check-mongodb-plugins

About

• this repository contains a collection of Icinga / Nagios plugins to monitor a MongoDB database
• tested with MongoDB 4.2, 4.4 and 5.0
• Written for python3
• Minimal dependencies (only required non-default library is toml)

Documentation

• check_mongodb_stats.py
• check_mongodb_dbsize.py

Configuration

Python setup

• Make sure python 3.x is installed on the machine
• Install toml library
  • pip3 install toml

Configuring the database connection settings

• For security reasons these plugins do not accept the connections parameters for the database as arguments

• Instead the plugins reads the parametes from a hidden toml-formatted configuration file

  • Default: /etc/nagios/.mdbservice, use --credentialfile=/path/to/your/filefor a non-default location
  • Ideally change the file owner and permissions of .mdbservice so that only the user executing the plugins can read the config file

  [localhost]
  hostname="localhost"
  port=27017
  user="yourdbuser"
  pw="secretpassword"
  authdb="admin"
  tls=true
  tlscafile="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"

Parameters

• [instancename] : you can configure multiple connections within one .mdbservice-file. This config section name corresponds with the --instance-argument of the plugin
• hostname : optional, defaults to localhost
• port : optional, defaults to 27017
• user : optional
• pw : optional
• authdb : optional, defaults to admin
• tls : true/false, defaults to true
• tlscafile : Path to cacerts file for TLS certificate validation
• tls_allow_invalid_hostnames : true/false, connect to MongoDB via TLS even if the CommonName/SubjectAlternativeName of the Cert does not match our Servername. Defaults to false
• tls_allow_invalid_certificates: true/false, connect to MongoDB via TLS even if the TLS-Certificate is invalid (i.e. expired). Defaults to false

Configuring database use

• Open a MongoDB DB shell, create a dedicated monitoring user and assign the clusterMonitor role

  use admin
  db.createUser(
    {
        user: "monitoring",
        pwd: passwordPrompt(),
        roles: [
            { role: "clusterMonitor", db: "admin" }
        ]
    }
  )