Sentries

Overview

Sentry is an agent that connects remote hosts to Logpresso Sonar for log collection. In Settings > Sentries, you can register the target host OS and the server that the Sentry will connect to, then copy the installation command generated by the web console and run it on the target host.

After deployment, you can monitor connection status together with CPU, memory, disk, and network usage from the list. If a Sentry is connected, you can click its Sentry ID to open remote actions such as process lookup, network connection lookup, routing table lookup, ARP cache lookup, thread dumps, bundle lookup, and restart.

The Sentries menu is available to Cluster Administrators and Administrators. Both roles can view, add, and delete Sentries, and run remote actions and restarts.

Supported environments

This document describes how to deploy a Sentry in Linux and Windows environments.

To deploy a Sentry in a Unix environment, contact Logpresso. The supported Unix environments are listed in the following table.

Prerequisites

Before you deploy a Sentry, prepare the following on the control node:

• Open the network ports that the Sentry and the Logpresso server use to communicate.
• Upload the JDK required to run the Sentry.
• Register the Sentry package used for installation.

To install a Sentry on a Linux host, you also need to install the required packages on that host.

A Sentry connects from a remote host, so the node it connects to (the data-receiving node) must have an address reachable from the Sentry host. In Settings > Cluster, if the node's IP address is only 127.0.0.1 (the default that points to the server itself), the installation script replaces that value with the web console address, so the Sentry connects to the control node instead of the node you selected. Set the node's VIP address (recommended) or host address to a value reachable from the Sentry host.

Once preparation is complete, running the installation command generated by the web console on the target host automatically downloads and installs both the Sentry and the Java runtime.

Network ports

Sentry installation, data reception, and remote management use the following ports. To install a Sentry and receive the data it sends, you must allow access to these ports in the node's local firewall. Port numbers may vary depending on your environment.

Upload JDK

A Sentry runs on a Java runtime that the Logpresso server distributes together with the Sentry installation files. Download a trusted OpenJDK distribution from one of the following official sources and upload it to the control node.

• Logpresso Store
• Eclipse Temurin

Before uploading, rename the file and adjust its extension to the following rules so the Logpresso server can recognize it.

• The file name must start with jdk- or jre-.
• The text from the prefix up to the first dot (.) must be a numeric-only major version.
  • Recognized examples: jre-21.0.1.tar.gz (detailed version), jdk-21.zip (short version)
  • Unrecognized example: jre-8u151-linux-x64.tar.gz (the version contains non-numeric characters)
• The extension must be .tar.gz for Linux and .zip for Windows.

Copy the prepared file to the distribution directory on the Logpresso server.

# Adjust the paths for your environment.
# PKGDIR: the directory where the Logpresso server is installed
PKGDIR="/opt/logpresso"

# Create the distribution directories for Linux and Windows
sudo -u logpresso mkdir -p ${PKGDIR}/download/{linux,win}/x64

# Copy the JRE/JDK files
sudo -u logpresso cp <linux_JRE_or_JDK.tar.gz> ${PKGDIR}/download/linux/x64
sudo -u logpresso cp <windows_JRE_or_JDK.zip> ${PKGDIR}/download/win/x64

Register the Sentry package

In Settings > Packages, register the package to use for Sentry installation. For how to register a package, see Packages.

Install required packages

The host where you install a Linux Sentry must have the following packages. The installation script stops if any of the ifconfig, netstat, unzip, wget, tar, or gunzip commands is missing.

The installation script does not check for ethtool and lsof in advance. If ethtool is missing on the Sentry host, the Sentry cannot send resource usage, so the CPU, Mem, Storage, NIC RX, and NIC TX values in the Sentry list are shown as 0. If lsof is missing, all process IDs in the network connection results are shown as 0. If you remove the net-tools package after installation, routing table retrieval fails and resource usage is no longer updated.

The following example installs all the required packages at once on a RHEL-based operating system.

sudo dnf install -y net-tools ethtool lsof wget tar gzip unzip

Add a Sentry

Before you deploy Sentry to a new server, create a Sentry registration entry first.

1. In Settings > Sentries, click Add.

2. In the panel that opens, configure the following fields and click Save.

   

   • OS: Select the operating system of the target host. Depending on the environment, only supported options are shown from Linux and Windows.
   • Sentry ID: Enter the unique identifier for the Sentry in the cluster (required, up to 62 characters). The value must be in a valid domain name or hostname format.
   • Target: Select the cluster node that the Sentry will connect to (required). The list shows the node type together with the VIP or host address.
   • Auth Token: Enter the token to use during installation (required). A random value is generated by default, and it must follow the 1234-abcd format with four digits, a hyphen, and four lowercase letters.

3. After the Sentry is created, the installation command dialog opens.

View the installation command

After you create a Sentry, the Sentry Installation dialog displays the command that you must run on the target host.

• The dialog instructs you to open a terminal as an administrator on the target server and run the displayed command.
• Click Copy To Clipboard to copy the installation command.
• Click OK to close the dialog and return to the Sentry list.

The installation command is generated from the selected OS, Sentry ID, target server, and auth token, and its format differs by operating system. The host address in the installation command follows the web endpoint specified during installation (the web console address), not the target server you chose here. To learn how to specify the web endpoint, see Configure the certificates and web endpoint.

On Linux, the command downloads the installation script with wget and runs it.

wget --no-check-certificate -q -O install.sh "https://<control_node_address>:44300/deploy/installer/sentry-linux?guid=<sentry_id>&token=<auth_token>&base=<target_server>" && chmod +x install.sh && ./install.sh

On Windows, a PowerShell command is generated. It changes to the temporary directory, configures the session to trust the server certificate and use TLS 1.2, then downloads install.cmd and runs it.

cd $env:TEMP; add-type "using System.Net; using System.Security.Cryptography.X509Certificates; public class TrustAllCertsPolicy : ICertificatePolicy { public bool CheckValidationResult(ServicePoint a, X509Certificate b, WebRequest c, int d) {return true;}}";[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://<control_node_address>:44300/deploy/installer/sentry-windows?guid=<sentry_id>&token=<auth_token>&base=<target_server>' -OutFile install.cmd; cmd /c install.cmd

The installation is completed only after you run the command on the target host.

View the Sentry list

Open Settings > Sentries to view the Sentry list.

• Status: Shows whether the Sentry is connected. Connected Sentries are shown with a green indicator, and disconnected Sentries with a gray indicator.
• Node: Shows the cluster node or node pair that the Sentry connects to.
• Sentry ID: Shows the unique identifier of the Sentry. For connected Sentries, clicking it opens the remote action menu.
• Hostname: Shows the hostname where the Sentry is installed.
• Version: Shows the installed Sentry package version.
• CPU: Shows CPU usage as a progress bar and percentage.
• Mem: Shows memory usage as a progress bar and percentage.
• Storage: Shows disk usage. If the host has multiple disks, the highest usage is displayed.
• NIC RX: Shows receive bandwidth usage. If the host has multiple network interfaces, the highest usage is displayed.
• NIC TX: Shows transmit bandwidth usage. If the host has multiple network interfaces, the highest usage is displayed.

Use the search box to narrow the list by Sentry ID or hostname.

Download the list

To save the list as a file, follow these steps.

1. Click on the toolbar.

2. In the Download Sentry List dialog, specify the properties of the file to download, then click Download.

   

   • File Name: The name of the file to download (default: Sentries).
   • Columns: The fields to include in the download. Choose from Status, Node, Sentry ID, Hostname, Version, CPU, Mem, Storage, NIC RX, and NIC TX (default: all selected).
   • File Format: Choose from CSV, XML, Microsoft Word, HTML, JSON, and PDF (default: CSV).
   • Encoding: The character encoding of the file. This field appears only when File Format is CSV or JSON, and you can choose from UTF8, UTF16, and Latin 1 (default: UTF8).
   • Range: The start and end number of the range to download (default: the first row number on the current page through the total count). Numbers follow the order shown in the list.

Refresh the list

To reload the latest status, click on the toolbar.

Remote Sentry actions

For a connected Sentry, click the arrow next to Sentry ID to open the remote action menu. The remote action menu is available only for connected Sentries.

The remote action menu provides the following actions:

• Processes
• Network Connections
• Routing Table
• ARP Cache Table
• Thread Dumps
• Top Threads
• Bundles
• Restart

Processes

Click Processes to open the process list of the selected Sentry host in a new window.

Network connections

Click Network Connections to open the network connection information of the selected Sentry host in a new window.

Routing table

Click Routing Table to open the routing table of the selected Sentry host in a new window.

ARP cache table

Click ARP Cache Table to open the ARP cache information of the selected Sentry host in a new window.

Thread dumps

Click Thread Dumps to open the full thread dump of the selected Sentry in a new window.

Top threads

Click Top Threads to open the busiest thread information of the selected Sentry in a new window.

Bundles

Click Bundles to open the deployed bundle information of the selected Sentry in a new window.

Restart

Click Restart to open a confirmation dialog.

Click Restart again to send a restart command to the selected Sentry. A notification appears, and the list is reloaded.

Delete a Sentry

To remove a registered Sentry entry from the list, select the Sentry and click Delete.

In the table in the delete confirmation dialog, check the Sentry ID of the selected Sentry, then click Delete to delete it.