Step 1 - Configure EJBCA health check service

The EJBCA health check servlet offers several application-level points to be monitored, see Monitoring and Healthcheck for more information. This guide outlines how to enable and monitor the CA health check.

Step 2 - Install Monit

To install Monit, you can either build it from source or install it via OS package managers.

Step 3 - Configure Monit

By default, Monit provides a default configuration control-file named monitrc located at /etc/monitrc (Linux) that contains sample configuration examples.

Follow the steps below to create a new customized configuration file and update the configuration file to align with the services you want to monitor. Depending on your needs, this can range from being minimal without alerts to including additional services and email notifications.

To create a customized Monit control file, using a minimal or additional services example configuration, follow these steps:

1. On your server, run the following:
   

   [root@alma90 ~]# vi ~/.monitrc

2. Update your new custom configuration file with one of the following example configurations, and then save the file:

   1. Minimal configuration: The following provides a minimal example configuration:
      

      # Global

      set daemon 30 # check at 30 seconds intervals

      set log syslog

       

      # Monit host and port

      set httpd port 2812 and

      allow admin:monit # require user 'admin' with password 'monit'

       

      # EJBCA Healthcheck

      check program EJBCA[Healthcheck] with path /opt/ejbcahealthcheck.sh

      if status != 0 then alert

   2. Additional monitored services configuration: The following provides an example configuration including additional services to monitor, and an option to trigger outbound email notifications via SMTP. Note that the example values for memory, usage, and so on are just sample values and may need to be adjusted for your environment and server resources.
      

      # Global

      set daemon 30 # check services at 30 seconds intervals

      set log syslog

       

      # Monit host and port

      set httpd port 2812 and

      # use address localhost # only accept connection from localhost (drop if you use M/Monit)

      # allow localhost # allow localhost to connect to the server and

      allow admin:monit # require user 'admin' with password 'monit'

      # with ssl { # enable SSL/TLS and set path to server certificate

      # pemfile: /etc/ssl/certs/monit.pem

      # }

      #

       

      # EJBCA Healthcheck

      check program EJBCA[Healthcheck] with path /opt/ejbcahealthcheck.sh

      if status != 0 then alert

       

      # Network interface

      check network Interface[Bridge] with interface ens160

      if link down then alert

      if link down then alert

      if changed link then alert

      if saturation > 90% then alert

      if download > 10 MB/s then alert

      if total uploaded > 1 GB in last hour then alert

       

      # System resources

      check system localhost[$HOST]

      if loadavg (1min) per core > 2 for 5 cycles then alert

      if loadavg (5min) per core > 1.5 for 10 cycles then alert

      if cpu usage > 95% for 10 cycles then alert

      if memory usage > 75% then alert

      if swap usage > 25% then alert

       

      # MariaDB

      check process MariaDB

      with pidfile /var/run/mariadb/mariadb.pid

      start program = "/usr/sbin/service mysql start" with timeout 60 seconds

      stop program = "/usr/sbin/service mysql stop" with timeout 60 seconds

      if totalmem > 400 MB for 5 cycles then alert

      if totalmem > 600 MB for 5 cycles then restart

      if cpu > 60% for 3 cycles then alert

      if cpu > 80% for 3 cycles then restart

      if 2 restarts within 7 cycles then timeout

       

      # httpd

      check process HTTPD with pidfile /var/run/httpd/httpd.pid

      group apache

      start program = "/usr/bin/systemctl httpd start"

      stop program = "/usr/bin/systemctl httpd stop"

      if cpu usage > 70% for 10 cycles then restart

      if 5 restarts within 10 cycles then alert

       

      # Wildfly

      check process Wildfly matching 'standalone.sh'

      start program = "/usr/bin/systemctl wildfly start"

      stop program = "/usr/bin/systemctl wildfly stop"

      if totalmem > 3 GB for 2 cycles then restart

      if cpu usage > 90% for 5 cycles then restart

      if 5 restarts within 10 cycles then alert

       

      # Filesystem storage

      check filesystem localhost[/boot] with path /dev/nvme0n1p1

      if space usage > 70% for 5 times within 15 cycles then alert

      check filesystem localhost[/root] with path /dev/mapper/almalinux-root

      if space usage > 80% for 5 times within 15 cycles then alert

       

      ############################################################################

       

      set eventqueue

      basedir /var/monit # set the base directory where events will be stored

      slots 99999 # optionally limit the queue size

       

      ############################################################################

       

      # SMTP settings

      set mailserver smtp.yourdomain.tld

      port 465

      username "noreply@yourdomain.tld" password "pa$$wOrdHere"

      using auto

       

      # Email recipient

      set alert name.surname@company.com

       

      # Message settings

      set mail-format {

      from: Monit <noreply@yourdomain.tld>

      subject: monit alert -- $EVENT $SERVICE

      message: $EVENT Service $SERVICE

      Date: $DATE

      Action: $ACTION

      Host: $HOST

      Description: $DESCRIPTION

       

      Regards,

      MonitBot

      }

       

      ###############################################################################

      ## Includes

      ###############################################################################

      ##

      ## It is possible to include additional configuration parts from other files or

      ## directories.

      #

      include /etc/monit.d/*

      #

3. Update the control file permissions:
   

   chmod 700 /root/.monitrc

4. Once you have configured the services that you want to include for monitoring, and before launching the Monit web interface in the next step, run a syntax check for the control file:

   monit -t

Step 4 - Start Monit

Once you have configured the control file, you need to start (and enable) the monit service.

To start Monit as a service and enable it to start automatically on boot, run the following:

Step 5 - Access monitored data

The monitored data can be reached via the Monit web interface or the command line.

Useful Monit commands

The following lists some useful Monit commands and options. For a list of all available arguments and options, refer to the Monit documentation.

Print service status information (in the terminal):

Reload all daemon(s):

Stop all running daemon(s):

Run syntax check for the control file:

Start the service using a different control file:

Next steps

Monit also allows you to monitor files, directories, and filesystems for changes, such as timestamp changes, checksum changes, or size changes. For more information, refer to the Monit documentation.

To learn more about the EJBCA health check service used for health monitoring, see Monitoring and Healthcheck.

To learn how to get started with EJBCA Community as a Docker Container, you can follow the Quick Start Guide - Start EJBCA Container with Unauthenticated Network Access.

To find out more about EJBCA use cases, see Solution Areas.