Checkmk host on AWS

General
1

Hi!

I’m building a monitoring site on AWS to monitor hosts on AWS, Internet and also on prem via VPN. The idea is to have a dashboard site and N monitoring sites. I was planning to expose the portal through an ALB but was wondering which was the best solution for agent registration ports as I guess exposing them via ALB is not possible because of TLS certificates.

Which would be the best solution? NLB? Exposing directly? Any experiences or insights are really appreciated!

Regards,

Alejandro

2

Use CLB.It just works! Just kidding :slight_smile:

You could use one NLB as the endpoint.

  • TCP 443 > Checkmk TCP 443: end-to-end HTTPS for GUI, native Checkmk SAML, REST API/agent port discovery, and distributed configuration synchronization.
  • TCP 8000 > Checkmk TCP 8000: Agent Receiver registration and Checkmk-managed mTLS. This traffic is TLS.
  • TCP 6557 > Checkmk TCP 6557, restricted to the central site/VPN, if distributed monitoring needs data through Livestatus.

Also, use TCP pass-through, with the HTTPS certificate installed on the Checkmk server. This preserves SAML and Checkmk’s TLS handling. AFAIK, an ALB cannot handle port 8000, and an ALB+NLB combination is unnecessary for a single backend site.

1 Like