Supervision, Monitoring et Métrologie — SNMP, Prometheus & Grafana

Métrologie ──► données historiques ──► capacité planning
Monitoring  ──► temps réel          ──► détection anomalie
Supervision ──► vision globale      ──► prise de décision

Gestionnaire (NMS)          Agent SNMP (équipement)
       │                            │
       │── GET / GETNEXT ──────────►│
       │◄─ Response ────────────────│
       │                            │
       │◄─ Trap (alerte spontanée) ─│

Manager ── GET (OID: 1.3.6.1.2.1.1.1.0) ──► Agent
Manager ◄── Response (valeur: "Linux srv01") ── Agent

Manager ── GETNEXT (OID: 1.3.6.1.2.1.1) ──► Agent
Manager ◄── Response (OID suivant + valeur) ── Agent

Manager ── SET (OID: ifAdminStatus = down) ──► Agent
Manager ◄── Response (OK) ── Agent

Agent ── TRAP (linkDown, interface Gi0/1) ──► Manager

Agent ── INFORM ──► Manager
Agent ◄── Response (ACK) ── Manager

. (root)
└── 1 (iso)
    └── 3 (org)
        └── 6 (dod)
            └── 1 (internet)
                ├── 2 (mgmt)
                │   └── 1 (mib-2)
                │       ├── 1  (system)      ← Infos système
                │       ├── 2  (interfaces)  ← Interfaces réseau
                │       ├── 4  (ip)          ← Statistiques IP
                │       ├── 6  (tcp)         ← Statistiques TCP
                │       └── 11 (snmp)        ← Stats SNMP
                └── 4 (private)
                    └── 1 (enterprises)
                        ├── 9    (Cisco)
                        ├── 311  (Microsoft)
                        └── 2636 (Juniper)

! Créer un groupe SNMP avec accès lecture seule
snmp-server group SUPERVISION v3 priv read iso

! Créer un utilisateur
snmp-server user admin-snmp SUPERVISION v3 auth sha MonMotDePasse priv aes 128 MaCleChiffrement

! Restreindre aux IPs autorisées
snmp-server community public RO 10
ip access-list standard 10
 permit 192.168.1.50

┌─────────────────────────────────────────────────────────────┐
│                     Docker Compose                          │
│                                                             │
│  ┌─────────────┐    ┌─────────────┐    ┌────────────────┐  │
│  │  Prometheus │    │   Grafana   │    │ Alertmanager   │  │
│  │  :9090      │◄───│  :3000      │    │  :9093         │  │
│  └──────┬──────┘    └─────────────┘    └────────────────┘  │
│         │                                                   │
└─────────│───────────────────────────────────────────────────┘
          │ scrape /metrics
          ▼
┌─────────────────────────────────────────────────────────────┐
│  Exporters (agents)                                         │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────┐  │
│  │ node_exporter│  │windows_exporter  │ snmp_exporter    │  │
│  │ Linux/macOS  │  │ Windows      │  │ Switches/Routeurs│  │
│  │ :9100        │  │ :9182        │  │ :9116            │  │
│  └──────────────┘  └──────────────┘  └──────────────────┘  │
└─────────────────────────────────────────────────────────────┘

supervision/
├── docker-compose.yml
├── prometheus/
│   ├── prometheus.yml        ← Configuration Prometheus
│   └── rules/
│       └── alerts.yml        ← Règles d'alertes
└── grafana/
    └── provisioning/
        ├── datasources/
        │   └── prometheus.yml
        └── dashboards/
            └── dashboards.yml

version: '3.8'

networks:
  supervision:
    driver: bridge

volumes:
  prometheus_data:
  grafana_data:

services:

  # ── Prometheus ───────────────────────────────────────────────────────────────
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./prometheus/rules:/etc/prometheus/rules
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=30d"
      - "--web.enable-lifecycle"

  # ── Grafana ──────────────────────────────────────────────────────────────────
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=admin123
      - GF_USERS_ALLOW_SIGN_UP=false
    depends_on:
      - prometheus

  # ── Alertmanager ─────────────────────────────────────────────────────────────
  alertmanager:
    image: prom/alertmanager:latest
    container_name: alertmanager
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "9093:9093"
    volumes:
      - ./prometheus/alertmanager.yml:/etc/alertmanager/alertmanager.yml

  # ── SNMP Exporter (switches, routeurs) ───────────────────────────────────────
  snmp-exporter:
    image: prom/snmp-exporter:latest
    container_name: snmp-exporter
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "9116:9116"
    volumes:
      - ./snmp-exporter/snmp.yml:/etc/snmp_exporter/snmp.yml

global:
  scrape_interval:     15s   # Fréquence de collecte
  evaluation_interval: 15s   # Fréquence d'évaluation des règles
  scrape_timeout:      10s

# Règles d'alertes
rule_files:
  - "rules/alerts.yml"

# Alertmanager
alerting:
  alertmanagers:
    - static_configs:
        - targets: ["alertmanager:9093"]

scrape_configs:

  # Prometheus lui-même
  - job_name: "prometheus"
    static_configs:
      - targets: ["localhost:9090"]

  # Serveurs Linux / macOS (node_exporter)
  - job_name: "linux"
    static_configs:
      - targets:
          - "192.168.1.10:9100"   # SRV-NOUVY
          - "192.168.1.30:9100"   # SRV-WSUS
        labels:
          env: "production"
          os:  "linux"

  # Postes et serveurs Windows (windows_exporter)
  - job_name: "windows"
    static_configs:
      - targets:
          - "192.168.1.20:9182"   # PC-WIN01
          - "192.168.1.21:9182"   # PC-WIN02
        labels:
          env: "production"
          os:  "windows"

  # Équipements réseau via SNMP
  - job_name: "snmp"
    static_configs:
      - targets:
          - "192.168.1.1"   # Routeur
          - "192.168.1.2"   # Switch core
    metrics_path: /snmp
    params:
      module: [if_mib]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: snmp-exporter:9116

mkdir -p supervision/prometheus/rules supervision/grafana/provisioning/datasources
cd supervision
docker compose up -d

# Vérifier que les conteneurs tournent
docker compose ps

# Logs Prometheus
docker compose logs -f prometheus

# Télécharger node_exporter
wget https://github.com/prometheus/node_exporter/releases/latest/download/node_exporter-1.11.0.linux-amd64.tar.gz
tar xvf node_exporter-*.tar.gz
sudo cp node_exporter-*/node_exporter /usr/local/bin/

# Créer un utilisateur dédié
sudo useradd --no-create-home --shell /bin/false node_exporter

# Créer le service systemd
sudo tee /etc/systemd/system/node_exporter.service <<EOF
[Unit]
Description=Node Exporter
After=network.target

[Service]
User=node_exporter
ExecStart=/usr/local/bin/node_exporter
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now node_exporter

# Vérifier
curl http://localhost:9100/metrics | head -20

brew install node_exporter

# Démarrer en tant que service
brew services start node_exporter

# Vérifier
curl http://localhost:9100/metrics | head -20

Get-Service windows_exporter
Invoke-WebRequest http://localhost:9182/metrics | Select-Object -First 5

# Utilisation CPU globale (en %)
100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)

# CPU Windows
100 - (avg by(instance) (rate(windows_cpu_time_total{mode="idle"}[5m])) * 100)

# RAM disponible Linux (en %)
(node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100

# RAM utilisée Windows (en %)
(1 - (windows_os_physical_memory_free_bytes / windows_cs_physical_memory_bytes)) * 100

# Espace disque libre par partition Linux
(node_filesystem_avail_bytes{fstype!="tmpfs"} / node_filesystem_size_bytes{fstype!="tmpfs"}) * 100

# Windows
(windows_logical_disk_free_bytes / windows_logical_disk_size_bytes) * 100

# Débit entrant en Mo/s
rate(node_network_receive_bytes_total{device!="lo"}[5m]) / 1024 / 1024

# Débit sortant en Mo/s
rate(node_network_transmit_bytes_total{device!="lo"}[5m]) / 1024 / 1024

  blackbox-exporter:
    image: prom/blackbox-exporter:latest
    container_name: blackbox-exporter
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "9115:9115"
    volumes:
      - ./blackbox/blackbox.yml:/etc/blackbox_exporter/config.yml

modules:
  http_2xx:
    prober: http
    timeout: 5s
    http:
      valid_http_versions: ["HTTP/1.1", "HTTP/2.0"]
      valid_status_codes: []      # 2xx par défaut
      follow_redirects: true

  http_post_2xx:
    prober: http
    http:
      method: POST

  tcp_connect:
    prober: tcp
    timeout: 5s

  icmp:
    prober: icmp
    timeout: 5s
    icmp:
      preferred_ip_protocol: "ip4"

  dns_check:
    prober: dns
    dns:
      query_name: "google.com"
      query_type: "A"

  # Sondes HTTP
  - job_name: "blackbox_http"
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
      - targets:
          - http://192.168.1.10         # Site interne
          - https://monsite.com         # Site externe
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox-exporter:9115

  # Sondes TCP (vérifier un port ouvert)
  - job_name: "blackbox_tcp"
    metrics_path: /probe
    params:
      module: [tcp_connect]
    static_configs:
      - targets:
          - 192.168.1.10:443    # HTTPS
          - 192.168.1.10:3306   # MySQL
          - 192.168.1.30:8530   # WSUS
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox-exporter:9115

  # Sondes ICMP (ping)
  - job_name: "blackbox_icmp"
    metrics_path: /probe
    params:
      module: [icmp]
    static_configs:
      - targets:
          - 192.168.1.1     # Routeur
          - 192.168.1.2     # Switch
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox-exporter:9115

# Service HTTP disponible (1 = up, 0 = down)
probe_success{job="blackbox_http"}

# Temps de réponse HTTP
probe_duration_seconds{job="blackbox_http"}

# Certificat SSL — jours avant expiration
(probe_ssl_earliest_cert_expiry - time()) / 86400

modules:
  if_mib:
    walk:
      - 1.3.6.1.2.1.2          # interfaces
      - 1.3.6.1.2.1.31.1.1     # ifXTable (interfaces étendues)
      - 1.3.6.1.2.1.1          # system
    metrics:
      - name: ifHCInOctets
        oid: 1.3.6.1.2.1.31.1.1.1.6
        type: counter
        help: "Octets reçus sur l'interface"
        indexes:
          - labelname: ifIndex
            type: gauge
      - name: ifHCOutOctets
        oid: 1.3.6.1.2.1.31.1.1.1.10
        type: counter
        help: "Octets émis sur l'interface"
        indexes:
          - labelname: ifIndex
            type: gauge
    auth:
      community: supervision-snmp
    version: 2

# Trafic entrant sur une interface (Mo/s)
rate(ifHCInOctets{instance="192.168.1.1"}[5m]) / 1024 / 1024

# Trafic sortant
rate(ifHCOutOctets{instance="192.168.1.2"}[5m]) / 1024 / 1024

groups:
  - name: infrastructure
    rules:

      # CPU > 90 % pendant 5 minutes
      - alert: CPUElevé
        expr: >
          100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 90
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "CPU élevé sur {{ $labels.instance }}"
          description: "CPU à {{ $value | printf "%.1f" }}% depuis 5 min."

      # RAM disponible < 10 %
      - alert: RAMCritique
        expr: >
          (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100 < 10
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Mémoire critique sur {{ $labels.instance }}"
          description: "Seulement {{ $value | printf "%.1f" }}% de RAM disponible."

      # Disque < 15 % libre
      - alert: DisquePlein
        expr: >
          (node_filesystem_avail_bytes{fstype!="tmpfs"} / node_filesystem_size_bytes{fstype!="tmpfs"}) * 100 < 15
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Disque presque plein sur {{ $labels.instance }}"
          description: "Partition {{ $labels.mountpoint }} à {{ $value | printf "%.1f" }}% libre."

      # Hôte non joignable (down)
      - alert: HôteIndisponible
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Hôte indisponible : {{ $labels.instance }}"
          description: "L'exporter {{ $labels.job }} ne répond plus."

      # Service HTTP down
      - alert: ServiceHTTPDown
        expr: probe_success{job="blackbox_http"} == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Service HTTP indisponible : {{ $labels.instance }}"

      # Certificat SSL expire dans moins de 30 jours
      - alert: CertificatSSLExpire
        expr: (probe_ssl_earliest_cert_expiry - time()) / 86400 < 30
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "Certificat SSL expire bientôt : {{ $labels.instance }}"
          description: "Expire dans {{ $value | printf "%.0f" }} jours."

global:
  smtp_smarthost: "in-v3.mailjet.com:587"
  smtp_from: "alertes@example.com"          # Expéditeur vérifié dans Mailjet
  smtp_auth_username: "MAILJET_API_KEY"     # API Key Mailjet
  smtp_auth_password: "MAILJET_SECRET_KEY"  # Secret Key Mailjet
  smtp_require_tls: true

route:
  group_by: ["alertname", "instance"]
  group_wait:      30s
  group_interval:  5m
  repeat_interval: 4h
  receiver: "equipe-si"
  routes:
    - match:
        severity: critical
      receiver: "equipe-si-critical"

receivers:
  - name: "equipe-si"
    email_configs:
      - to: "si@example.com"
        send_resolved: true
        headers:
          Subject: "[SUPERVISION] {{ .GroupLabels.alertname }} — {{ .Status | toUpper }}"

  - name: "equipe-si-critical"
    email_configs:
      - to: "si-urgent@example.com"
        send_resolved: true
        headers:
          Subject: "[CRITIQUE] {{ .GroupLabels.alertname }} — {{ .Status | toUpper }}"

inhibit_rules:
  - source_match:
      severity: critical
    target_match:
      severity: warning
    equal: ["alertname", "instance"]

docker compose exec alertmanager kill -HUP 1

alerts.yml          → définit QUAND alerter (CPU > 90%, hôte down, disque plein...)
        ↓
Alertmanager        → reçoit l'alerte de Prometheus
        ↓
Mailjet SMTP        → envoie l'email
        ↓
si@example.com      → warning
si-urgent@example.com → critical

# Ajouter dans docker-compose.yml
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    restart: unless-stopped
    networks:
      - supervision
    ports:
      - "8080:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro

  - job_name: "docker"
    static_configs:
      - targets: ["cadvisor:8080"]

apiVersion: 1

datasources:
  - name: Prometheus
    type: prometheus
    access: proxy
    url: http://prometheus:9090
    isDefault: true
    editable: false

100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)

(node_memory_MemAvailable_bytes{instance="$instance"} / node_memory_MemTotal_bytes{instance="$instance"}) * 100

rate(node_network_receive_bytes_total{instance="$instance", device!="lo"}[5m]) / 1024 / 1024

! SNMPv2c (simple, à utiliser sur réseau isolé uniquement)
snmp-server community supervision-snmp RO
snmp-server location "Salle Serveurs — NOUVY"
snmp-server contact si@nouvy.lan

! SNMPv3 (recommandé)
snmp-server group SUPERVISION v3 priv read iso
snmp-server user admin-snmp SUPERVISION v3 auth sha MonPassword priv aes 128 MaCle
snmp-server host 192.168.1.50 version 3 priv admin-snmp

# SNMPv2c — récupérer la description du système
snmpwalk -v2c -c supervision-snmp 192.168.1.1 sysDescr

# SNMPv3
snmpwalk -v3 -l authPriv -u admin-snmp 
  -a SHA -A MonPassword 
  -x AES -X MaCle 
  192.168.1.1 sysDescr

# Trafic sur toutes les interfaces
snmpwalk -v2c -c supervision-snmp 192.168.1.1 ifHCInOctets

# Trafic entrant (Mo/s) sur l'interface 1 du routeur
rate(ifHCInOctets{instance="192.168.1.1", ifIndex="1"}[5m]) / 1024 / 1024

# Interfaces UP/DOWN
ifOperStatus{instance="192.168.1.2"}
# 1 = up, 2 = down, 3 = testing