Nightingale 集成之 LDAP 监控基于 cnMonitor 采集 OpenLDAP 与 389ds 服务器指标【免费下载链接】nightingaleNightingale is to monitoring and alerting what Grafana is to visualization.项目地址: https://gitcode.com/GitHub_Trending/ni/nightingaleNightingale 在integrations/目录下为各类可观测对象提供了开箱即用的采集与告警集成其中Ldap组件负责采集 LDAP 服务器的cnMonitor监控后端指标目前覆盖 OpenLDAP 与 389ds 两大类服务器。本文以该组件的 官方文档 为主体结合仓库内的 采集配置样本、内置告警规则 与 集成中心加载源码完整讲解插件的工作原理、两种方言dialect的指标体系、参数配置方法与排障思路读完即可将 LDAP 服务器的连接、线程、操作量等核心健康指标接入 Nightingale 并配置告警。插件概述与工作前提该插件从 LDAP 服务器的监控后端cnMonitor采集指标。OpenLDAP 与 389ds 都内建了这一监控子系统cnMonitor子树中记录了连接、线程、操作、统计等运行时数据插件通过 LDAP 协议读取这些条目并转换为时序指标。要使用该插件必须先在 LDAP 服务器上启用监控后端/监控插件OpenLDAP启用 monitor 后端如加载monitor模块并配置olcModuleLoad、在slapd.conf或cnconfig中声明 monitor 数据库详细做法见 OpenLDAP 官方 Monitoring slapd 文档389ds启用相应的监控功能具体步骤见 389ds 官方文档。前置条件满足后指标是否产出、指标名长什么样取决于所选用的服务器方言dialect。采集配置详解在 Nightingale 集成中心中每个组件都对应 categraf 配置语法与指标命名的权威样本Ldap组件的配置样本位于 integrations/Ldap/collect/ldap/ldap.toml。核心参数如下# # collect interval # interval 15 [[instances]] # # append some labels for series # labels { regioncloud, productn9e } # # interval global.interval * interval_times # interval_times 1 ## Server to monitor ## The scheme determines the mode to use for connection with ## ldap://... -- unencrypted (non-TLS) connection ## ldaps://... -- TLS connection ## starttls://... -- StartTLS connection ## If no port is given, the default ports, 389 for ldap and starttls and ## 636 for ldaps, are used. #server ldap://localhost ## Server dialect, can be openldap or 389ds # dialect openldap # DN and password to bind with ## If bind_dn is empty an anonymous bind is performed. bind_dn bind_password ## Reverse the field names constructed from the monitoring DN # reverse_field_names false ## Optional TLS Config # use_tls false # tls_ca /etc/categraf/ca.pem # tls_cert /etc/categraf/cert.pem # tls_key /etc/categraf/key.pem ## Use TLS but skip chain host verification # insecure_skip_verify false各参数含义与取值说明参数默认值说明interval全局采集间隔采集周期单位为秒可单独为本实例指定labels无为指标追加的附加标签如regioncloud、productn9einterval_times1实际采集间隔 全局interval×interval_timesserverldap://localhost要监控的服务器地址。scheme 决定连接模式ldap://为明文非 TLS 连接ldaps://为 TLS 连接starttls://为 StartTLS 连接未给出端口时ldap与starttls默认使用 389 端口ldaps默认使用 636 端口dialectopenldap服务器方言取值openldap或389ds决定指标命名规则与解析逻辑bind_dn空绑定用的 DN为空时执行匿名绑定bind_password空绑定密码配合bind_dn使用reverse_field_namesfalse是否反转从监控 DN 构造出的字段名顺序use_tlsfalse是否启用 TLStls_ca/etc/categraf/ca.pemCA 证书路径tls_cert/etc/categraf/cert.pem客户端证书路径tls_key/etc/categraf/key.pem客户端私钥路径insecure_skip_verifyfalse使用 TLS 但跳过证书链与主机名校验测试环境慎用Tags所有指标都会携带以下标签用于区分被监控的服务器实例server—— 服务器名称或 IP取自server配置中的主机部分port—— 建立连接所用的端口如 389、636labels中追加的自定义标签会作为额外标签一并写入时序数据便于跨维度聚合。openldap 方言指标与示例输出使用openldap方言时指标以openldap_为前缀覆盖连接数、线程池、各类 LDAP 操作bind/search/add/modify/delete/compare/modrdn/extended/unbind/abandon的发起与完成计数、PDU 与字节统计、条目统计、文件描述符等是判断 slapd 运行状态的核心数据。完整输出示例如下示例环境agent_hostnamezy-fat port389 serverlocalhostopenldap_modify_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_referrals_statistics agent_hostnamezy-fat port389 serverlocalhost 0 openldap_unbind_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_delete_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_extended_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_pdu_statistics agent_hostnamezy-fat port389 serverlocalhost 42 openldap_starting_threads agent_hostnamezy-fat port389 serverlocalhost 0 openldap_active_threads agent_hostnamezy-fat port389 serverlocalhost 1 openldap_uptime_time agent_hostnamezy-fat port389 serverlocalhost 102 openldap_bytes_statistics agent_hostnamezy-fat port389 serverlocalhost 3176 openldap_compare_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_bind_operations_completed agent_hostnamezy-fat port389 serverlocalhost 1 openldap_total_connections agent_hostnamezy-fat port389 serverlocalhost 1002 openldap_search_operations_completed agent_hostnamezy-fat port389 serverlocalhost 1 openldap_abandon_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_add_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_open_threads agent_hostnamezy-fat port389 serverlocalhost 1 openldap_add_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 3 openldap_write_waiters agent_hostnamezy-fat port389 serverlocalhost 0 openldap_entries_statistics agent_hostnamezy-fat port389 serverlocalhost 41 openldap_modrdn_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_pending_threads agent_hostnamezy-fat port389 serverlocalhost 0 openldap_max_pending_threads agent_hostnamezy-fat port389 serverlocalhost 0 openldap_bind_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 1 openldap_max_file_descriptors_connections agent_hostnamezy-fat port389 serverlocalhost 1024 openldap_compare_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_search_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 2 openldap_modrdn_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_read_waiters agent_hostnamezy-fat port389 serverlocalhost 1 openldap_backload_threads agent_hostnamezy-fat port389 serverlocalhost 1 openldap_current_connections agent_hostnamezy-fat port389 serverlocalhost 1 openldap_unbind_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_delete_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_extended_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_modify_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 0 openldap_max_threads agent_hostnamezy-fat port389 serverlocalhost 16 openldap_abandon_operations_completed agent_hostnamezy-fat port389 serverlocalhost 0 openldap_operations_completed agent_hostnamezy-fat port389 serverlocalhost 2 openldap_database_2_databases agent_hostnamezy-fat port389 serverlocalhost 0关键指标速查指标含义典型关注点openldap_current_connections/openldap_total_connections当前连接数 / 累计连接总数当前连接数逼近max_file_descriptors_connections时存在文件描述符耗尽风险openldap_max_file_descriptors_connections文件描述符上限对应的最大连接数与current_connections对比计算连接饱和度openldap_active_threads/openldap_max_threads活跃线程数 / 最大线程数活跃线程长期贴近上限意味着线程池饱和openldap_pending_threads/openldap_max_pending_threads/openldap_backload_threads等待中的线程数 / 最大等待线程数 / 积压线程数pending_threads 0表示请求已开始排队openldap_operations_initiated/openldap_operations_completed发起操作总数 / 完成操作总数两者差值持续扩大说明有操作卡住openldap_op_operations_initiated/..._completed各类 LDAP 操作bind/search/add/modify/delete/compare/modrdn/extended/unbind/abandon的发起与完成计数定位具体卡住的操作类型openldap_uptime_time进程运行时长秒突然回落到很小的值说明刚发生过重启openldap_entries_statistics/openldap_bytes_statistics/openldap_pdu_statistics条目、字节、PDU 统计反映请求处理规模openldap_read_waiters/openldap_write_waiters读/写等待者数量持续非零说明 IO 存在阻塞389ds 方言指标与示例输出使用389ds方言时指标以389ds_为前缀命名与 OpenLDAP 不同更贴近 389 Directory Server 的监控计数器。完整输出示例如下389ds_current_connections_at_max_threads agent_hostnamezy-fat port389 serverlocalhost 0 389ds_connections_max_threads agent_hostnamezy-fat port389 serverlocalhost 0 389ds_add_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_dtablesize agent_hostnamezy-fat port389 serverlocalhost 63936 389ds_strongauth_binds agent_hostnamezy-fat port389 serverlocalhost 13 389ds_modrdn_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_maxthreads_per_conn_hits agent_hostnamezy-fat port389 serverlocalhost 0 389ds_current_connections agent_hostnamezy-fat port389 serverlocalhost 2 389ds_security_errors agent_hostnamezy-fat port389 serverlocalhost 0 389ds_entries_sent agent_hostnamezy-fat port389 serverlocalhost 13 389ds_cache_entries agent_hostnamezy-fat port389 serverlocalhost 0 389ds_backends agent_hostnamezy-fat port389 serverlocalhost 0 389ds_threads agent_hostnamezy-fat port389 serverlocalhost 17 389ds_connections agent_hostnamezy-fat port389 serverlocalhost 2 389ds_read_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_entries_returned agent_hostnamezy-fat port389 serverlocalhost 13 389ds_unauth_binds agent_hostnamezy-fat port389 serverlocalhost 0 389ds_search_operations agent_hostnamezy-fat port389 serverlocalhost 14 389ds_simpleauth_binds agent_hostnamezy-fat port389 serverlocalhost 0 389ds_operations_completed agent_hostnamezy-fat port389 serverlocalhost 51 389ds_connections_in_max_threads agent_hostnamezy-fat port389 serverlocalhost 0 389ds_modify_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_wholesubtree_search_operations agent_hostnamezy-fat port389 serverlocalhost 1 389ds_read_waiters agent_hostnamezy-fat port389 serverlocalhost 0 389ds_compare_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_errors agent_hostnamezy-fat port389 serverlocalhost 13 389ds_in_operations agent_hostnamezy-fat port389 serverlocalhost 52 389ds_total_connections agent_hostnamezy-fat port389 serverlocalhost 15 389ds_cache_hits agent_hostnamezy-fat port389 serverlocalhost 0 389ds_list_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_referrals_returned agent_hostnamezy-fat port389 serverlocalhost 0 389ds_copy_entries agent_hostnamezy-fat port389 serverlocalhost 0 389ds_operations_initiated agent_hostnamezy-fat port389 serverlocalhost 52 389ds_chainings agent_hostnamezy-fat port389 serverlocalhost 0 389ds_bind_security_errors agent_hostnamezy-fat port389 serverlocalhost 0 389ds_onelevel_search_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_bytes_sent agent_hostnamezy-fat port389 serverlocalhost 1702 389ds_bytes_received agent_hostnamezy-fat port389 serverlocalhost 0 389ds_referrals agent_hostnamezy-fat port389 serverlocalhost 0 389ds_delete_operations agent_hostnamezy-fat port389 serverlocalhost 0 389ds_anonymous_binds agent_hostnamezy-fat port389 serverlocalhost 0关键指标速查指标含义典型关注点389ds_current_connections/389ds_connections/389ds_total_connections当前连接数 / 当前连接数另一计数/ 累计连接总数结合389ds_dtablesize进程文件描述符表大小判断连接饱和389ds_threads/389ds_connections_in_max_threads/389ds_current_connections_at_max_threads线程数 / 处于最大线程数的连接数 / 当前处于最大线程数的连接数反映线程池压力389ds_in_operations/389ds_operations_initiated/389ds_operations_completed进行中操作数 / 发起操作数 / 完成操作数差值增大说明操作积压389ds_op_operations各类操作计数add/search/modify/delete/compare/modrdn/list 等其中 search 还细分为onelevel_search_operations、wholesubtree_search_operations389ds_simpleauth_binds/389ds_strongauth_binds/389ds_unauth_binds/389ds_anonymous_binds各认证方式的绑定计数反映认证请求构成与安全状况389ds_errors/389ds_security_errors/389ds_bind_security_errors错误计数 / 安全错误 / 绑定安全错误异常升高需关注389ds_bytes_sent/389ds_bytes_received/389ds_entries_sent/389ds_entries_returned收发字节与返回条目数反映查询吞吐内置告警规则OpenLDAP 五大场景开箱即用Ldap组件自带告警规则文件 integrations/Ldap/alerts/openldap_by_categraf.json集成中心在初始化时会将alerts/目录下的 JSON 解析为AlertRule并写入builtin_payloads类型为alert规则默认处于disabled: 1状态可在 Nightingale 告警规则管理中启用。这些规则均基于openldap_指标设计PromQL 与处置建议action如下1. OpenLDAP 连接数逼近文件描述符上限PromQLopenldap_current_connections / (openldap_max_file_descriptors_connections 0) * 100 80severity2Warningprom_for_duration180 秒处置建议执行ldapsearch -x -D bind_dn -w pw -b cnConnections,cnMonitor查看连接明细并定位连接数最多的客户端 IP大量连接来自同一应用说明其未复用或未关闭连接应推动应用侧改用连接池应急可调大 slapd 的ulimit -nsystemd 下改LimitNOFILE并重启同时检查是否配置了olcIdleTimeout未配置时空闲连接会一直占用描述符。2. OpenLDAP 请求积压PromQLopenldap_pending_threads 0severity2prom_for_duration180 秒处置建议执行ldapsearch -x -D bind_dn -w pw -b cnOperations,cnMonitor查看哪类操作Search/Bind/Modify量最大Search 占大头时在slapd.conf打开loglevel stats从日志里找耗时高的 SRCH 过滤器为对应属性建索引olcDbIndex补完索引后执行slapindex重建需先停 slapd确认非索引问题则调大olcThreads默认 16并评估 CPU 核数是否成为瓶颈。3. OpenLDAP 线程池饱和PromQLopenldap_active_threads / (openldap_max_threads 0) * 100 90severity2prom_for_duration180 秒处置建议执行ldapsearch -x -D bind_dn -w pw -b cnThreads,cnMonitor确认 Active/Max 实时值打开 stats 日志定位慢操作重点排查无索引的 substring 过滤如(cn*abc*)导致的全库扫描为高频过滤属性补olcDbIndex并slapindex重建这是最有效的降负载手段索引完备仍饱和的调大olcThreads或增加只读副本syncrepl consumer分流查询。4. OpenLDAP 操作完成数落后于发起数PromQLopenldap_operations_initiated - openldap_operations_completed 100severity2prom_for_duration300 秒处置建议对比各类操作的 Initiated 与 Completed定位卡住的操作类型卡在 Modify/Add 的检查后端数据库锁与磁盘 IOiostat -x 1mdb 后端在写放大时容易阻塞卡在 Search 的按慢查询思路补索引若是 syncrepl 复制拖住主库检查各 consumer 的连通性与延迟必要时先摘掉异常 consumer。5. OpenLDAP 近期发生过重启PromQLopenldap_uptime_time 300severity3Infoprom_for_duration60 秒处置建议先确认是否是计划内变更非计划则执行journalctl -u slapd --since -30min定位退出原因执行dmesg -T | grep -i killed process确认是否被 OOM 杀掉mdb 后端olcDbMaxSize配置过大是常见诱因重启后执行ldapsearch -x -b -s base namingContexts验证服务正常并确认副本同步已追平。源码视角集成如何进入 Nightingale从源码结构看integrations/目录是 Nightingale 集成体系的单一事实来源同一份组件目录被多个模块消费集成中心初始化center/integration/init.go在启动时扫描integrations/默认位于runner.Cwd下将每个组件的icon/目录首图注册为 Logo将markdown/目录下的 README 写入组件详情BuiltinComponent并把alerts/目录中的 JSON 解析为内置告警写入builtin_payloads见 center/integration/init.go 的Init入口与 告警装载逻辑。因此本文所述告警规则会在服务端首次初始化时自动入库前端集成中心即可浏览启用。AI 文档检索aiagent/tools/integrations_loader.go会将每个组件的markdown/README.md与collect/*/*.toml转为文档条目并入 AI 检索索引README 以[integration-doc]前缀、TOML 以[integration-config]前缀标记见 integrations_loader.go使 Agent 通过search_n9e_docs检索时能直接拿到真实的[[instances]]配置写法LDAP 插件的配置样本就是这类可被检索到的 ground truth。i18n 词条告警的 action 与名称的中英文词条维护在 integrations/Ldap/i18n/en_US.json集成中心按组件词条表渲染多语言变体未提供词条的语言按回退链回退到源语言详见 center/integration/init.go 的AddBuiltinPayload多语言渲染逻辑。采集与告警落地步骤确认服务器侧就绪在 OpenLDAPmonitor 后端或 389ds 上启用监控功能并用ldapsearch验证cnMonitor子树可读放置采集配置将 ldap.toml 放入 categraf 的conf/input.ldap/目录按环境填写server可带ldap://、ldaps://、starttls://scheme 与端口、dialect按需配置bind_dn/bind_password留空走匿名绑定与 TLS 相关参数接入 Nightingalecategraf 采集到的openldap_*/389ds_*指标推送至 Nightingale 后即可在指标视图查询并使用 内置告警规则 一键启用验证告警修改规则状态为启用确认prom_eval_interval: 15秒的评估周期内 PromQL 能正常求值规则默认配置了 7×24 全天候、notify_recovered: 1恢复通知。小结Nightingale 的Ldap集成把 LDAP 服务器cnMonitor的运维数据转化为openldap_*与389ds_*两套指标体系通过server/port标签天然支持多实例监控配合组件自带的五条 OpenLDAP 告警规则与逐条排障 action可在连接耗尽、线程池饱和、请求积压、操作停滞与异常重启等场景发生前及时介入。配置层面只需在 ldap.toml 中确定 scheme、方言与绑定凭据即可实现 LDAP 服务健康状态的端到端可观测。【免费下载链接】nightingaleNightingale is to monitoring and alerting what Grafana is to visualization.项目地址: https://gitcode.com/GitHub_Trending/ni/nightingale创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考