Monitor OpenVPN Connections with Prometheus and Grafana

Welcome to our tutorial on how to monitor OpenVPN connections with Prometheus and Grafana. Grafana is a data visualization and monitoring tool and supports time series datastores such as Graphite, InfluxDB, Prometheus, Elasticsearch. Prometheus on the other hand is an open-source systems and service monitoring tool. It collects metrics from configured targets via HTTP calls at given intervals, evaluates rule expressions, displays the results, and can trigger alerts if some conditions are met. Grafana can be used to achieve better visualization of the metrics collected by the Prometheus. In this setup, however, we will learn how to collect OpenVPN connection metrics using Prometheus and visualize then on Grafana.

Monitor OpenVPN Connections with Prometheus and Grafana

In this tutorial, we are using an Ubuntu 20.04 systems for demo labs. Feel free to use other OSes.

To monitor OpenVPN connections with Prometheus and Grafana, we will install and setup each component of the monitoring separately.

Install Prometheus on Ubuntu 20.04

We have covered the installation of Prometheus on Ubuntu 20.04 in our previous guide. Follow the link below to install and setup Prometheus on Ubuntu 20.04;

Install and Setup Prometheus on Ubuntu 20.04

You can as well use CentOS 8 instead.

Install and Configure Prometheus on CentOS 8

Install Grafana on Ubuntu 20.04

Follow the link below to install Grafana on Ubuntu 20.04;

Installing Grafana on Ubuntu 20.04

Want to use CentOS instead? Follow the link below to setup Grafana on CentOS 8.

Install Latest Grafana on CentOS 8

Integrating Grafana with Prometheus

Once both Grafana and Prometheus are in place, you can then configure Grafana to fetch the metrics from Prometheus.

systemctl status grafana-server

● grafana-server.service - Grafana instance
     Loaded: loaded (/lib/systemd/system/grafana-server.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2020-09-21 17:01:07 UTC; 5min ago
       Docs: http://docs.grafana.org
   Main PID: 14610 (grafana-server)
      Tasks: 8 (limit: 2282)
     Memory: 18.0M
     CGroup: /system.slice/grafana-server.service
             └─14610 /usr/sbin/grafana-server --config=/etc/grafana/grafana.ini --pidfile=/var/run/grafana/grafana-server.pid --packaging=deb cfg:default.paths.logs=/var/l>

Sep 21 17:02:16 ubuntu20 grafana-server[14610]: t=2020-09-21T17:02:16+0000 lvl=info msg="Executing migration" logger=migrator id="create cache_data table"
...

systemctl status prometheus

● prometheus.service - Prometheus Time Series Collection and Processing Server
     Loaded: loaded (/etc/systemd/system/prometheus.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2020-09-21 16:35:03 UTC; 32min ago
   Main PID: 2464 (prometheus)
      Tasks: 8 (limit: 2282)
     Memory: 27.6M
     CGroup: /system.slice/prometheus.service
             └─2464 /usr/local/bin/prometheus --config.file /etc/prometheus/prometheus.yml --storage.tsdb.path /var/lib/prometheus/ --web.console.templates=/etc/prometheus>

Sep 21 16:35:03 ubuntu20 prometheus[2464]: level=info ts=2020-09-21T16:35:03.205Z caller=head.go:644 component=tsdb msg="Replaying on-disk memory
...

ss -altnp | grep -E ":3000|:9090"

LISTEN    0         4096                     *:9090                   *:*        users:(("prometheus",pid=2464,fd=10))                                          
LISTEN    0         4096                     *:3000                   *:*        users:(("grafana-server",pid=14610,fd=8))

To integrate Grafana with Prometheus, you need to add Prometheus data source to Grafana.

This can be done by logging into Grafana web interface and navigating to Configuration (gear like icon) > Datasources > Add data source.

From the data source types, select Prometheus. This opens up Prometheus datasource configuration page.

Enter the Prometheus server URL. If you are running Grafana and Prometheus on the same server, use the address http://localhost:9090 otherwise, use the address http://<prometheus-server-IP>:9090.

Click Save & Test.

Install OpenVPN Prometheus Node Exporter on OpenVPN Server

Next, you need to install OpenVPN node exporter on the OpenVPN Server.

We have already covered how to install and configure OpenVPN and OpenVPN clients;

Install and Setup OpenVPN Server on Ubuntu 20.04

Install and Configure OpenVPN Client on CentOS 8/Ubuntu 18.04

Setup OpenVPN Server on CentOS 8

In this setup, our OpenVPN server is running on a CentOS 8 system. Hence, we need to install the OpenVPN node exporter on CentOS 8 OpenVPN server. OpenVPN Exporter for Prometheus is an open source project hosted on Github and written by Kumina. All credit goes back to the creator of this exporter.

You can run the exporter as docker container or a standalone executable binary.

In this setup, we run it as standalone executable binary on a Centos 8 server hosting a vpn server.

Install Go on CentOS 8

Download Go tarball for installation from Go download’s page.

wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz

Extract it into /usr/local, creating a Go tree in /usr/local/go.

tar -C /usr/local -xzf go1.15.2.linux-amd64.tar.gz

Add /usr/local/go/bin to the PATH environment variable.

vim .bashrc_profile

...
# User specific environment and startup programs

PATH=$PATH:$HOME/bin:/usr/local/go/bin

export PATH

Source the file to effect the changes.

source .bash_profile

Go should now be on your PATH.

Download OpenVPN Node Exporter

Download OpenVPN node exporter from the Github releases page.

wget https://github.com/kumina/openvpn_exporter/archive/v0.3.0.tar.gz

Extract it;

tar xzf v0.3.0.tar.gz

Next, build the OpenVPN node exporter;

cd openvpn_exporter-0.3.0/

Set the path to OpenVPN server status log file;

vim main.og

...

func main() {
        var (
                listenAddress      = flag.String("web.listen-address", ":9176", "Address to listen on for web interface and telemetry.")
                metricsPath        = flag.String("web.telemetry-path", "/metrics", "Path under which to expose metrics.")
                // openvpnStatusPaths = flag.String("openvpn.status_paths", "examples/client.status,examples/server2.status,examples/server3.status", "Paths at which OpenVPN places its status files.")
                openvpnStatusPaths = flag.String("openvpn.status_paths", "/var/log/openvpn/openvpn-status.log", "Paths at which OpenVPN places its status files.")
...

Save and exit the file.

Build the exporter now;

go build -o openvpn_exporter main.go

This will create Prometheus OpenVPN node exporter binary, openvpn_eporter, in the current directory. Copy the binary to /usr/local/bin binary path.

cp openvpn_eporter /usr/local/bin/

By default, the exporter listens on TCP port 9176, hence you need to open this port on firewall.

firewall-cmd --add-port=9176/tcp --permanent
firewall-cmd --reload

Run the exporter in standalone mode to test it;

openvpn_exporter

2020/09/21 23:37:50 Starting OpenVPN Exporter
2020/09/21 23:37:50 Listen address: :9176
2020/09/21 23:37:50 Metrics path: /metrics
2020/09/21 23:37:50 openvpn.status_path: /var/log/openvpn/openvpn-status.log
2020/09/21 23:37:50 Ignore Individuals: false

Configure Prometheus to scrape OpenVPN Node exporter metrics;

vim /etc/prometheus/prometheus.yml

...
  # The job name is added as a label `job=` to any timeseries scraped from this config.
  - job_name: 'prometheus'

    # metrics_path defaults to '/metrics'
    # scheme defaults to 'http'.

    static_configs:
    - targets: ['localhost:9090']
  ## Add OpenVPN Node Exporter
  - job_name: 'openvpn-metrics'
    scrape_interval: 5s
    static_configs:
            - targets: ['192.168.60.6:9176']

Restart Prometheus;

systemctl restart prometheus

Check the Prometheus Target, http://server-IP:9090/targets.