so-monitor-add

[ng1991]

Hi All,

Recently I added a new monitor interface and used the so-monitor-add command, this worked and I started to see the data and didn't think much more on it.

I rebooted the host and the so-status showed everything good. I then however noticed that we was receiving 0 traffic and the new interface I added was not in bond0, I also noticed the same behavior on another host which I had done the same on.

Below is from grafana "Monitor Interface Traffic" Chart (I am going to add alerts for this going forward):

To fix this I ran the so-monitor-add again and this rectified the issue on both hosts, is their a way to make this command permanent, does something need amending on the pillar on the manager?

I could re-run the setup or add this as a job when the host boots to run the command but that seems drastic/unnecessary

Thanks in advance

[reyesj2]

nmcli device

On the far right under "CONNECTION" you'll see bond0 followed by bond0-slave- for every interface configured to be a slave to bond0.

After verifying the NICs you need to monitor are members of the bonded interface verify your sensor is monitoring bond0 and not one specific port.

sudo salt "*_sensor" pillar.get sensor:interface

Output will show bond0 or the specific interface you are configured to monitor. In which case you will need to edit it in /opt/so/saltstack/local/pillar/minions/<sensor_hostname>.sls

[ng1991]

Hi Reyesj2,

Thanks for your reply the interface on one of the sensors I am adding is p1p4, when i run the command and it adds to bond0 I see the traffic it just doesnt appear to be persistent and is not isolated to this one host which is making me think the manager is maybe controlling what is added to the bond on startup.

Below is the results of nmcli device

The second command does confirm that that bond 0 interface is monitored.

Any other advice will be appreciated but it may be quicker if no obvious reason for me to re-run the setup as when selecting the monitor interfaces this way I have never had any issues.

[reyesj2]

I find it unusual that you have devices listed under CONNECTION which are identified as "System". I do not have this on my sensors or standalone deployments.
Is it possible that you have an extra configuration for the p1p4 interface in /etc/sysconfig/network-scripts/ifcfg-p1p4 There will be a file there named ifcfg-bond0-slave-p1p4 which is expected after running so-monitor-add. Looking for redundant configurations for the same interface.