Monitoring at a different level (BPF/Suricata/Cilium)
Traditional pull based monitoring (nagios et al) is DEAD>
Push based (partly Prometheus, Riemann) is cooler.
But it's still somewhat superficial requests.. how about
monitoring directly "from the wire".
Reasearch on gathering data on an app-level without
app-internal instrumentation (eg. haproxy/suricata).
Updated by Philipp Buehler over 1 year ago
The idea is to tproxy chain haproxy traffic and let suricata "inspect" the traffic.
Pull the eve.json output into ELG or so.
server moni 172.23.42.1:80 send-proxy # lives on a loopback if (e.g. lo1)
bind 172.23.42.1:80 accept-proxy name monitor-in
suricata makes traffic analysis on lo1