netdata 1.5 released - big update!
-
@cgunzelman said in netdata 1.5 released - big update!:
or go here and start reading.
https://www.reddit.com/r/sysadmin/comments/5pvg5n/netdata_the_opensource_realtime_performance/"You can run all your netdata behind another web server, like nginx, apache, lighttpd, etc. You can configure authentication at this front-end web server. The wiki has configuration pages for all of them.
All your netdata register themselves to the my-netdata menu of the dashboard, so you can jump from server to server easily. Several dashboard settings are also propagated from server to server (like current section, zoom level, view timeframe, etc)."
So how would that work, we have to build secure channels between every host and an aggregation point? Reddit leaves me more thinking that it is lacking rather than more. I think the issue might be that this is a product that assumes single site, 1990s LAN-based security and most of us assume or plan for LANless security and multi-site by default. So we instantly ask questions, for even the smallest companies, that this assumes won't come up. That's what I've gathered from reading the manual and Reddit. Basically, it's an awesome tool for a legacy world. I don't know any companies that work in that model today, they exist, but I don't run into them any more. Everyone has cloud hosts, data centers, multiple sites or something these days.
-
All of my machines have local firewalls built with FireHOL and ansible to distribute the config. I plan on using netdata on both my public facing servers (their own firewalls) and machines in a LAN.
Offtopic: your video insinuates Webroot has very low overhead, it does not with stock settings. I've got it installed on 80 windows servers and 1500 workstations. We are looking to move away from it simply because of all the issues it caused on terminal servers.
-
@cgunzelman said in netdata 1.5 released - big update!:
All of my machines have local firewalls built with FireHOL and ansible to distribute the config. I plan on using netdata on both my public facing servers (their own firewalls) and machines in a LAN.
But the local firewalls will have to be opened on the monitoring port for netdata to work. What's your plan to tie them together, VPN?
-
@scottalanmiller So none of your clients have site-to-site VPNs? Not for printers? Not for legacy applications? What's terrible about opening the port for the webUI to local machines? I could see forwarding the port to the open world to be questionable for security since this is such a new product.
-
@cgunzelman said in netdata 1.5 released - big update!:
@scottalanmiller So none of your clients have site-to-site VPNs? Not for printers? Not for legacy applications? What's terrible about opening the port for the webUI to local machines? I could see forwarding the port to the open world to be questionable for security since this is such a new product.
None use site to site for everything, which is what would be required. Some site to site would not solve the issue, only total site to site. And no, none have that.
Our customers specifically are even less likely to have it as VPNs are an extension of LAN security and we generally, but not always, move away from that. We very rarely implement it and more often than not remove it (slowly, over time as things are replaced.)
The only issue with opening the port on local machines is that you are investing in trusting your LAN. Your network design requires that the LAN be a trusted location, which it might be today, but it's technical debt based on that design. The issue that all of us commenting have, and all of our customers have, is that they don't have fully trusted LANs for their servers. They might have some or none, but none have full. Without full, this can be used on some servers, but rarely the important ones. Unless we build out a complex security infrastructure of our own to support it.
-
@cgunzelman said in netdata 1.5 released - big update!:
I could see forwarding the port to the open world to be questionable for security since this is such a new product.
There is no authentication, so even if the product was old and battle tested, it would still expose your data to the outside. Assuming I trust the product 100% to do what it is supposed to do, that still wouldn't work. And I'm not doubting the creators did an excellent job, I'm sure they did and it looks like an amazing product that just doesn't fit a need that I can imagine having today.
-
It's like a crazy awesome mouse trap, but none of us have mice
-
I've been using it to monitor a new firewall distribution that we have been testing for a few months now. It's great for real-time data collection, seeing everything in one neat package.
If you want authentication, use a mainstream webserver instead of the built-in. It says so right there in the wiki.
You may not have a need for it in the small business world (MSP I assume) but to others with specialized projects or need realtime monitoring on a simple and easy-to-read dashboard, it's perfect.
-
What I pointed out above is, what I believe, that every business I know requires in this kind of monitoring. Some may not need all of this, but these are the points that are important:
- Centralized viewing
- Security
- Data collection away from the source device
- Historical viewing
Outside of Wall St trading applications, where the overhead of this is likely out of the question, I don't know of anyone needing the level of detail here so the selling point seems empty. But it misses all four needs that they do have in the real world. It might be an amazing top replacement, but I already have top implemented and with full security built in. This does allow you to use DevOps tools and avoid logging in for top, so that's nice. But it introduces so many security complications that it's hard to see that that is offset by that one thing.
-
@cgunzelman said in netdata 1.5 released - big update!:
If you want authentication, use a mainstream webserver instead of the built-in. It says so right there in the wiki.
Sure, but we want a central, managed authentication system for all of the hosts. Implementing that security on hundreds of servers individually isn't practical or really safe. Someone quits, you have to manually update every server. Sure, if you are pushing that out with DevOps tools it is only so bad. Most companies aren't there yet, though.
-
@cgunzelman said in netdata 1.5 released - big update!:
You may not have a need for it in the small business world (MSP I assume) but to others with specialized projects or need realtime monitoring on a simple and easy-to-read dashboard, it's perfect.
I can see that, but seems very niche. I've worked in that world and tools like this would not have been easily allowed. What kinds of apps are you managing that do real time work? I had a tonne of that in financial trading, but only there.
-
If these users are installing the agent manually on thousands of machines, they are overworking themselves. Automation is the modern way of doing things.
I plan on monitoring routers with it. Routers that customer service reps will need to know the status of at the drop of a hat when dealing with customers relying on them for internet links.
-
@cgunzelman said in netdata 1.5 released - big update!:
I plan on monitoring routers with it. Routers that customer service reps will need to know the status of at the drop of a hat when dealing with customers relying on them for internet links.
That's a more interesting use case. Although "instant" view and real time are very different. Real time is that it is showing you what is happening as it happens. We already have instant views with other tools, Grafana for example. Real time does apply on routers, but humans can't really view packet load in real time, it's too fast. I assume that all of the routers are already on the Internet so the exposure is simple?
-
@scottalanmiller They have a management VLAN which customer service reps have access to.
-
@cgunzelman said in netdata 1.5 released - big update!:
@scottalanmiller They have a management VLAN which customer service reps have access to.
So it is external, but they VPN to the VLAN, then have one console per customer?
-
@hobbit666 you install it everywhere - it is a "smarter" agent.
-
@hobbit666 there is no multi-server overview. It is a real-time performance monitoring tool. Its purpose is to provide over the web real-time information about the metrics of each server. It is not a statistics tool.
-
@scottalanmiller if you need authentication you can run it behind another web server, like nginx or apache.
-
@scottalanmiller it is a completely different purpose. With all other monitoring solutions you get "statistics of past performance" and that's it.
With netdata you get real-time insights of everything happening in the system and its applications. And when I say everything I really mean it: everything.
My goal was not to design a prettier munin, nagios, zabbix, smokeping, etc. There are very nice tools (I really like them), but they completely fail to provide the right information.
Check for example this: https://github.com/firehol/netdata/wiki/Linux-console-tools%2C-fail-to-report-per-process-CPU-usage-properly - even top fails to properly report what is really happening in all cases.
So, netdata is a real-time performance monitoring system, similar to top, vmstat, iotop, systemd-cgtop, etc. Even if you need statistics of past performance, netdata can archive its metrics to graphite, opentstb, prometheus and the likes, so that you can visualize them with grafana (another excellent tool).
-
@scottalanmiller your browser does all the magic, not the servers. Each netdata is completely isolated to the rest. Only you (your browser) needs to have access to all of them. How you do this, it is your problem to figure out. You can use an authentication web server in proxy mode, setup a VPN, trust your static IP at firewall, tunnel it through ssh, etc
All these are your option. To understand the concept, let's assume netdata is a CGI. What would you do? Do the same.
