Cluster Summary Tab

The Cluster summary tab gives you and overview of the overall health of the IDS hosts in the cluster, as well the IDS service and the Logshipper service.

IDSTower installs an agent on the IDS Hosts that tracks key metrics of the Cluster’s hosts and report them every one minute to IDSTower, which is displayed in the Summary Tab.

We will explain every section of the Cluster Page displayed in the below image

../_images/cluster_summary_tab.png

1. This section is the cluster page tabs, by clicking on them you can navigate to the Summary, configuration and Hosts sections.


2. This section is the cluster Actions sub-menu, through it you can apply cluster-wide actions like Starting the IDS services, stopping them…etc

../_images/cluster_actions_submenu.png

One of those actions is Reset SSH Trust. IDSTower reaches every managed host over SSH using a key pair it generates for the cluster, installing the public key in the authorized_keys file of the host’s SSH user. If a host stops accepting that key, every operation on it fails while gathering facts, and IDSTower reports that the host rejected the cluster’s SSH key (Permission denied (publickey,...)). Reset SSH Trust generates a new key pair for the cluster and re-establishes trust with all of its hosts; it asks for the SSH user account, port, and password or private key of the hosts, because IDSTower needs another way in to install the new key. Once the reset succeeds, run Update Hosts Config to redeploy the configuration.

A host that runs in a container is the common cause. Everything IDSTower installs on such a host lives in the container’s writable layer — the cluster public key in authorized_keys, the Suricata package, and the package repository definition and keyring IDSTower adds — so recreating the container discards all of it, and the host comes back without them. Restarting a container keeps its writable layer and is unaffected. The recovery is the same in every case: Reset SSH Trust, then Update Hosts Config.


3. This section Will display the Cluster Status (a green tick means everything is ok) and the status of the IDS & logshipper services running on the cluster hosts, along with the version number deployed and the number of hosts in the cluster. When a newer Suricata or Filebeat version can be installed, a notice appears here; see Upgrading Suricata and Filebeat.


4. This section displays several key metrics that are calculated across cluster hosts.


next, we will explain the cluster Configs tab.