Trouble monitoring ElasticSearch

Troubleshooting
, ,
1

CMK version: 2.1.0p17
OS version: Oracle Linux 9.1

Issue: I am trying to monitor our ElasticSearch (v8.6.0) server, running on Ubuntu 22.04.1 (LTS). I have the CMK agent installed on the machine itself and of course it is reporting back OS level stats as expected. I’m running in to an issue trying to monitor Elastic using the built-in checks in CMK. I add them as monitoring rules in the WATO, but they don’t appear on the host. I’ve also tried to add them as enforced services, but they just don’t leave the pending state. Any help is much appreciated!

Output of “cmk --debug -vvn hostname”:

Checkmk version 2.1.0p17
Try license usage history update.
Trying to acquire lock on /omd/sites/it/var/check_mk/license_usage/next_run
Got lock on /omd/sites/it/var/check_mk/license_usage/next_run
Trying to acquire lock on /omd/sites/it/var/check_mk/license_usage/history.json
Got lock on /omd/sites/it/var/check_mk/license_usage/history.json
Next run time has not been reached yet. Abort.
Releasing lock on /omd/sites/it/var/check_mk/license_usage/history.json
Released lock on /omd/sites/it/var/check_mk/license_usage/history.json
Releasing lock on /omd/sites/it/var/check_mk/license_usage/next_run
Released lock on /omd/sites/it/var/check_mk/license_usage/next_run
Updating IPv4 DNS cache for <HOSTNAME>: <IP>
Trying to acquire lock on /omd/sites/it/var/check_mk/ipaddresses.cache
Got lock on /omd/sites/it/var/check_mk/ipaddresses.cache
Releasing lock on /omd/sites/it/var/check_mk/ipaddresses.cache
Released lock on /omd/sites/it/var/check_mk/ipaddresses.cache
+ FETCHING DATA
  Source: SourceType.HOST/FetcherType.PIGGYBACK
[cpu_tracking] Start [7fa827f7ccd0]
[PiggybackFetcher] Fetch with cache settings: NoCache(<HOSTNAME>, base_path=/omd/sites/it/tmp/check_mk/data_source_cache/piggyback, max_age=MaxAge(checking=0, discovery=120, inventory=120), disabled=True, use_outdated=False, simulation=False)
Not using cache (Cache usage disabled)
[PiggybackFetcher] Execute data source
No piggyback files for '<HOSTNAME>'. Skip processing.
No piggyback files for '<IP>'. Skip processing.
Not using cache (Cache usage disabled)
[cpu_tracking] Stop [7fa827f7ccd0 - Snapshot(process=posix.times_result(user=0.0, system=0.0, children_user=0.0, children_system=0.0, elapsed=0.0))]
+ PARSE FETCHER RESULTS
  Source: SourceType.HOST/FetcherType.PIGGYBACK
No persisted sections
  -> Add sections: []
Received no piggyback data
[cpu_tracking] Start [7fa827f044c0]
value store: synchronizing
Trying to acquire lock on /omd/sites/it/tmp/check_mk/counters/<HOSTNAME>
Got lock on /omd/sites/it/tmp/check_mk/counters/<HOSTNAME>
value store: loading from disk
Releasing lock on /omd/sites/it/tmp/check_mk/counters/<HOSTNAME>
Released lock on /omd/sites/it/tmp/check_mk/counters/<HOSTNAME>
No piggyback files for '<HOSTNAME>'. Skip processing.
No piggyback files for '<IP>'. Skip processing.
[cpu_tracking] Stop [7fa827f044c0 - Snapshot(process=posix.times_result(user=0.0, system=0.0, children_user=0.0, children_system=0.0, elapsed=0.009999999776482582))]
execution time 0.0 sec | execution_time=0.010 user_time=0.000 system_time=0.000 children_user_time=0.000 children_system_time=0.000 cmk_time_agent=0.000
2

Hi @mredus,

have you configured the elastic special agent which queries information via the elastic rest api?

image

If so, you can use “cmk -D ” to show the command line triggering the elastic special agent and execute that by hand to get more debug info.

Gerd

1 Like
3

Hi @gstolz,

Thank you for the response and I apologize for my delay. I did attempt to use the special agent but had no luck. Is there any documentation available for it? I think my problem when I last attempted it was that I didn’t know what permissions to assign the CMK user on the ElasticSearch side.

Also, I’m not sure if this changes anything as far as configuring the special agent - but we’re using x-pack security and have also secured the Kibana WebUI with SSL.

Thank you again for the help so far,
Michael

4

Hi mredus,
sorry - I don’t know the x-pack security at all, not sure what/how it could impact this :confused:
AFAIK read only permissions are enough for the special agent.

Gerd

5

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.