InfluxDB External

[mmaxwell-dc]

Version

2.4.140

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

128

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Is it possible to have InfluxDB collecting metrics from other sources? I'm having some trouble getting access to it from outside the SO environment. I've confirmed there are no firewalls on the source or target, all on same subnet, ping working fine with packets being sent/collected for other information capturing. I'm unsure if InfluxDB is meant to remain internal and just collect SO metrics, but I wanted to utilise it for one of my hypervisors.
I can reach https://:443/influxdb but I know its running internally on 8086, just not connecting. I've tried connecting with multiple different protocols just to see. I've also confirmed that the certificates are trusted on both sides, so no issues there. This is a homelab setup so happy to tweak with it as needed!

Again - just want to see if this is possible or if it should just be kept for internal SO metrics. Appreciate any input or guidance from anyone, thank you!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

It would probably be easier to install the Elastic agent and collect system metrics through the system integration.

How are you trying to send the metrics to influxdb?

[mmaxwell-dc]

Hey Chris!
I did end up setting up another influxDB container on another host and confirmed pretty instantly that it was receiving data.
I was using Proxmox for my lab hypervisor and they have a built in metric server config that just sends the data from the cluster to InfluxDB. If I set it up to point to the SO influxDB, it would just time out and not be able to reach it. I figured its something to do with the container network exposure, as I couldn't reach https://:8086 externally, but could see it was mapped.
When I set the metric server to my new influxDB server, it would sent the data instantly and I could create the visualizations.

I was more curious if this was a deliberate restriction on SecurityOnion to just collect the internal metrics and not expose it for any other collectors.

[cm-ops]

We use telegraf to send to influxdb, did you look at the telegraf.conf to see the output? Perhaps you were missing the bucket, token, and TLS stuff?