pcp
[Top] [All Lists]

Re: [pcp] nginx PMDA error

To: Nathan Scott <nathans@xxxxxxxxxx>
Subject: Re: [pcp] nginx PMDA error
From: Tadej JaneÅ <tadej.j@xxxxxx>
Date: Thu, 10 Sep 2015 12:13:25 +0200
Cc: pcp@xxxxxxxxxxx
Delivered-to: pcp@xxxxxxxxxxx
In-reply-to: <56429816.29582957.1441838180419.JavaMail.zimbra@xxxxxxxxxx>
References: <1441613884.8358.33.camel@tlinux64> <y0m37yqkqph.fsf@xxxxxxxx> <1441790097.27574.20.camel@tlinux64> <20150909125102.GD16438@xxxxxxxxxx> <1441811714.27574.80.camel@tlinux64> <56429816.29582957.1441838180419.JavaMail.zimbra@xxxxxxxxxx>
Hi Nathan,

On Wed, 2015-09-09 at 18:36 -0400, Nathan Scott wrote:
> 
> The problem is likely to be nginx not being configured to export stats,
> (they're not enabled by default).  There's two things to check...

Indeed, I missed the part that I should configure nginx to export the
stats.

> Firstly, nginx must be compiled with HttpStubStatusModule module (this
> is on by default in Fedora). You can check that by running following
> command:
> 
> $ nginx -V 2>&1 | grep -o with-http_stub_status_module
> 
> If nothing is reported, nginx has been built without stats support, and
> it will require a recompile to resolve this.

Yes, fortunately, this module is compiled-in with nginx that is shipped
with the latest versions of Fedora and CentOS.

> Next, the server section of your /etc/nginx/nginx.conf needs to include:
> 
>         location /nginx_status {
>           stub_status on;
>           access_log off;
>           allow 127.0.0.1;
>           deny all;
>         }
> 
> Restart the nginx service, and you should see metric values.

Thanks for the nginx configuration instructions. I still had to overcome
two issues before I could get nginx's metric values:

1) I had to configure nginx to allow access via IPv6, otherwise, I would
get error messages like:
2015/09/10 08:20:26 [error] 4838#0: *1 access forbidden by rule,
client: ::1, server: _, request: "GET /nginx_status HTTP/1.1", host:
"localhost"

So the relevant part of /etc/nginx/nginx.conf should look like:

        location /nginx_status {
            stub_status on;
            access_log off;
            allow 127.0.0.1;
            allow ::1;
            deny all;
        }

2) I had to temporarily disable SELinux, otherwise, I would get SELinux
denial messages like:
type=AVC msg=audit(1441874883.417:752): avc:  denied  { name_connect }
for  pid=4754 comm="perl" dest=80
scontext=system_u:system_r:pcp_pmcd_t:s0
tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0

For 2), I don't know whether I should file this as a bug report with PCP
or distribution's (i.e. Fedora's) SELinux policy?

> There is a small bug in the error code being returned by the PMDA (from your 
> earlier
> mail), this config stuff should be documented in pmdaginx(1), and we lack
> tests for this PMDA.  I'll get those fixed up for the next PCP release,
> but you should be good to go with the configuration steps above.

I saw the commit, thanks for fixing this so quickly!

Cheers,
Tadej

<Prev in Thread] Current Thread [Next in Thread>