Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docker/monitornode/config/prometheus.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,9 @@ scrape_configs:
static_configs:
- targets: ['host.docker.internal:9090']
scrape_interval: 5s

# Host CPU, memory, disk, filesystem. Start with start-node-exporter.sh (Linux only).
- job_name: 'node'
static_configs:
- targets: ['host.docker.internal:9100']
scrape_interval: 5s
78 changes: 78 additions & 0 deletions docker/monitornode/scripts/start-node-exporter.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
#!/usr/bin/env bash
#
# Starts node_exporter so Prometheus can scrape host CPU, memory, disk, and
# filesystem metrics. Must run on Linux: the container shares the host's PID
# and network namespaces and mounts the host root, so the numbers are the
# machine's, not Docker's.
#
# Usage: ./start-node-exporter.sh
#
# Requirements: Docker must be installed and running. Linux only.
# Prometheus scrapes this at host.docker.internal:9100 (job "node").

set -euo pipefail

CONTAINER_NAME="sei-node-exporter"
NODE_EXPORTER_PORT=9100
PROMETHEUS_UI_PORT=9091

# Check for Docker
if ! command -v docker &>/dev/null; then
echo "Error: docker is not installed or not in PATH" >&2
exit 1
fi

# Check that Docker daemon is reachable
if ! docker info &>/dev/null; then
echo "Error: Docker daemon is not running or not accessible. Start Docker and try again." >&2
exit 1
fi

# Docker Desktop on macOS/Windows would report the VM, not the host running the bench.
if [[ "$(uname -s)" != "Linux" ]]; then
echo "Error: node_exporter in Docker only reports the host on Linux." >&2
echo "On macOS/Windows it would scrape Docker's VM, not the machine running the bench." >&2
exit 1
fi

# If container exists and is running, we're done
if docker ps -q -f "name=^${CONTAINER_NAME}$" | grep -q .; then
echo "node_exporter is already running."
echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics"
exit 0
fi

# If container exists but is stopped, start it
if docker ps -aq -f "name=^${CONTAINER_NAME}$" | grep -q .; then
echo "Starting existing node_exporter container..."
docker start "$CONTAINER_NAME"
echo ""
echo "node_exporter is running."
echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics"
exit 0
fi

# --net=host / --pid=host: collect the host's network and process view.
# /:/host + --path.rootfs=/host: CPU, disk, and filesystems from the host, not the container.
echo "Creating and starting node_exporter container..."
docker run -d \
--name "$CONTAINER_NAME" \
--net=host \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[suggestion] With --net=host and no --web.listen-address, node_exporter binds 0.0.0.0:9100 on the host, publishing fairly detailed host telemetry (filesystems, NVMe namespaces, PSI, process counts) to anything that can reach the machine. This matters most on the AWS bench flow in the cryptosim README, where the deliberate use of an SSH tunnel for Prometheus (ssh -L 9091:localhost:9091) suggests the intent is not to open monitoring ports at all.

Note that the obvious fix does not work: --web.listen-address=127.0.0.1:9100 would break the scrape, since the Prometheus container reaches the host via the host-gateway bridge address rather than loopback. The workable options are binding to the docker bridge gateway explicitly, or documenting in the script header that access control is left to the host firewall / security group. A one-line note in the header would be enough.

--pid=host \
-v "/:/host:ro,rslave" \
prom/node-exporter:latest \
--path.rootfs=/host

echo ""
echo "node_exporter is running."
echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics"
echo " Prometheus job: node (host.docker.internal:${NODE_EXPORTER_PORT})"
echo ""
echo "To stop: ./stop-node-exporter.sh"
echo ""
echo "Grafana: import dashboard 1860 (Node Exporter Full), or query node_* in Explore."

# Config is bind-mounted; reload so a running Prometheus picks up the node job.
if curl -sf -X POST "http://localhost:${PROMETHEUS_UI_PORT}/-/reload" >/dev/null 2>&1; then

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[suggestion] The Prometheus reload is fully silent on failure and is only attempted on the container-creation path. Two gaps:

  1. curl is an undeclared dependency (the header lists only Docker). If it is missing, or if the reload returns non-2xx, the if simply falls through and the user is told "node_exporter is running" while an already-running Prometheus never picks up the node job.
  2. The two early exit 0 paths above (container already running, container stopped-then-started) skip the reload entirely.

Adding an else branch that prints something like "Could not reload Prometheus; restart it to pick up the 'node' scrape job" — and moving the reload before the early exits, or repeating it on the restart path — makes the failure self-diagnosing.

echo "Prometheus reloaded."
fi
32 changes: 32 additions & 0 deletions docker/monitornode/scripts/stop-node-exporter.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
#!/usr/bin/env bash
#
# Stops the local node_exporter. The container is stopped but not removed;
# use start-node-exporter.sh to start it again.
#
# Usage: ./stop-node-exporter.sh
#
# Requirements: Docker must be installed and running.

set -euo pipefail

CONTAINER_NAME="sei-node-exporter"

# Check for Docker
if ! command -v docker &>/dev/null; then
echo "Error: docker is not installed or not in PATH" >&2
exit 1
fi

# Check that Docker daemon is reachable
if ! docker info &>/dev/null; then
echo "Error: Docker daemon is not running or not accessible. Start Docker and try again." >&2
exit 1
fi

if docker ps -q -f "name=^${CONTAINER_NAME}$" | grep -q .; then
echo "Stopping node_exporter container..."
docker stop "$CONTAINER_NAME"
echo "node_exporter stopped."
else
echo "node_exporter is not running."
fi
3 changes: 3 additions & 0 deletions sei-db/state_db/bench/cryptosim/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,8 @@ installed.
```
docker/monitornode/scripts/start-prometheus.sh
docker/monitornode/scripts/start-grafana.sh
docker/monitornode/scripts/start-node-exporter.sh

```

Then, navigate to http://localhost:3000/ in a web browser to reach the grafana UI. Username and password are "admin".
Expand All @@ -73,6 +75,7 @@ You can stop these services by killing their containers, or by running the follo
```
docker/monitornode/scripts/stop-prometheus.sh
docker/monitornode/scripts/stop-grafana.sh
docker/monitornode/scripts/stop-node-exporter.sh
```

# Running in AWS
Expand Down
Loading