Vserver watchdogs

Monitoring listening TCP/UDP processes

mynetstat

#!/bin/bash 

# Copyright: 2007 Philippe Teuwen <phil at teuwen dot org>
# License:   GPLv3 or later
#
# Description:
#   Watch for modifications in the list of listening TCP/UDP processes across all vservers
#   Examples: mysql, imapproxy,.. crashes
#             IP binding broken after package upgrade
#             new suspicious listening process, etc
#
# Usage:
#   mynetstat [update|diff|diff+update] options
#
#   mynetstat
#       Gives a clean list of listening processes in which vserver and with which binding
#   mynetstat update
#       Creates a snapshot in a logfile
#   mynetstat diff
#       Shows diffs compared to the snapshot
#       This is the one expected to be called by cron on the host
#   mynetstat diff+update
#       Same as diff but takes a new snapshot in case of changes
#       so cron doesn't send repetitively alerts
#   Options:
#   You can use numeric options of netstat: [--numeric|-n] [--numeric-hosts] [--numeric-ports]
# Changelog:
#   v1.0

###### Adapt this one to your needs:        
LOGFILE="$(dirname $0)/mynetstat.snapshot"
####################################

POSTUPDATE=false
case "$1" in
    "update")
        shift
        CMD="cat > $LOGFILE"
    ;;
    "diff")
        shift
        CMD="diff -U0 $LOGFILE -"
    ;;
    "diff+update")
        shift
        CMD="diff -U0 $LOGFILE -"
        POSTUPDATE=true
    ;;
    *)
        CMD="cat"
esac

function FILTER() {
    /usr/bin/awk -v vs=$i '
        /^(tcp|udp)/{
            if ($7=="")
                $7=$6;
            sub(/^[0-9]+\//,"",$7);
            printf "%-20s%-10s%-30s%s\n", vs, $1, $4, $7
        }'
}
(
for i in $(/usr/sbin/vserver-stat |awk '/^[0-9]/{print $8}'); do
    /usr/sbin/vserver $i exec /bin/netstat --ip -lp $NUMERIC|FILTER
done
i=HOST
/bin/netstat --ip -lp $NUMERIC|FILTER
) |sort -b | eval $CMD

[ $? -eq 1 ] && $POSTUPDATE && exec $0 update $*

/etc/cron.d/watch-vservers

MAILTO=root
*/15 * * * *    root /home/vservers/tools/watch/mynetstat diff

Monitoring running processes

myps

#!/bin/bash 

# Copyright: 2007 Philippe Teuwen <phil at teuwen dot org>
# License: GPLv3 or later
#
# Description:
#   Watch for modifications in the list of running processes across all vservers
#
# Usage:
#   myps
#       Gives a clean list of processes in which vserver
#   myps update
#       Creates a snapshot in a logfile
#       Be careful that transient processes as those ran by this script itself will be there!
#   myps update-filtered
#       Same a bit smarter, it filters out processes of the day and according to 
#       extra rules written in LOGFILE_OPT
#   myps missing
#       Shows missing processes apparently not running but well in the reference snapshot
#       This is the one expected to be called by cron on the host
#   myps new
#       Shows processes running but not present in the reference snapshot
#       Be careful that transient processes as those ran by this script itself will be there!
#   myps new-filtered
#       Same a bit smarter, it filters out processes of the day and according to 
#       extra rules written in EXTRAFILTER
#       Note that you could miss processes forking at abnormal rate as they would be "too young"
#       This is one could be interestingly called by cron too
#   myps missing+new-filtered
#       Guess what...
# Changelog:
#   v1.0

###### Adapt this one to your needs:        
LOGFILE="$(dirname $0)/myps.snapshot"
EXTRAFILTER="$(dirname $0)/myps-filter.conf"
####################################

# Default passthrough filter:
FILTER="cat"
case "$1" in
    "update")
        shift
        CMD="cat > $LOGFILE && echo \"Done. You can clean manually the snapshot from transient processes\""
    ;;
    "update-filtered")
        shift
        # Filter our processes of today:
        FILTER="egrep -v \"[ ]+ +[0-9]\""
        # Filter out lines matching those in EXTRAFILTER
        CMD="cat |grep -v -f $EXTRAFILTER > $LOGFILE && echo \"Done. You can clean manually the snapshot from transient processes\""
    ;;
    "missing")
        shift
        CMD="diff -U0 $LOGFILE - |sed \"1,2d\" |grep \"^-\""
    ;;
    "new")
        shift
        # Filter our processes of today:
        FILTER="egrep -v \"[ ]+ +[0-9]\""
        # Filter out lines matching those in EXTRAFILTER
        CMD="diff -U0 $LOGFILE - |sed \"1,2d\" |grep \"^+\"|grep -v -f $EXTRAFILTER"
    ;;
    "missing+new-filtered")
        shift
        $0 missing $*
        exec $0 new-filtered $*
    ;;
    *)
        CMD="cat"
    ;;
esac

# To get also args of the command, change "pid,command" by "pid,comm"
/usr/sbin/vps ax -o pid,start_time,command|\
    sed "1d;s/^[ 0-9]\\+//"|\
    eval $FILTER|\
    cut -c-14,21-|\
    sort|\
    uniq|\
    eval $CMD

Some explanation:
myps-filter.conf is supposed to contain lines used by grep -v to clean the output from processes that can run but not necessarily so you don't want to hear about them

/etc/cron.d/watch-vservers

MAILTO=root
57 * * * *    root /home/vservers/tools/watch/myps missing+new-filtered

We choose once per day among others at 23:57 and 0:57 so we avoid to capture processes of less than 1 hour but "of yesterday"

Monitoring and killing CPU-hungry logins

In some situations my CPU was burning like hell for days.
This was the vcontext/login process when using the command "vserver XX enter".
If it happens that the process is disconnected from its terminal it eats all the CPU :-(
I could reproduce the problem as follow:

• ssh to the server as normal user
• sudo su -
• vserver XX enter
• from another term, kill -9 one of the 2 su processes ("su -" or "-su")
• quit the current terminal

Now from another terminal you can see that

 vps ax|grep " login"

shows a "login" process not attached to any tty (cf the "?") and using top you see it's running 100% cpu.

Actually the real process is called vcontext as seen by top, pgrep and as you can see in /proc/XXX/status but its command line was overwritten with "login\0\0\0\0\0\0\0\0\0\0\0..." and commands like vps or pgrep -f show you this name "login" as you can see in /proc/XXX/cmdline.

So I wrote a script and installed it in a cron to kill any such dandling process:

pids=$(/usr/sbin/vps axc|\
    egrep ' ? +[RS] +[1-9][0-9]*:[0-9]+ +vcontext'|\
    sed 's/^ *\([0-9]\+\) .*$/\1/')
[ "$pids" != "" ] && \
    echo "Killing dandling login" && \
    kill $pids

And /etc/cron.d/watch-vservers:

MAILTO=root
*/5 * * * *     root /home/vservers/tools/kill-vcontext

This also shows something weird: processes in vservers don't appear with ps ax, ok, they appear with vps ax.
Now if I want to kill one of them from the host:

vkill 29825
vkill: vc_ctx_kill(): No such process
chcontext --ctx 1 kill 29825
<no error but nothing happen neither because ctx1 can watch all but can only watch!>
kill 29825
<works!!>

It seems that on newer versions (2.6.18?), such direct kill will not work => use vkill --xid <vserver1> <pid>.

Monitoring and restarting daemons

I have a big syslog-ng aggregator + dumping into mysql, cf Syslog
But sometimes during/after cron.daily (logrotate?), syslog-ng dies
I experienced similar problems with apache2 at logrotate weekly and with denyhosts
So I decided to monitor all my daemons and try to restart them automatically when there is a problem

mywatchdog

#!/bin/bash

# Copyright: Philippe Teuwen <phil at teuwen dot org>
# License: GPLv3 or later
#
# Usage:
#   mywatchdog <vserver> <space-separated list of daemons>
# Checks in vserver if such daemons are running otherwise it tries to launch them with /etc/init.d/<daemon> start
# Special vserver MAIN refers to the host
#
# Note that <daemon> must be the name of the script in /etc/init.d/
# and must be usable as a pattern to find the process otherwise add a specific filter below

VSERVER=$1
shift

for i in $*; do 
    FILTER=${i}
    # Special daemons to tweak as the process has another name
    # -f greps on the full command line otherwise filter applies only on the process name
    [ "${i}" == "backuppc" ] && FILTER=BackupPC
    [ "${i}" == "courier-authdaemon" ] && FILTER=authdaemond
    [ "${i}" == "courier-imap" ] && FILTER=couriertcpd
    [ "${i}" == "denyhosts" ] && FILTER="-f denyhosts"
    [ "${i}" == "openbsd-inetd" ] && FILTER=inetd
    [ "${i}" == "ozyman" ] && FILTER="-f nomce.pl"
    [ "${i}" == "postgresql-8.1" ] && FILTER=postmaster
    [ "${i}" == "spamassassin" ] && FILTER=spamd
    [ "${i}" == "sysklogd" ] && FILTER=syslogd
    [ "${i}" == "uml-utilities" ] && FILTER=uml_switch
    [ "${i}" == "zope2.9" ] && FILTER="-f zope2.9"
    if [ "$VSERVER" == "MAIN" ]; then
        if [ ! -e "/etc/init.d/${i}" ]; then
            echo "Error in using mywatchdog script, /etc/init.d/${i} does not exist in MAIN!"
            exit 1
        fi
        pgrep ${FILTER}\|logrotate\|apt-get >/dev/null || \
        { 
            echo "Error! ${i}@${VSERVER} seems to be down! I try to restart  it..." && \
            /etc/init.d/${i} start; 
        }
    else
        if [ ! -e "/home/vservers/${VSERVER}/etc/init.d/${i}" ]; then
            echo "Error in using mywatchdog script, /etc/init.d/${i} does not exist in ${VSERVER}!"
            exit 1
        fi
        /usr/sbin/chcontext --ctx ${VSERVER} pgrep ${FILTER}\|logrotate\|apt-get >/dev/null || \
        { 
            echo "Error! ${i}@${VSERVER} seems to be down! I try to restart  it..." && \
            /usr/sbin/vserver ${VSERVER} exec /etc/init.d/${i} start; 
        }
    fi
done

/etc/cron.d/watch-vservers

I added to my /etc/cron.d/watch-vservers entries similar to

*/15 * * * *    root : "WD MAIN"     ;/home/vservers/tools/watch/mywatchdog MAIN          acpid atop exim4 munin-node ssh denyhosts sysklogd udev xinetd uml-utilities
*/15 * * * *    root : "WD MX"       ;/home/vservers/tools/watch/mywatchdog mx            syslog2mysql courier-authdaemon courier-imap cron exim4 fetchmail munin-node spamassassin ssh denyhosts syslog-ng xinetd
*/15 * * * *    root : "WD NS0"      ;/home/vservers/tools/watch/mywatchdog ns0           cron dnsmasq sysklogd
*/15 * * * *    root : "WD PUBLIC"   ;/home/vservers/tools/watch/mywatchdog public        apache2 cron exim4 munin-node sysklogd
*/15 * * * *    root : "WD SQL"      ;/home/vservers/tools/watch/mywatchdog sql           cron munin-node mysql sysklogd
[...]

"WD VSERVER" are the first strings to appear in the mails titles, this helps me to quickly identify problems
I don't monitor cron on MAIN as if it's dead, well, the watchdogs won't be called :-/

Note that if you use logcheck, you will get security warnings because our calls contain "deny" when we want to check "denyhosts" so you could need to add sth like this in /etc/logcheck/violations.ignore.d/local-logcheck-watchdogs

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]: \(root\) CMD \(.*mywatchdog.*denyhosts.*\)$

Monitoring imapproxy

Imapproxy is in one vserver, the one with apache2 and squirrelmail and IMAP server is in another vserver, the mail server.
Because of racing between both vservers at boot time, imapproxy can fail to start if courier was not yet there

*/15 * * * *    root /usr/sbin/chcontext --ctx vserverX pgrep imapproxy >/dev/null|| { /usr/sbin/chcontext --ctx vserverY pgrep couriertcp >/dev/null && { echo "Error! Imapproxy@vserverX seems to be down! I try to restart it..." && /usr/sbin/vserver vserverX exec /etc/init.d/imapproxy start; } }