Setting up monitoring

So, Checkmk is ready. But before we start with the actual monitoring, we will briefly explain some important terms. First of all, there is the host. A host in Checkmk is any stand alone, physical or virtual system monitored by Checkmk. Usually these are things with their own IP address (servers, switches, SNMP devices, virtual machines), but also, for example, Docker containers or other logical objects which do not have such an IP address. Each host always has one of the states UP, DOWN, UNREACH or PEND.

On each host a number of services are monitored. A service can be anything — for example, a file system, a process, a hardware sensor, a switch port — but it can also simply be a certain metric such as CPU utilization or RAM usage. Each service can have one of the states OK, WARN, CRIT, UNKNOWN or PEND.

In order for Checkmk to be able to request data from a host, an agent is necessary. This is a small program that is installed on the host and which provides data on the state (or 'health') of the host on request. Servers running Windows, Linux, or Unix can only be effectively monitored by Checkmk if you install a Checkmk agent there — an agent provided by us. In the case of network devices and many appliances, the manufacturer will usually have built-in an agent that Checkmk can easily query using the standardized SNMP protocol. Cloud services such as Amazon Web Services (AWS) or Azure alternatively provide an interface ('API') that can be queried by Checkmk via HTTP.

Even though Checkmk does not require name resolution of hosts, a well-maintained Domain Name System (DNS) makes configuration much easier and avoids errors, since Checkmk will then be able to resolve the host names on its own without you needing to enter IP addresses in Checkmk.

So setting up a monitoring system is a good opportunity to check whether your DNS is up-to-date and, if necessary, to add any missing entries.

Checkmk manages your hosts in a hierarchical tree of folders — quite analogous to what you know from files in your operating system. If you only monitor a handful of hosts, this may seem not so important to you. But remember — Checkmk is designed to monitor thousands and tens of thousands of hosts — so good order can be half the battle won.

Before you include the first hosts into Checkmk, it is therefore advantageous to think about the structure of these folders. On the one hand, the folder structure is useful for your own overview. More importantly, however, it can be used for the configuration of Checkmk. All configuration attributes of hosts can be defined in a folder, which are then automatically inherited by its subfolders and hosts contained there. Therefore, it is elementary, not only but especially for the configuration of large environments, to set up a well-considered folder structure from the beginning.

Once you have created a folder structure, you can change it — but you must do so very carefully. Moving a host to another folder can have the effect of changing its attributes without you being aware of it.

The real consideration when building a folder structure that will be most useful to you is the criteria by which you want to organize the folders. The criteria can be different at each level of the tree. For example, you can distinguish by location in the first level and by technology in the second level.

The following classification criteria have proven themselves in practice:

Sorting by location is particularly obvious in larger companies, especially if you distribute the monitoring over several Checkmk servers. Each server then monitors a region or a state/country, for example. If your folders map this distribution, then you can define, for example, in the folder 'Munich' that all hosts in this folder are to be monitored from the Checkmk site 'muc'.

Alternatively, 'organization' (i.e. the answer to the question 'Who is responsible for a host?') may be a more meaningful criterion, since location and responsibility may not always be the same. For example, it may be that one group of your colleagues is responsible for the administration of Oracle, regardless of the actual physical location of the corresponding hosts. If, for example, the folder 'Oracle' is intended for the hosts of the Oracle colleagues, it is easy to configure in Checkmk that all hosts below this folder are only visible to these colleagues and that they can even maintain their hosts there themselves.

Structuring by technology could, for example, provide a folder for Windows servers and one for Linux servers. This would simplify the implementation of the scheme 'The sshd process must run on all Linux servers'. Another example is the monitoring of devices such as switches or routers via SNMP. Here, no Checkmk agent is used, but the devices are queried via the SNMP protocol. If these hosts are grouped in separate folders, you can make the settings necessary for SNMP, such as the 'Community', directly at the folder.

Since a folder structure can only rarely reflect the complexity of reality, Checkmk provides another supplementary possibility for structuring using the host tags — but more on this in a separate chapter on fine-tuning the monitoring. For more information on the folder structure, among other things, see the article on hosts.

You can access the administration of folders and hosts via the navigation bar, the Setup menu, the Hosts topic and the Hosts entry. The Main page is then displayed:

Before we create the first folder, we will briefly discuss the structure of this page, since you will find the various elements on most Checkmk pages in the same or a similar format. Below the page title Main you will find the breadcrumb path, which shows you where you are currently located within the Checkmk interface. Below this, the menu bar is displayed, which summarizes the possible actions on this page in menus and menu items. The menus in Checkmk are always context-specific, i.e. you will only find menu entries for actions that make sense on the current page.

Below the menu bar you will find the action bar, in which the most important actions in the menus are offered as buttons for direct clicking. You can hide the action bar with the button to the right of the Help menu and show it again with . When the action bar is hidden, the icons are displayed in the menu bar to the right of .

Since we are currently on an empty page (without folders and without hosts), the important actions for creating the first object are additionally offered via even larger buttons — so that the options offered by the page cannot be overlooked. These buttons will disappear after the first object has been created.

Now let’s get back to the reason we are on this page: the creation of folders. One folder — the main folder — exists in every freshly set up Checkmk system. It is called the Main, as you can see in the title of the page. Below the main folder, we will now create the three folders Windows, Linux, and Network as a simple exercise.

Create the first of the three folders by selecting one of the actions offered to create a folder, e.g. the Add folder button. On the new page Add folder enter the folder name in the first box Basic settings:

In the above image, the Show less mode is active and only the entry that is absolutely necessary for creating a folder is displayed. Confirm the entry with Save.

Analogous to the Windows folder, create the other two folders Linux and Network. After that, the situation will look like this:

Tip: When you point the mouse at the tab or the top of a folder icon, the folder unfolds to reveal the icons you need to perform important actions with the folder (change the properties, move the folder or delete it).

One more tip: At the top right of each page you will find the information whether — and if so, how many — changes have already been accumulated in the meantime. Since we have created three folders, there are three changes, but they do not need to be activated yet. We will deal with activating changes in more detail below.

Now everything is in place and ready for the first host to be added the monitoring — and what could be more obvious than to monitor the Checkmk server itself? Checkmk won’t be able to report its own total failure of course, but this is still useful since not only does it give you an overview of CPU and RAM usage, but also a number of metrics and checks concerning the Checkmk system itself.

The procedure for including a Linux host (as well as a Windows host, by the way) is in principle always as follows:

Finally, once the host has been created in the configuration environment, the services can be configured and the changes activated for the monitoring environment.

Just as for Linux, Checkmk also has its own agent for Windows. This is packaged as an MSI package. You will find it just one menu entry away from the Linux agent. Once you have downloaded the MSI package and copied it to your Windows computer, you can install it by double-clicking, as is usual with Windows.

Once the agent has been installed, you can create the host in Checkmk, register it by command, and add it to the monitoring. Follow the same procedure as described above for the Linux host, but create the host in the designated Windows folder. Since Windows is structured differently from Linux, the agent will naturally find other services. For a detailed introduction to this subject, see the article on monitoring Windows.

Professional quality switches, routers, printers and many other devices and appliances already have a built-in interface for monitoring from the manufacturer — the Simple Network Management Protocol (SNMP). Such devices can be monitored very easily with Checkmk — and you don’t even need to install an agent.

The basic procedure is always the same:

For the above last three points (4, 5, 6), the result should look like in the following screenshot:

Tip: If you have created all SNMP devices in a separate folder, simply carry out the configuration of the Monitoring agents for the folder. This will automatically apply these settings to all the hosts in this folder.

The rest runs as usual. If you want, you can take a look at the Test connection to host page with the Save & go to connection tests button. There you can immediately see whether access via SNMP works, here for a Cisco Catalyst 4500 switch, for example:

On the Properties of host page, click on Save & go to service configuration to display the list of all services. This naturally looks completely different from Linux or Windows. On all devices, by default Checkmk monitors all ports that are currently in use. You can customize this later as you wish. In addition, one service that is always OK shows you the general information about the device, and another service shows you the uptime.

A detailed description can be found in the article on monitoring via SNMP.

You can also monitor cloud services, containers and virtual machines (VM) with Checkmk, even if you do not have access to the actual servers. Checkmk uses the application programming interfaces (API) provided by the manufacturers for this purpose. These interfaces always use HTTP or HTTPS for access.

The basic principle is always the following:

You can find step-by-step instructions for setting up monitoring of Amazon Web Services (AWS), Microsoft Azure, Docker, Kubernetes and VMWare ESXi in the User guide.

Continue with the monitoring tools