How to Install Cacti SNMP Monitoring Tool on Debian 9

This tutorial will show you how to install and configure Cacti network monitoring tool from source to ensure that you get the latest version on Debian 9, codename Stretch.

Cacti is a web-based network monitoring tool, completely open source, designed to display network and system graphics via RRDtool. It uses the SNMP (Simple Network Management Protocol) protocol to gather and monitor network traffic from network devices, such as switches, routers, Linux, Unix and Windows servers or other types of network-based devices that support SNMP.

Requirements

• Debian 9 minimal installation on a bare-metal machine or on a virtual private server.
• A static IP address configured for one of your system network interfaces cards.
• Access to root account or a user with root account privileges via sudo.

Initial Configuration

Before we start to install Cacti from source, first assure that your system meets all the software requirements for compiling and installing Cacti. In the first step, open the Debian sources list file for editing with root privileges and append the contrib and non-free repositories as shown in the below file excerpt.

nano /etc/apt/sources.list

sources.list file sample:

deb http://ftp.ro.debian.org/debian/ stretch main contrib non-free
deb-src http://ftp.ro.debian.org/debian/ stretch main
 
deb http://security.debian.org/debian-security stretch/updates main contrib non-free
deb-src http://security.debian.org/debian-security stretch/updates main

After finished editing the file, save and close the file and update your system repositories and software packages to incorporate the new packages, by issuing the below commands.

apt update

apt upgrade

Next, fire up a new command in order to install some necessary utilities that will be used to further manage your system from command line.

apt install wget patch unzip zip bash-completion

Cacti is a web-based monitoring tool mostly written in PHP server-side programming language. In order to run the Cacti php file scripts, a web server, such as Apache HTTP server, and a PHP interpreter must be installed and functional in the system.  In order to install Apache web server and the PHP interpreter alongside with all required PHP modules needed by Cacti to run properly, issue the following command in your server console.

apt install apache2 libapache2-mod-php7.0 php7.0 php7.0-snmp php7.0-xml php7.0-mbstring php7.0-json php7.0-gd php7.0-gmp php7.0-zip php7.0-ldap php7.0-mcrypt

After Apache and PHP have been installed, test if the web server is up and running and listening for network connections on port 80 by issuing the following command with root privileges.

netstat –tlpn

In case netstat network utility is not installed by default on your Debian system, execute the below command to install it.

apt install net-tools

By inspecting the netstat command output you can see that apache daemon is listening for incoming network connections on port 80.

In case you have a firewall enabled on your system, such as UFW firewall application, you should add a new rule to allow HTTP traffic to pass through the firewall by issuing the following command.

ufw allow WWW

or

ufw allow 80/tcp

Finally, test if the Apache web server default web page can be displayed in your client's browser by visiting your Debian machine IP address via HTTP protocol, as shown in the below image. If you don’t know your machine IP address, execute 'ifconfig' or 'ip a' commands. My IP in this setup is: http://192.168.1.14

In the next step, we need to make some further changes to PHP default configuration file in order to assure that the file_uploads variable is enabled and the PHP timezone setting is correctly configured and matches your system physical location.  Open /etc/php/7.0/apache2/php.ini file for editing and assure that the following lines are set up as follows.

file_uploads = On
date.timezone = Europe/London

Replace the timezone variable accordingly to your physical time zone by consulting the list of timezones provided by PHP docs at the following link http://php.net/manual/en/timezones.php

After you’ve made the required changes, create a php info file and restart apache daemon to apply changes by issuing the following commands.

echo '<?php phpinfo(); ?>'| tee /var/www/html/info.php

systemctl restart apache2

 Check if the PHP timezone has been correctly configured by visiting the php info script from a browser at the following URL (as illustrated in the below image). Scroll down to date setting to check php timezone setting.

http://192.168.1.14/info.php

Cacti monitoring tool stores configurations and collected data in an RDBMS database.  In this tutorial, we’ll configure Cacti with MariaDB database backend. Issue the below command to install MariaDB database and the PHP module needed to access mysql database.

apt install mariadb-server php7.0-mysql

After you’ve installed MariaDB, verify that the daemon is running and listens for network connections on localhost, port 3306, by running netstat command.

netstat –tlpn | grep mysql

Then log into MySQL console and secure MariaDB root account by issuing the following commands.

mysql -h localhost

use mysql;
update user set plugin='' where user='root';
flush privileges;
exit

In the next step, secure MariaDB by executing the script mysql_secure_installation provided by the installation package from Debian Stretch repository. While running, the script will ask a series of questions to secure the MariaDB database, such as: to change MySQL root password, to remove anonymous users, to disable remote root logins and to delete the test database. Execute the script by issuing the below command and assure you type yes to all questions asked in order to fully secure MySQL daemon. Use the below script output except as a guide.

sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB

      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current

password for the root user.  If you've just installed MariaDB, and

you haven't set the root password yet, the password will be blank,

so you should just press enter here.

Enter current password for root (enter for none):

OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB

root user without the proper authorisation.

You already have a root password set, so you can safely answer 'n'.

Change the root password? [Y/n] y

New password:

Re-enter new password:

Password updated successfully!

Reloading privilege tables..

 ... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone

to log into MariaDB without having to have a user account created for

them.  This is intended only for testing, and to make the installation

go a bit smoother.  You should remove them before moving into a

production environment.

Remove anonymous users? [Y/n] y

 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This

ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y

 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can

access.  This is also intended only for testing, and should be removed

before moving into a production environment.

Remove test database and access to it? [Y/n] y

 - Dropping test database...

 ... Success!

 - Removing privileges on test database...

 ... Success!

Reloading the privilege tables will ensure that all changes made so far

will take effect immediately.

Reload privilege tables now? [Y/n] y

 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB

installation should now be secure.

Thanks for using MariaDB!

In order to test MariaDB security, try to login to the database from console with no root password. The access to the database should be denied if no password is provided for the root account. If the password is supplied, the login process should be granted to MySQL console, as shown in the below screenshot.

mysql -h localhost -u root

mysql -h localhost -u root –p

While logged in to MariaDB database, go ahead and create a database for Cacti installation and create the user that will be used to manage cacti database, by issuing the following commands. Replace the cacti database user and password accordingly.

create database cacti;
grant all on cacti.* to 'cacti_user'@'localhost' identified by 'cacti_pass';
flush privileges;
exit

Also, grant select permissions to the cacti database user for MySQL time zone by issuing the below commands. This is a new requirement in order to install and run the latest release of Cacti.

mysql -u root -p mysql < /usr/share/mysql/mysql_test_data_timezone.sql

mysql -u root -p -e 'grant select on mysql.time_zone_name to cacti_user@localhost'

In the next step, open MySQL server default configuration file and append the following lines as shown in the below sample.

nano /etc/mysql/mariadb.conf.d/50-server.cnf

Add the following lines at the bottom of the 50-server.cnf file:

max_heap_table_size              = 98M
tmp_table_size                   = 64M
join_buffer_size                 = 64M
innodb_buffer_pool_size          = 485M
innodb_doublewrite               = off
innodb_additional_mem_pool_size  = 80M
innodb_flush_log_at_timeout      = 3
innodb_read_io_threads           = 32
innodb_write_io_threads          = 16

In order to apply all changes we made so far, restart MySQL and Apache daemons and verify that the daemons are running by issuing the following commands.

systemctl restart mysql apache2

systemctl status mysql apache2

Configure SNMP Service

Cacti web monitoring service uses the SNMP protocol in order to collect device data and statistics. In order to install the SNMP program, SNMP daemon service and SNMP MIBS in your local Debian 9 system, issue the following command with root privileges.

apt install snmp snmpd snmp-mibs-downloader

Also, install the industry-standard data logging tool RRDtool, which is used by Cacti to display the graphing functionality.

apt install rrdtool

Next, edit the SNMP configuration file /etc/snmp/snmp.conf and comment the “mibs” line by adding a hashtag (#) in front of the line as described in the below image.

Also configure SNMP daemon remote and localhost access, by opening the snmpd.conf file for editing and search and update the below lines as follows:

nano /etc/snmp/snmpd.conf

Uncomment the line to listen for connections on all interfaces

agentAddress udp:161,udp6:[::1]:161

Add the following lines to allow SNMP query for your local network via the snmp_string password. Replace the snmp community string snmp_string password and your network CIDR address accordingly.

rocommunity snmp_string localhost
rocommunity snmp_string 192.168.1.0/25

Optionally, you can also modify the contact and location variable in order to provide information about your server. This information is displayed in Cacti notification area when you check your server details. Also, your system hostname, kernel version and system uptime are displayed in Cacti notification area.

In order to modify this information, edit the sysLocation and sysContact lines under the system information section and add your own values. By default, the following values are configured for sysLocation and sysContact.

sysLocation Sitting on the Dock of the Bay
sysContact Me <[email protected]>

After you’ve made the proper changes to snmpd.conf file, save and close the file and restart snmp daemon to reflect changes by issuing the below commands. Then check the snmpd daemon status and the owned ports in listening state.

systemctl restart snmpd.service

systemctl status snmpd.service

netstat -tulpn| grep snmp

Open firewall port for SNMP:

ufw allow 161/udp

In order to verify that the SNMP daemon is working as expected and retrieves all the SNMP values under memory tree for localhost, run the below command.

snmpwalk -v 2c -c snmp_string localhost memory

Install Cacti-Spine

Cacti-Spine is a replacement for the default cmd.php poller, written in C for faster execution time. In order to compile and install Cacti-Spine pooler from sources in Debian 9, first, execute the following command in order to install all the required dependencies into the system.

apt install build-essential dos2unix dh-autoreconf help2man libssl-dev libmysql++-dev libmariadb-dev libmariadbclient-dev librrds-perl libsnmp-dev

Next, download the latest version of Cacti-Spine tar compressed archive with wget utility, extract the tarball archive and enter cacti-spine extracted directory by issuing the following commands.