Schedule regular scans with a systemd timer or cron when you do not use Icinga2 or
Nagios. The examples in contrib/ provide service, timer and environment
files you can adapt to your installation:
contrib/systemd/check-opencloud-security.serviceand.timercontrib/systemd/check-opencloud-security.env.example
The separate
check-opencloud-security-refresh.timer
keeps the scanner's release schedule and advisory database current. Configure
the scanner to read the two files under /var/lib/check-opencloud-security
before enabling it; the refresh command validates both documents and writes
them atomically.
- contrib/cron/check-opencloud-security.cron
To have these written for you, with the settings you just configured already
in them, run check-opencloud-scanner configure --export-monitoring systemd -
see configure. The
files below are the templates it is based on.
systemd timer
sudo mkdir -p /etc/check-opencloud-security
sudo cp contrib/systemd/check-opencloud-security.env.example /etc/check-opencloud-security/env
sudo $EDITOR /etc/check-opencloud-security/env # set COS_HOST (and any other options)
sudo cp contrib/systemd/check-opencloud-security.service /etc/systemd/system/
sudo cp contrib/systemd/check-opencloud-security.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now check-opencloud-security.timer
# Run it once immediately to verify the setup:
sudo systemctl start check-opencloud-security.service
journalctl -u check-opencloud-security.service
cron
sudo cp contrib/cron/check-opencloud-security.cron /etc/cron.d/check-opencloud-security
sudo chmod 644 /etc/cron.d/check-opencloud-security
sudo $EDITOR /etc/cron.d/check-opencloud-security # set COS_HOST (and any other options)
Both examples configure the check entirely through environment variables, so the same binary or Docker image is reused unmodified across hosts - only the environment file or cron entry changes.
Two things catch people out here, and both are covered in
Troubleshooting: cron and systemd have neither a login
shell's PATH nor its environment, so use the full path to
check-opencloud-security and set COS_HOST explicitly.
On a cluster, the equivalent is a CronJob - see Kubernetes.
For more than a handful of instances, see
Checking a fleet of instances.