The plugins from Check NetApp-REST connect to the NetApp devices with a user and password to retrieve the status and performance data. Here we explain how to create this user on a NetApp device with RESTful API (>= Ontap 9.6).
Keep the users name short (not longer than 15 characters) in order to avoid problems with third-party tools (e.g. Windows domain user, LDAP).
To make your live easy avoid shell-active characters like backslash or exclamation mark in the password. E.g. jGyi8CHP_83d will make you less headache than 0815!nagios\123.
To get a monitoring-user you can ask your NetApp-partner on how to create a read-only user with sufficient but not too high privileges, refer to your product-documentation or you can use the following type-script to create it.
The creation-process of a read-only user may differ between Ontap versions. Please contact your NetApp Partner if you are unsure.
Create a role first and then a user. The role and user below are for the checks of Check NetApp-REST (RESTful API) only.
The role grants read access to the RESTful API, blocks the security area and allows only the certificate endpoint from it. Replace the example name cluster1 with the name of your cluster.
cluster1::security login rest-role> create -role monitoring -vserver cluster1 -api /api -access readonly
cluster1::security login rest-role> create -role monitoring -vserver cluster1 -api /api/security -access none
cluster1::security login rest-role> create -role monitoring -vserver cluster1 -api /api/security/certificates -access readonly
What each entry is for:
/api readonly: read access for all checks. Because a privilege applies to all paths below it, this also covers the CLI passthrough endpoints (/api/private/cli/...) some checks use./api/security none: no access to the security area (accounts, roles, keys, passwords). The most specific path wins, so this overrides /api for everything below /api/security./api/security/certificates readonly: the only exception from the line above, needed by the certificate check. The check also reads /api/private/cli/security/certificate, which is covered by /api.ONTAP may warn that some security certificate ... show-text commands will not be accessible. This is expected; the certificate check does not need them.
Check Result
cluster1::security login rest-role> show monitoring
Role Access
Vserver Name API Level
---------- ------------- ------------------- ------
cluster1 monitoring /api readonly
/api/security none
/api/security/certificates
readonly
3 entries were displayed.
The checks connect via HTTPS, so the user needs the application http only.
cluster1::security login> create monitoring -role monitoring -comment "system-monitoring user, readonly" -application http -authentication-method password
Check Result
cluster1::security login> show monitoring
Vserver: cluster1
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
monitoring http password monitoring no none