-
Notifications
You must be signed in to change notification settings - Fork 885
Add system metrics #4076
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Add system metrics #4076
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| #!/usr/bin/env bash | ||
| # | ||
| # Starts node_exporter so Prometheus can scrape host CPU, memory, disk, and | ||
| # filesystem metrics. Must run on Linux: the container shares the host's PID | ||
| # and network namespaces and mounts the host root, so the numbers are the | ||
| # machine's, not Docker's. | ||
| # | ||
| # Usage: ./start-node-exporter.sh | ||
| # | ||
| # Requirements: Docker must be installed and running. Linux only. | ||
| # Prometheus scrapes this at host.docker.internal:9100 (job "node"). | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| CONTAINER_NAME="sei-node-exporter" | ||
| NODE_EXPORTER_PORT=9100 | ||
| PROMETHEUS_UI_PORT=9091 | ||
|
|
||
| # Check for Docker | ||
| if ! command -v docker &>/dev/null; then | ||
| echo "Error: docker is not installed or not in PATH" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Check that Docker daemon is reachable | ||
| if ! docker info &>/dev/null; then | ||
| echo "Error: Docker daemon is not running or not accessible. Start Docker and try again." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Docker Desktop on macOS/Windows would report the VM, not the host running the bench. | ||
| if [[ "$(uname -s)" != "Linux" ]]; then | ||
| echo "Error: node_exporter in Docker only reports the host on Linux." >&2 | ||
| echo "On macOS/Windows it would scrape Docker's VM, not the machine running the bench." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # If container exists and is running, we're done | ||
| if docker ps -q -f "name=^${CONTAINER_NAME}$" | grep -q .; then | ||
| echo "node_exporter is already running." | ||
| echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # If container exists but is stopped, start it | ||
| if docker ps -aq -f "name=^${CONTAINER_NAME}$" | grep -q .; then | ||
| echo "Starting existing node_exporter container..." | ||
| docker start "$CONTAINER_NAME" | ||
| echo "" | ||
| echo "node_exporter is running." | ||
| echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # --net=host / --pid=host: collect the host's network and process view. | ||
| # /:/host + --path.rootfs=/host: CPU, disk, and filesystems from the host, not the container. | ||
| echo "Creating and starting node_exporter container..." | ||
| docker run -d \ | ||
| --name "$CONTAINER_NAME" \ | ||
| --net=host \ | ||
| --pid=host \ | ||
| -v "/:/host:ro,rslave" \ | ||
| prom/node-exporter:latest \ | ||
| --path.rootfs=/host | ||
|
|
||
| echo "" | ||
| echo "node_exporter is running." | ||
| echo " Metrics: http://localhost:${NODE_EXPORTER_PORT}/metrics" | ||
| echo " Prometheus job: node (host.docker.internal:${NODE_EXPORTER_PORT})" | ||
| echo "" | ||
| echo "To stop: ./stop-node-exporter.sh" | ||
| echo "" | ||
| echo "Grafana: import dashboard 1860 (Node Exporter Full), or query node_* in Explore." | ||
|
|
||
| # Config is bind-mounted; reload so a running Prometheus picks up the node job. | ||
| if curl -sf -X POST "http://localhost:${PROMETHEUS_UI_PORT}/-/reload" >/dev/null 2>&1; then | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [suggestion] The Prometheus reload is fully silent on failure and is only attempted on the container-creation path. Two gaps:
Adding an |
||
| echo "Prometheus reloaded." | ||
| fi | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| #!/usr/bin/env bash | ||
| # | ||
| # Stops the local node_exporter. The container is stopped but not removed; | ||
| # use start-node-exporter.sh to start it again. | ||
| # | ||
| # Usage: ./stop-node-exporter.sh | ||
| # | ||
| # Requirements: Docker must be installed and running. | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| CONTAINER_NAME="sei-node-exporter" | ||
|
|
||
| # Check for Docker | ||
| if ! command -v docker &>/dev/null; then | ||
| echo "Error: docker is not installed or not in PATH" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Check that Docker daemon is reachable | ||
| if ! docker info &>/dev/null; then | ||
| echo "Error: Docker daemon is not running or not accessible. Start Docker and try again." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if docker ps -q -f "name=^${CONTAINER_NAME}$" | grep -q .; then | ||
| echo "Stopping node_exporter container..." | ||
| docker stop "$CONTAINER_NAME" | ||
| echo "node_exporter stopped." | ||
| else | ||
| echo "node_exporter is not running." | ||
| fi |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[suggestion] With
--net=hostand no--web.listen-address, node_exporter binds0.0.0.0:9100on the host, publishing fairly detailed host telemetry (filesystems, NVMe namespaces, PSI, process counts) to anything that can reach the machine. This matters most on the AWS bench flow in the cryptosim README, where the deliberate use of an SSH tunnel for Prometheus (ssh -L 9091:localhost:9091) suggests the intent is not to open monitoring ports at all.Note that the obvious fix does not work:
--web.listen-address=127.0.0.1:9100would break the scrape, since the Prometheus container reaches the host via thehost-gatewaybridge address rather than loopback. The workable options are binding to the docker bridge gateway explicitly, or documenting in the script header that access control is left to the host firewall / security group. A one-line note in the header would be enough.