ServiceNow CMDB. It then generates the corresponding configuration …
Das war der Open-Source-Monitoring-Workshop 2025
Saturday, July 05, 2025 in Insights
Spoiler: Schee war’s Das 16. Treffen der deutschsprachigen Open-Source-Monitoring-Community fand am 2. und 3. Juli in München statt. Gastgeber war die collaboration Factory GmbH, die ihren Loft in der neuen Hopfenpost am Hauptbahnhof (sogar mit Tribüne) zur Verfügung stellte. Beziehungen muss man haben… Der Workshop brachte wie immer Monitoring-Admins und Software-Autoren zusammen, die sich in ihren Vorträgen über neue Entwicklungen und Anwendungen in die Karten schauen lassen. In München bieten sich natürlich Biergartenbesuche zum geselligen Austausch an, auch davon wurde mehrmals Gebrauch gemacht. Tag 1 - 2. Juli - 34,3 °C Nach der Begrüßung der ca. 50 Teilnehmer folgte die Keynote von Marco Pasti von der collaboration Factory GmbH. Er stellte cplace vor, das Flaggschiff des …
Die Agenda für den Open-Source-Monitoring-Workshop 2025
Thursday, June 26, 2025 in Insights
Vortag - 1.7.25 18:00 - 22:00 █ Vorabendtreffen im Parkcafe Workshop Tag 1 - 2.7.25 09:00 - 09:30 █ Eintreffen/Registrierung 09:30 - 10:00 █ Begrüßung und Keynote 10:00 - 10:45 █ Softwareentwicklung in einem Open-Source-Unternehmen - Blerim Sheqa, Icinga 10:45 - 11:00 █ Pause 11:00 - 11:45 █ Monitoring bei cplace - Sebastian Weitzel, cplace 11:45 - 11:50 █ Ankündigung Mittagessen und Wegbeschreibung 11:50 - 13:15 █ Mittagessen im Augustiner Biergarten 13:15 - 14:00 █ Umbrella Monitoring - Jens Michelsons, it-novum 14:00 - 14:45 █ Cloud-Monitoring bei einem großen Elektrokonzern - Ulrike Klusik, Consol 14:45 - 14:55 █ Pause 14:55 - 15:40 █ Monitoring bei der Freiwilligen Feuerwehr München - Basti Schubert 15:40 - 16:00 █ Lightning Talks… 18:00 - 22:00 █ Löwenbräukeller Workshop Tag 2 - …