2.8. Monitor Configuration

[TAG=Monitor Configuration] [TAG=Configuration->Monitor]

The Monitor configuration file is a stripped down version of the Director configuration file, mixed with a Console configuration file. It simply contains the information necessary to contact Directors, Clients, and Storage daemons you want to monitor.

For a general discussion of configuration file and resources including the data types recognized by Bareos, please see the Configuration chapter of this manual.

The following Monitor Resource definition must be defined:

  • Monitor – to define the Monitor’s name used to connect to all the daemons and the password used to connect to the Directors. Note, you must not define more than one Monitor resource in the Monitor configuration file.
  • At least one Client, Storage or Director resource, to define the daemons to monitor.

2.8.1. Monitor Resource

[TAG=Monitor Resource] [TAG=Resource->Monitor]

The Monitor resource defines the attributes of the Monitor running on the network. The parameters you define here must be configured as a Director resource in Clients and Storages configuration files, and as a Console resource in Directors configuration files.

begin{description}

resourceDirective{Console}{Monitor}{Description}{dt{String}}{}{}{}{}

resourceDirective{Console}{Monitor}{Dir Connect Timeout}{dt{Time}}{}{10}{}{}

resourceDirective{Console}{Monitor}{FD Connect Timeout}{dt{Time}}{}{10}{}{}

resourceDirective{Console}{Monitor}{Name}{dt{Name}}{required}{}{}{}

resourceDirective{Console}{Monitor}{Password}{dt{Md5password}}{required}{}{}{}

resourceDirective{Console}{Monitor}{Refresh Interval}{dt{Time}}{}{60}{}{}

resourceDirective{Console}{Monitor}{Require SSL}{dt{Boolean}}{}{no}{}{}

resourceDirective{Console}{Monitor}{SD Connect Timeout}{dt{Time}}{}{10}{}{}

end{description}

2.8.2. Director Resource

[TAG=Director Resource] [TAG=Resource->Director]

The Director resource defines the attributes of the Directors that are monitored by this Monitor.

As you are not permitted to define a Password in this resource, to avoid obtaining full Director privileges, you must create a Console resource in the Director’s configuration file, using the Console Name and Password defined in the Monitor resource. To avoid security problems, you should configure this Console resource to allow access to no other daemons, and permit the use of only two commands: status and .status (see below for an example).

You may have multiple Director resource specifications in a single Monitor configuration file.

begin{description}

resourceDirective{Console}{Director}{Address}{dt{String}}{required}{}{}{}

resourceDirective{Console}{Director}{Description}{dt{String}}{}{}{}{}

resourceDirective{Console}{Director}{Dir Port}{dt{Pint32}}{}{9101}{}{}

resourceDirective{Console}{Director}{Enable SSL}{dt{Boolean}}{}{no}{}{}

resourceDirective{Console}{Director}{Name}{dt{Name}}{required}{}{}{}

end{description}

2.8.3. Client Resource

[TAG=Resource->Client] [TAG=Client Resource]

The Client resource defines the attributes of the Clients that are monitored by this Monitor.

You must create a Director resource in the Client’s configuration file, using the Director Name defined in the Monitor resource. To avoid security problems, you should set the Monitor directive to Yes in this Director resource.

You may have multiple Director resource specifications in a single Monitor configuration file.

begin{description}

resourceDirective{Console}{Client}{Address}{dt{String}}{required}{}{}{}

resourceDirective{Console}{Client}{Description}{dt{String}}{}{}{}{}

resourceDirective{Console}{Client}{Enable SSL}{dt{Boolean}}{}{no}{}{}

resourceDirective{Console}{Client}{FD Port}{dt{Pint32}}{}{9102}{}{}

resourceDirective{Console}{Client}{Name}{dt{Name}}{required}{}{}{}

resourceDirective{Console}{Client}{Password}{dt{Md5password}}{required}{}{}{}

end{description}

2.8.4. Storage Resource

[TAG=Resource->Storage] [TAG=Storage Resource]

The Storage resource defines the attributes of the Storages that are monitored by this Monitor.

You must create a Director resource in the Storage’s configuration file, using the Director Name defined in the Monitor resource. To avoid security problems, you should set the Monitor directive to Yes in this Director resource.

You may have multiple Director resource specifications in a single Monitor configuration file.

begin{description}

resourceDirective{Console}{Storage}{Address}{dt{String}}{required}{}{}{}

resourceDirective{Console}{Storage}{Description}{dt{String}}{}{}{}{}

resourceDirective{Console}{Storage}{Enable SSL}{dt{Boolean}}{}{no}{}{}

resourceDirective{Console}{Storage}{Name}{dt{Name}}{required}{}{}{}

resourceDirective{Console}{Storage}{Password}{dt{Md5password}}{required}{}{}{}

resourceDirective{Console}{Storage}{SD Address}{dt{String}}{}{}{}{}

resourceDirective{Console}{Storage}{SD Password}{dt{Md5password}}{}{}{}{}

resourceDirective{Console}{Storage}{SD Port}{dt{Pint32}}{}{9103}{}{}

end{description}

2.8.5. Tray Monitor

2.8.5.1. Tray Monitor Security

[TAG=Tray Monitor Security] [TAG=Security->Tray Monitor]

There is no security problem in relaxing the permissions on tray-monitor.conf as long as FD, SD and DIR are configured properly, so the passwords contained in this file only gives access to the status of the daemons. It could be a security problem if you consider the status information as potentially dangerous (most people consider this as not being dangerous).

Concerning Director’s configuration:
In tray-monitor.conf, the password in the Monitor resource must point to a restricted console in bareos-dir.conf (see the documentation). So, if you use this password with bconsole, you’ll only have access to the status of the director (commands status and .status). It could be a security problem if there is a bug in the ACL code of the director.
Concerning File and Storage Daemons’ configuration:
In tray-monitor.conf, the Name in the Monitor resource must point to a Director resource in bareos-fd/sd.conf, with the Monitor directive set to Yes (see the documentation). It could be a security problem if there is a bug in the code which check if a command is valid for a Monitor (this is very unlikely as the code is pretty simple).

2.8.5.2. Example Tray Monitor configuration

[TAG=Tray Monitor->Configuration] [TAG=Configuration->Tray Monitor]

An example Tray Monitor configuration file might be the following:

Example tray-monitor.conf
#
# Bareos Tray Monitor Configuration File
#
Monitor {
  Name = rufus-mon        # password for Directors
  Password = "GN0uRo7PTUmlMbqrJ2Gr1p0fk0HQJTxwnFyE4WSST3MWZseR"
  RefreshInterval = 10 seconds
}

Client {
  Name = rufus-fd
  Address = rufus
  FDPort = 9102           # password for FileDaemon
  Password = "FYpq4yyI1y562EMS35bA0J0QC0M2L3t5cZObxT3XQxgxppTn"
}
Storage {
  Name = rufus-sd
  Address = rufus
  SDPort = 9103           # password for StorageDaemon
  Password = "9usxgc307dMbe7jbD16v0PXlhD64UVasIDD0DH2WAujcDsc6"
}
Director {
  Name = rufus-dir
  DIRport = 9101
  address = rufus
}

Example File daemon’s Director record

Example Monitor resource
#
# Restricted Director, used by tray-monitor to get the
#   status of the file daemon
#
Director {
  Name = rufus-mon
  Password = "FYpq4yyI1y562EMS35bA0J0QC0M2L3t5cZObxT3XQxgxppTn"
  Monitor = yes
}

A full example can be found at Example Client Configuration File.

Example Storage daemon’s Director record

Example Monitor resource
#
# Restricted Director, used by tray-monitor to get the
#   status of the storage daemon
#
Director {
  Name = rufus-mon
  Password = "9usxgc307dMbe7jbD16v0PXlhD64UVasIDD0DH2WAujcDsc6"
  Monitor = yes
}

Example Director’s Console record

Example Monitor resource
#
# Restricted console used by tray-monitor to get the status of the director
#
Console {
  Name = Monitor
  Password = "GN0uRo7PTUmlMbqrJ2Gr1p0fk0HQJTxwnFyE4WSST3MWZseR"
  CommandACL = status, .status
}