OpenLDAP

Auto-Detection

Built-in Metrics

Bleemeo monitors OpenLDAP through automatic service detection and built-in metrics gathered from the slapd monitoring backend.

Auto-Detection

Glouton automatically detects OpenLDAP instances running on the host. To enable metrics gathering, you must enable the slapd monitoring backend and configure a bind DN and password in the agent configuration.

If the auto-detected parameters are incorrect or you need to configure metrics gathering, you can override them manually.

Linux
Windows

sudo tee /etc/glouton/conf.d/99-openldap.conf > /dev/null << 'EOF'
service:
  # For an OpenLDAP running outside a container
  - type: "openldap"
    address: "127.0.0.1"
    port: 389
    # DN/password to bind with. If username is empty, an anonymous bind is performed.
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"
    # Use LDAPS (note that port will likely need to be changed to 636)
    ssl: true
    # Use StartTLS (you cannot enable both ssl and starttls at the same time)
    starttls: true
    # Skip host certificate verification
    ssl_insecure: true
    # Path to PEM-encoded root certificate to verify the server certificate
    ca_file: "/myca"

  # For an additional OpenLDAP running outside a container
  - type: "openldap"
    instance: "NAME_ASSOCIATED_WITH_YOUR_ADDITIONAL_SERVICE"
    address: "127.0.0.1"
    port: 390
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"

  # For an OpenLDAP running in a Docker container
  - type: "openldap"
    instance: "CONTAINER_NAME"
    address: "172.17.0.2"
    port: 389
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"
EOF

Create or edit C:\ProgramData\glouton\conf.d\99-openldap.conf:

service:
  # For an OpenLDAP running outside a container
  - type: "openldap"
    address: "127.0.0.1"
    port: 389
    # DN/password to bind with. If username is empty, an anonymous bind is performed.
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"
    # Use LDAPS (note that port will likely need to be changed to 636)
    ssl: true
    # Use StartTLS (you cannot enable both ssl and starttls at the same time)
    starttls: true
    # Skip host certificate verification
    ssl_insecure: true
    # Path to PEM-encoded root certificate to verify the server certificate
    ca_file: "/myca"

  # For an additional OpenLDAP running outside a container
  - type: "openldap"
    instance: "NAME_ASSOCIATED_WITH_YOUR_ADDITIONAL_SERVICE"
    address: "127.0.0.1"
    port: 390
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"

  # For an OpenLDAP running in a Docker container
  - type: "openldap"
    instance: "CONTAINER_NAME"
    address: "172.17.0.2"
    port: 389
    username: "cn=admin,dc=example,dc=org"
    password: "adminpassword"

Built-in Metrics

Metric	Description
`service_status`	Status of OpenLDAP
`openldap_connections_current`	Current number of active connections
`openldap_waiters_read`	Number of threads blocked waiting to read data from a client
`openldap_waiters_write`	Number of threads blocked waiting to write data to a client
`openldap_threads_active`	Number of threads currently active in slapd
`openldap_statistics_bytes`	Outgoing bytes per second
`openldap_statistics_entries`	Outgoing entries per second
`openldap_operations_add_completed`	Number of add operations per second
`openldap_operations_bind_completed`	Number of bind operations per second
`openldap_operations_delete_completed`	Number of delete operations per second
`openldap_operations_modify_completed`	Number of modify operations per second
`openldap_operations_search_completed`	Number of search operations per second

Monitoring Troubleshooting

See Troubleshoot a Service Check or Missing Metrics for what applies to every service: finding the address and port Glouton really uses, what each check message means, and how to read the collection error — which does not appear in the agent logs at the default level.

The Service Check is not OK

The check only opens the TCP port — it sends no command — so it fails when the port is wrong (Connection refused), when a firewall drops the packets (connection timed out after 10 seconds), or when the configured address cannot be parsed (Invalid TCP address). A green check proves the port is open, and nothing more.

Metrics are Missing

A passing check says nothing about the metrics: they are collected separately.

Glouton binds with username as the bind DN and password as its password, then reads the cn=Monitor subtree.

Reproduce what Glouton does, from the machine where the agent runs:

ldapsearch -x -H ldap://127.0.0.1:389 -D "cn=admin,dc=example,dc=com" -W -b "cn=Monitor" -s base

What you see	Cause	Fix
`No such object` on `cn=Monitor`	The monitoring backend is not enabled	Enable the `monitor` backend in `slapd`
an empty result, or `Insufficient access` — Glouton binds anonymously	No bind DN configured	Set `username` and `password`
`Invalid credentials`	Wrong bind DN or password	Fix them; the bind DN is a full DN, not a login name
an empty result	The bind DN cannot read `cn=Monitor`	Add an ACL granting it read access to the monitor backend
a TLS error	A TLS mismatch	Set `start_tls: true` for StartTLS on port 389, or `ssl: true` for LDAPS on 636; add `ca_file` for a private CA, or `ssl_insecure: true` to skip verification