Docker Container Monitoring Using PRTG
How to monitor Docker containers using PRTG, including secure setup and configuration of Docker for remote monitoring.
Monitoring your IT infrastructure provides many benefits. Discovering bottlenecks and gaining insights for predictive measures are just the beginning.
PRTG is a solid monitoring solution already present and actively used in many IT departments. Because there are a lot of different monitoring solutions out there, this guide is targeted to be compatible with the way PRTG handles Docker container monitoring.
PRTG requires the Docker socket to be exposed to the network, which is not the case in a default setup. The reason for the port not being exposed by default is security.
An exposed and unsecured port could lead to a major security issue. Anyone able to connect to the Docker socket could easily gain full control of the system – meaning root access.
Therefore, it is important to handle these configurations with care. The measure we are going to take is to secure remote access by using TLS certificates. You can read more about this in the Docker docs.
A guide on the PRTG Docker Container Sensor can be found here.
Prerequisites
To follow this guide, you will need the following:
A running instance of Cybus Connectware.
Docker installed on your system and a PRTG instance with access to that host.
Access to the Admin UI with sufficient user permissions.
Basic knowledge of MQTT, Docker, and Linux.
Certificate Generation
First, we need to create a set of certificates. There are basically two options for doing this:
Use your private company certificate authority.
Create the certificates locally.
We are going to use the second option, which means all certificates will be self-signed, which is sufficient for the purpose of this guide.
All instructions for creating the certificates can be found in the Docker docs. To simplify this, we created a small script that executes all the commands for you.
All the steps below assume you are going to use the script. The script is non-interactive, meaning you do not have to enter anything during execution. The generated certificates won’t be password protected and are valid for 50 years.
Create a directory called .docker in your home directory. This directory is the default location where the Docker CLI stores all its information.
Clone the script into the previously created directory.
Change into the directory.
Make the script executable.
Next, we need to adjust a few things within the script.
Adjust the HOST to match your hostname and the last IP of the HOSTS string to match your host IP address.
This is how it looks:
Now we are ready to execute the script.
The output should look something like this:
To verify all certificates have been generated successfully, inspect the contents of the directory.
These files should be present. If there are more files than this, that is not an issue.
The last step is to locate the full path to where the certificates are stored.
In this example, the output looks like this. Yours will look a little different.
Docker Service Configuration
With all the necessary certificates in place, we have to assign them to the Docker daemon. We can find the location of the configuration file by checking the status of the Docker service.
As stated in the output, the configuration file is located at /lib/systemd/system/docker.service:
To adjust the configuration to our needs, open the configuration file using sudo privileges.
Find the line starting with ExecStart=/usr/bin/dockerd -H fd:// and add the following content to it. Be sure to use the correct path for your setup.
In this example, the complete line looks like this:
Save the changes and restart the Docker service.
Now we can verify our changes took effect.
Now we can use the Docker CLI to connect to the Docker daemon using the specified port. The important part is to use --tlsverify=true as this tells the Docker CLI to use the generated certificates located in your home directory (~/.docker).
Remember to adjust the IP address in the second line to your individual one.
This is the output of both commands:
PRTG
The last and final step is to install the Docker sensor inside PRTG. To do this, follow the provided instructions from https://www.paessler.com/manuals/prtg/docker_container_status_sensor.
Last updated
Was this helpful?