Installing a package on the virtual appliance

I am new to the Checkmk virtual appliance world. In a requirement to send the logs of the logfiles from Checkmk to a logstash endpoint, I wanted to test and install filebeat on the virtual appliance. But, it looks like its not recommended to install any package. Has anybody else faced this ? If yes, how did you solve it ?

This is the warning I get on the virtual appliance (1.4.7+):

!!! WARNING !!!
You are trying to use apt-get on a Check_MK Appliance. Installing or updating
packages manually will lead to serious trouble.
Your device will not be supported anymore if you change the installed packages.
!!! WARNING !!!
Do you want to continue? [y/N]:

It is an appliance. As soon as you install the next firmware release for it, the manually installed packages will be lost.

Hallo,
changing the appliance isn’t a good idea.
What is problem behind your idea you try to solve?

Ralf

Hello Ralf,

I want to try out two things.

  1. Change the banner and put the instance specific information like DEV and PROD and also put a company logo in addition to Checkmk.
  2. Install a filebeat package on the appliance to send the logs of some log files to our company logstash endpoint.

Is it possible ?

Hallo,
logfiles of the appliance or informations of some monitored hosts?

Rall

Initially, the use-case is about the log-files and then it will move in the direction of some business critical hosts and its services.

ok,
what s about using grafana/ prometheus for part 2 or is elk fix?

Ralf

ELK is fix unfortunately.

Grafana and Prometheus are not usable for log aggregation.
At the moment log aggregation is one of the bigger topics inside German KRITIS.

ok,
my question was not detailed enough.
Ralf

Is it possible to install a 3rd party python library as site user within the site environment ? Is that also going to affect the device supporting warranty ?

This is possible and sometimes needed for some special agents.
You have to pay attention to the shipped libraries and their versions.
That you have no conflict between existing libs and your new libs.

Thank you Andreas. And since I am configuring the virtual appliance in a cluster, so the installing of the 3rd party libraries won’t be necessary on the standby instance. Correct ?

Hi,

About sending the logfiles to a logstash endpoint, you can monitor the logfiles normally with check_mk and use the rule “Logwatch Event Console Forwarding” for sending all messages from logfiles to a remote syslog.

BR,
George

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.