Obsolete:Monitoring/strongswan

This page contains historical information. It may be outdated or unreliable.

IPsec connections are monitored today using a combination of prometheus-ipsec-exporter and icinga.

A per-site alert will fire via Icinga check_prometheus should one or more defined IPsec tunnels change to disconnected, unknown, or other non-connected state.

Troubleshooting an issue

1. Review the alert description text carefully. You should see some hint about where the problem lies here.
   1. e.g. alert text of "instance=cp1081:9536 site=eqiad tunnel={cp3060_v4,cp3060_v6}" indicates that there is a problem with the tunnels to cp3060 being reported by host cp1081.
2. Check the IPsec Grafana dashboard
   1. Investigate any ongoing non-zero values.
   2. Look for commonality, e.g. do multiple instances report problems with the same tunnel?
3. Write more about what you did to troubleshoot the issue in this runbook :)
4. Tell the traffic team about it