Continuous Monitoring Interview Question

Question1. Why is Continuous monitoring necessary? 

Answer :  I will suggest you to go with the below mentioned flow: Continuous Monitoring allows timely identification of problems or weaknesses and quick corrective action that helps reduce expenses of an organization. Continuous monitoring provides solution that addresses three operational disciplines known as: 

• continuous audit 
• continuous controls monitoring 
• continuous transaction inspection 

Question2. What is Nagios? 

Answer :  You can answer this question by first mentioning that Nagios is one of the monitoring tools. It is used for Continuous monitoring of systems, applications, services, and business processes etc in a DevOps culture. In the event of a failure, Nagios can alert technical staff of the problem, allowing them to begin remediation processes before outages affect business processes, end-users, or customers. With Nagios, you don’t have to explain why an unseen infrastructure outage affect your organization’s bottom line. Now once you have defined what is Nagios, you can mention the various things that you can achieve using Nagios. By using Nagios you can: 

• Plan for infrastructure upgrades before outdated systems cause failures. 
• Respond to issues at the first sign of a problem. 
• Automatically fix problems when they are detected. 
• Coordinate technical team responses. 
• Ensure your organization’s SLAs are being met. 
• Ensure IT infrastructure outages have a minimal effect on your organization’s bottom line. 
• Monitor your entire infrastructure and business processes. 

This completes the answer to this question. Further details like advantages etc. can be added as per the direction where the discussion is headed. 

Question3. How does Nagios works? 

Answer :  I will advise you to follow the below explanation for this answer: Nagios runs on a server, usually as a daemon or service. Nagios periodically runs plugins residing on the same server, they contact hosts or servers on your network or on the internet. One can view the status information using the web interface. You can also receive email or SMS notifications if something happens. The Nagios daemon behaves like a scheduler that runs certain scripts at certain moments. It stores the results of those scripts and will run other scripts if these results change. Now expect a few questions on Nagios components like Plugins, NRPE etc.. 

Question4. What are Plugins in Nagios?

Answer :  Begin this answer by defining Plugins. They are scripts (Perl scripts, Shell scripts, etc.) that can run from a command line to check the status of a host or service. Nagios uses the results from Plugins to determine the current status of hosts and services on your network. Once you have defined Plugins, explain why we need Plugins. Nagios will execute a Plugin whenever there is a need to check the status of a host or service. Plugin will perform the check and then simply returns the result to Nagios. Nagios will process the results that it receives from the Plugin and take the necessary actions. 

Question5. What is NRPE (Nagios Remote Plugin Executor) in Nagios? 

Answer :  Give a brief definition of Plugins. The NRPE addon is designed to allow you to execute Nagios plugins on remote Linux/Unix machines. The main reason for doing this is to allow Nagios to monitor “local” resources (like CPU load, memory usage, etc.) on remote machines. Since these public resources are not usually exposed to external machines, an agent like NRPE must be installed on the remote Linux/Unix machines. I will advise you to explain the NRPE architecture on the basis of diagram shown below. The NRPE addon consists of two pieces: 

• The check_nrpe plugin, which resides on the local monitoring machine. 
• The NRPE daemon, which runs on the remote Linux/Unix machine. There is a SSL (Secure Socket Layer) connection between monitoring host and remote host as shown in the diagram below. 

Question6. What do you mean by passive check in Nagios? 

Answer :  According to me, the answer should start by explaining Passive checks. They are initiated and performed by external applications/processes and the Passive check results are submitted to Nagios for processing.

Then explain the need for passive checks. They are useful for monitoring services that are Asynchronous in nature and cannot be monitored effectively by polling their status on a regularly scheduled basis. They can also be used for monitoring services that are Located behind a firewall and cannot be checked actively from the monitoring host. 

Question7. When Does Nagios Check for external commands? 

Answer :  Make sure that you stick to the question during your explanation so I will advise you to follow the below mentioned flow. Nagios check for external commands under the following conditions: 

• At regular intervals specified by the command_check_interval option in the main configuration file or, 
• Immediately after event handlers are executed. This is in addition to the regular cycle of external command checks and is done to provide immediate action if an event handler submits commands to Nagios. 

Question8. What is the difference between Active and Passive check in Nagios?  

Answer :  First point out the basic difference Active and Passive checks. The major difference between Active and Passive checks is that Active checks are initiated and performed by Nagios, while passive checks are performed by external applications. If your interviewer is looking unconvinced with the above explanation then you can also mention some key features of both Active and Passive checks: Passive checks are useful for monitoring services that are:

• Asynchronous in nature and cannot be monitored effectively by polling their status on a regularly scheduled basis. 
• Located behind a firewall and cannot be checked actively from the monitoring host. The main features of Actives checks are as follows: 
• Active checks are initiated by the Nagios process. 
• Active checks are run on a regularly scheduled basis. 

Question9. How does Nagios help with Distributed Monitoring? 

Answer :  The interviewer will be expecting an answer related to the distributed architecture of Nagios. So, I suggest that you answer it in the below mentioned format: With Nagios you can monitor your whole enterprise by using a distributed monitoring scheme in which local slave instances of Nagios perform monitoring tasks and report the results back to a single master. You manage all configuration, notification, and reporting from the master, while the slaves do all the work. This design takes advantage of Nagios’s ability to utilize passive checks i.e. external applications or processes that send results back to Nagios. In a distributed configuration, these external applications are other instances of Nagios. 

Question10. Explain Main Configuration file of Nagios and its location? 

Answer :  First mention what this main configuration file contains and its function. The main configuration file contains a number of directives that affect how the Nagios daemon operates. This config file is read by both the Nagios daemon and the CGIs (It specifies the location of your main configuration file). Now you can tell where it is present and how it is created. A sample main configuration file is created in the base directory of the Nagios distribution when you run the configure script. The default name of the main configuration file is nagios.cfg. It is usually placed in the etc/ subdirectory of you Nagios installation (i.e. /usr/local/nagios/etc/). 

Question11. Explain how Flap Detection works in Nagios? 

Answer :  I will advise you to first explain Flapping first. Flapping occurs when a service or host changes state too frequently, this causes lot of problem and recovery notifications. Once you have defined Flapping, explain how Nagios detects Flapping. Whenever Nagios checks the status of a host or service, it will check to see if it has started or stopped flapping. Nagios follows the below given procedure to do that: 

• Storing the results of the last 21 checks of the host or service analyzing the historical check results and determine where state changes/transitions occur 
• Using the state transitions to determine a percent state change value (a measure of change) for the host or service 
• Comparing the percent state change value against low and high flapping thresholds 

A host or service is determined to have started flapping when its percent state change first exceeds a high flapping threshold. A host or service is determined to have stopped flapping when its percent state goes below a low flapping threshold.

Question12. What are the three main variables that affect recursion and inheritance in Nagios?

Answer :  According to me the proper format for this answer should be: First name the variables and then a small explanation of each of these variables: 

• Name 
• Use
• Register 

Then give a brief explanation for each of these variables. Name is a placeholder that is used by other objects. Use defines the “parent” object whose properties should be used. Register can have a value of 0 (indicating its only a template) and 1 (an actual object). The register value is never inherited. 

Question13. What is meant by saying Nagios is Object Oriented? 

Answer :  Answer to this question is pretty direct. I will answer this by saying, “One of the features of Nagios is object configuration format in that you can create object definitions that inherit properties from other object definitions and hence the name. This simplifies and clarifies relationships between various components.” 

Question14. What is State Stalking in Nagios? 

Answer :  I will advise you to first give a small introduction on State Stalking. It is used for logging purposes. When Stalking is enabled for a particular host or service, Nagios will watch that host or service very carefully and log any changes it sees in the output of check results. Depending on the discussion between you and interviewer you can also add, “It can be very helpful in later analysis of the log files. Under normal circumstances, the result of a host or service check is only logged if the host or service has changed state since it was last checked.”