| 1 | <!--startmeta |
| 2 | custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/collectors/charts.d.plugin/libreswan/README.md" |
| 3 | meta_yaml: "https://github.com/netdata/netdata/edit/master/src/collectors/charts.d.plugin/libreswan/metadata.yaml" |
| 4 | sidebar_label: "Libreswan" |
| 5 | learn_status: "Published" |
| 6 | learn_rel_path: "Collecting Metrics/Collectors/Networking" |
| 7 | keywords: ['vpn', 'libreswan', 'network', 'ipsec'] |
| 8 | message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE COLLECTOR'S metadata.yaml FILE" |
| 9 | endmeta--> |
| 10 | |
| 11 | # Libreswan |
| 12 | |
| 13 | |
| 14 | <img src="https://netdata.cloud/img/libreswan.png" width="150"/> |
| 15 | |
| 16 | |
| 17 | Plugin: charts.d.plugin |
| 18 | Module: libreswan |
| 19 | |
| 20 | <img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" /> |
| 21 | |
| 22 | ## Overview |
| 23 | |
| 24 | Monitor Libreswan performance for optimal IPsec VPN operations. Improve your VPN operations with Netdata''s real-time metrics and built-in alerts. |
| 25 | |
| 26 | The collector uses the `ipsec` command to collect the information it needs. |
| 27 | |
| 28 | This collector is supported on all platforms. |
| 29 | |
| 30 | This collector supports collecting metrics from multiple instances of this integration, including remote instances. |
| 31 | |
| 32 | |
| 33 | ### Default Behavior |
| 34 | |
| 35 | #### Auto-Detection |
| 36 | |
| 37 | This integration doesn't support auto-detection. |
| 38 | |
| 39 | #### Limits |
| 40 | |
| 41 | The default configuration for this integration does not impose any limits on data collection. |
| 42 | |
| 43 | #### Performance Impact |
| 44 | |
| 45 | The default configuration for this integration is not expected to impose a significant performance impact on the system. |
| 46 | |
| 47 | ## Setup |
| 48 | |
| 49 | |
| 50 | ### Prerequisites |
| 51 | |
| 52 | #### Install charts.d plugin |
| 53 | |
| 54 | If [using our official native DEB/RPM packages](https://github.com/netdata/netdata/blob/master/packaging/installer/UPDATE.md#determine-which-installation-method-you-used), make sure `netdata-plugin-chartsd` is installed. |
| 55 | |
| 56 | |
| 57 | #### Permissions to execute `ipsec` |
| 58 | |
| 59 | The plugin executes 2 commands to collect all the information it needs: |
| 60 | |
| 61 | ```sh |
| 62 | ipsec whack --status |
| 63 | ipsec whack --trafficstatus |
| 64 | ``` |
| 65 | |
| 66 | The first command is used to extract the currently established tunnels, their IDs and their names. |
| 67 | The second command is used to extract the current uptime and traffic. |
| 68 | |
| 69 | Most probably user `netdata` will not be able to query libreswan, so the `ipsec` commands will be denied. |
| 70 | The plugin attempts to run `ipsec` as `sudo ipsec ...`, to get access to libreswan statistics. |
| 71 | |
| 72 | To allow user `netdata` execute `sudo ipsec ...`, create the file `/etc/sudoers.d/netdata` with this content: |
| 73 | |
| 74 | ``` |
| 75 | netdata ALL = (root) NOPASSWD: /sbin/ipsec whack --status |
| 76 | netdata ALL = (root) NOPASSWD: /sbin/ipsec whack --trafficstatus |
| 77 | ``` |
| 78 | |
| 79 | Make sure the path `/sbin/ipsec` matches your setup (execute `which ipsec` to find the right path). |
| 80 | |
| 81 | |
| 82 | |
| 83 | ### Configuration |
| 84 | |
| 85 | #### Options |
| 86 | |
| 87 | The config file is sourced by the charts.d plugin. It's a standard bash file. |
| 88 | |
| 89 | The following collapsed table contains all the options that can be configured for the libreswan collector. |
| 90 | |
| 91 | |
| 92 | <details open><summary>Config options</summary> |
| 93 | |
| 94 | |
| 95 | |
| 96 | | Option | Description | Default | Required | |
| 97 | |:-----|:------------|:--------|:---------:| |
| 98 | | libreswan_update_every | The data collection frequency. If unset, will inherit the netdata update frequency. | 1 | no | |
| 99 | | libreswan_priority | The charts priority on the dashboard | 90000 | no | |
| 100 | | libreswan_retries | The number of retries to do in case of failure before disabling the collector. | 10 | no | |
| 101 | | libreswan_sudo | Whether to run `ipsec` with `sudo` or not. | 1 | no | |
| 102 | |
| 103 | |
| 104 | </details> |
| 105 | |
| 106 | |
| 107 | |
| 108 | #### via File |
| 109 | |
| 110 | The configuration file name for this integration is `charts.d/libreswan.conf`. |
| 111 | |
| 112 | The file format is POSIX shell script. Generally, the structure is: |
| 113 | |
| 114 | ```sh |
| 115 | OPTION_1="some value" |
| 116 | OPTION_2="some other value" |
| 117 | ``` |
| 118 | You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the |
| 119 | Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory). |
| 120 | |
| 121 | ```bash |
| 122 | cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata |
| 123 | sudo ./edit-config charts.d/libreswan.conf |
| 124 | ``` |
| 125 | |
| 126 | ##### Examples |
| 127 | |
| 128 | ###### Run `ipsec` without sudo |
| 129 | |
| 130 | Run the `ipsec` utility without sudo |
| 131 | |
| 132 | ```yaml |
| 133 | # the data collection frequency |
| 134 | # if unset, will inherit the netdata update frequency |
| 135 | #libreswan_update_every=1 |
| 136 | |
| 137 | # the charts priority on the dashboard |
| 138 | #libreswan_priority=90000 |
| 139 | |
| 140 | # the number of retries to do in case of failure |
| 141 | # before disabling the module |
| 142 | #libreswan_retries=10 |
| 143 | |
| 144 | # set to 1, to run ipsec with sudo (the default) |
| 145 | # set to 0, to run ipsec without sudo |
| 146 | libreswan_sudo=0 |
| 147 | |
| 148 | ``` |
| 149 | |
| 150 | |
| 151 | ## Alerts |
| 152 | |
| 153 | There are no alerts configured by default for this integration. |
| 154 | |
| 155 | |
| 156 | ## Metrics |
| 157 | |
| 158 | Metrics grouped by *scope*. |
| 159 | |
| 160 | The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels. |
| 161 | |
| 162 | |
| 163 | |
| 164 | ### Per IPSEC tunnel |
| 165 | |
| 166 | Metrics related to IPSEC tunnels. Each tunnel provides its own set of the following metrics. |
| 167 | |
| 168 | This scope has no labels. |
| 169 | |
| 170 | Metrics: |
| 171 | |
| 172 | | Metric | Dimensions | Unit | |
| 173 | |:------|:----------|:----| |
| 174 | | libreswan.net | in, out | kilobits/s | |
| 175 | | libreswan.uptime | uptime | seconds | |
| 176 | |
| 177 | |
| 178 | |
| 179 | ## Troubleshooting |
| 180 | |
| 181 | ### Debug Mode |
| 182 | |
| 183 | |
| 184 | To troubleshoot issues with the `libreswan` collector, run the `charts.d.plugin` with the debug option enabled. The output |
| 185 | should give you clues as to why the collector isn't working. |
| 186 | |
| 187 | - Navigate to the `plugins.d` directory, usually at `/usr/libexec/netdata/plugins.d/`. If that's not the case on |
| 188 | your system, open `netdata.conf` and look for the `plugins` setting under `[directories]`. |
| 189 | |
| 190 | ```bash |
| 191 | cd /usr/libexec/netdata/plugins.d/ |
| 192 | ``` |
| 193 | |
| 194 | - Switch to the `netdata` user. |
| 195 | |
| 196 | ```bash |
| 197 | sudo -u netdata -s |
| 198 | ``` |
| 199 | |
| 200 | - Run the `charts.d.plugin` to debug the collector: |
| 201 | |
| 202 | ```bash |
| 203 | ./charts.d.plugin debug 1 libreswan |
| 204 | ``` |
| 205 | |
| 206 | ### Getting Logs |
| 207 | |
| 208 | If you're encountering problems with the `libreswan` collector, follow these steps to retrieve logs and identify potential issues: |
| 209 | |
| 210 | - **Run the command** specific to your system (systemd, non-systemd, or Docker container). |
| 211 | - **Examine the output** for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem. |
| 212 | |
| 213 | #### System with systemd |
| 214 | |
| 215 | Use the following command to view logs generated since the last Netdata service restart: |
| 216 | |
| 217 | ```bash |
| 218 | journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep libreswan |
| 219 | ``` |
| 220 | |
| 221 | #### System without systemd |
| 222 | |
| 223 | Locate the collector log file, typically at `/var/log/netdata/collector.log`, and use `grep` to filter for collector's name: |
| 224 | |
| 225 | ```bash |
| 226 | grep libreswan /var/log/netdata/collector.log |
| 227 | ``` |
| 228 | |
| 229 | **Note**: This method shows logs from all restarts. Focus on the **latest entries** for troubleshooting current issues. |
| 230 | |
| 231 | #### Docker Container |
| 232 | |
| 233 | If your Netdata runs in a Docker container named "netdata" (replace if different), use this command: |
| 234 | |
| 235 | ```bash |
| 236 | docker logs netdata 2>&1 | grep libreswan |
| 237 | ``` |
| 238 | |
| 239 |