Hello World: meet banshee

Welcome to the banshee blog. This is where we will post the project's progress, what each release brings, and technical articles.

Why banshee

In many teams, monitoring takes more time than it saves. Checks pile up over the years, written in different languages, each with its own options and output format, and an update can change what a check reports without anyone noticing. Keeping them running often falls to a single person. Above all, the state on screen is not always verified: a green light may only be the last known state.

banshee starts from one simple requirement: a monitoring tool must tell the truth on the day everything goes wrong. Every decision in the project is measured against that rule.

What banshee is

banshee is made of two programs. The master is the central server. It holds the inventory of what is monitored, the settings, the accounts and permissions, and the web interface. The poller will be the collection program. Installed close to the equipment, in a data center, at a customer's site or on the monitored server itself, it will query that equipment over SNMP, SSH or HTTPS and judge the answers. Each of its checks is called a probe.

The poller always opens the connection to the master, never the other way around. Monitoring a remote site will therefore take no inbound port and no VPN, since the poller reaches out to the master the way a browser reaches out to a website.

What sets it apart

• Verified state. Every result will carry its age. A result that is not renewed in time will be marked stale, and a poller that stops sending heartbeats will show at once.
• Alerts people can read. A problem will only raise an alert once confirmed, and every alert will say why in one sentence, for example "eth0 at 93%, above 90% for 5 min".
• Configuration on screen. The watches a collector offers are ticked, their thresholds are optional, and a setting placed on a folder applies to everything in it.
• Collection that reads without changing. What a probe sends to a device is written in its code and reviewed before it is deployed, and a compromised master will not be able to take over the pollers.

For technical teams

What a probe can do is described by its collector, written in Keen, banshee's language. Keen is a simple language, built into banshee with no dependency on the system, which most sysadmins can read without any training, and every collector follows the same layout, which makes code written by someone else easy to review. Here is the core of a UPS collector queried over SNMP:

need('protocol:snmp');

output('charge', 'number', array('label' => 'Battery charge', 'unit' => '%'));
output('runtime', 'number', array('label' => 'Time left on battery', 'unit' => 'min'));

watch.below('charge-low', 'Battery not charged', 'charge', array('warning' => 80, 'critical' => 50));
watch.below('runtime-short', 'Little time left on battery', 'runtime', array('warning' => 15, 'critical' => 5));

value('charge', snmp.get('1.3.6.1.2.1.33.1.2.4.0'));
value('runtime', snmp.get('1.3.6.1.2.1.33.1.2.3.0'));

The two watch.below lines are watches: use cases named in plain words, with thresholds suggested by the author. On a probe's page, the administrator will tick the ones that matter and adjust the thresholds if needed. A threshold left blank triggers nothing, and there is no plugin option to look up in a help page and no regular expression to write.

After each measurement, the poller will judge, and the most severe watch will win. The judging engine, already written and tested, covers the usual cases: a high or low threshold, a rise, a lack of activity, a drift from the usual pattern, an expected value, or an instance that stands out from the others, such as a disk slower than its neighbors.

The master checks every collector when it is saved and reports each mistake at its line. Collectors are shared through repositories, websites that publish collections. banshee's Store searches the repositories the administrator has added and pulls in a single collector or a whole collection. No update is automatic: every version is kept, can be compared with another, and can be restored in one click.

For decision-makers

banshee is free software, under the AGPL-3.0 license. There is only one edition, the same for everyone, with no license per host or per probe. Its license cost is zero, whatever the size of your infrastructure.

It runs on your own servers, and your data stays there. Every collector is readable code that you keep, so nothing ties you to the project if you ever decide to switch tools.

Configuration happens on screen rather than in files. A whole team can run the monitoring, without depending on a single expert.

The architecture is sized for 80,000 hosts and 600,000 probes. That target, deliberately far beyond common needs, is how we check that no technical choice will hold back a growing infrastructure. The inventory has already been tested with 680,001 folders, hosts and probes.

Where the project stands

The project follows a set order: the central server first, then the poller, then both together. The central server is well along. Today it handles:

• the inventory, a tree of folders, hosts and probes, where the screen shows where each setting comes from;
• accounts with two-factor sign-in, groups, and permissions set on the tree;
• secrets, encrypted in a vault with a recovery key;
• collectors, with their editor, their versions and the Store;
• the TLS profile of every encrypted connection, chosen through a mode named after the equipment it serves, from "Recent" to "Windows 2008 and later, Linux after 2010".

banshee does not monitor any production infrastructure yet. Collection will come with the poller, which is the next big step; with it will come results and states on screen, then email alerts. We are not giving a date. The central server was designed to receive it: the inventory already knows which poller collects which host, and every collector declares what it needs.

Getting involved

• For a question, some field experience or an infrastructure to monitor, contact the team.
• Sponsors fund development and are listed on this site: become a sponsor.
• We are building a network of partners who will deploy banshee and support the companies that adopt it: become a partner.
• The RSS feed announces every new post.