Frequently asked questions
What an administrator wants to know before trusting banshee with their infrastructure, from agents to the license.
Architecture
Do I need to install an agent on every machine?
No. Pollers query your equipment remotely, over SNMP, SSH or HTTPS, and nothing gets installed on the machines being monitored.
A poller is a separate program that you install wherever suits you, close to the equipment: a virtual machine in the data center, a small server at a customer’s site, or one of the monitored servers.
How does a poller get through a firewall?
It goes out. The poller opens the connection to the master, and the master never reaches out to it. All the poller needs is to be able to reach the master, the way a browser reaches a website. On the monitored site, you open no inbound port and set up no VPN.
When the master has work for a poller, it says so in its reply to the poller’s heartbeat, and the poller comes to fetch the task.
Which systems does banshee run on?
The master runs on Linux amd64, Debian or Alpine, with a PostgreSQL database. systemd or OpenRC restart it if it stops.
Pollers run on Linux, FreeBSD, macOS (Intel and ARM) and Windows Server 2016 and later, each as a single binary with nothing else to install. Windows Server 2008 and 2012 cannot host a poller, but they can be monitored remotely from a neighboring one.
Does banshee offer high availability?
No. There is no dedicated failover mechanism for the master, and no second master to take over.
The master is built not to fall over on its own: when the database or the disk goes missing, it pauses whatever depends on them, then resumes by itself once they are back.
How large an infrastructure can it handle?
The architecture is sized for 80,000 hosts and 600,000 probes. That is a design target, deliberately far beyond everyday needs, and every technical choice is measured against it. The inventory has already been tested with 680,001 folders, hosts and probes.
On the network side, a poller whose probes are all fine sends nothing but a heartbeat each minute, one bit per probe. Details only travel for what is wrong.
Collection
Which SNMP versions are supported?
SNMP v2c and v3. With v3, authentication ranges from MD5 to SHA-512, and privacy from DES to AES-256. SNMP probes only read: banshee has no SNMP write function at all.
In a collector, an SNMP table takes one line to read. snmp.table joins the columns on their index, so an interface’s name arrives together with its counters, with no two tables to match up by hand.
What does banshee do over SSH?
A collector runs a command on the target, then reads its output, its errors and its exit code. Each argument is passed separately and quoted, never pasted into the command. The host key is checked before any credential is sent, whether a password or a private key.
What the command does is written in plain sight in the collector, and you judge it when you review the code. With an account that has no write access on the target, a command you misread cannot change anything there.
And over HTTPS?
A collector reads a page or an API and gets the status code, the headers, the body and the response time. No redirect is followed silently: a 3xx response is returned as it is. A POST is possible too, when an API requires one, and as with an SSH command, what it does is yours to judge.
The server’s identity is checked against the system’s certificate authorities or against a pinned certificate fingerprint. Each connection has its own TLS profile, from the “Recent” mode, TLS 1.3 only, down to a mode that still accepts Windows XP. A token or a password set on a folder only goes to the targets whose collector asks for it by name.
What does a probe look like, and how do I write one?
A probe runs a collector, a short program written in Keen, banshee’s language. Keen looks like old-school procedural PHP, which most administrators can read without learning anything first. Here is the core of a collector for a UPS, queried over SNMP:
need('protocol:snmp');
output('charge', 'number', array('label' => 'Battery charge', 'unit' => '%'));
output('runtime', 'number', array('label' => 'Time left on battery', 'unit' => 'min'));
watch.below('charge-low', 'Battery not charged', 'charge', array('warning' => 80, 'critical' => 50));
watch.below('runtime-short', 'Little time left on battery', 'runtime', array('warning' => 15, 'critical' => 5));
value('charge', snmp.get('1.3.6.1.2.1.33.1.2.4.0'));
value('runtime', snmp.get('1.3.6.1.2.1.33.1.2.3.0'));The two watch.below lines are monitors, named in plain words, with thresholds the author suggests. On the probe’s page, you tick the ones you care about and adjust the thresholds if you like; a threshold left empty triggers nothing. No more digging through a plugin’s help for an option name, no more regular expression just to learn that a UPS has switched to battery.
The master checks the code each time it is saved and points to every mistake by its line. And if you would rather write nothing at all, collectors can be pulled from repositories, the community’s or your own. Every version is kept: it can be compared with another and restored in one click.
What happens when a poller goes silent?
Its probes stop showing green. Every poller sends a heartbeat each minute, so a site that has gone quiet shows on the screen instead of passing for a site where all is well.
Alerts
How does banshee avoid alert storms?
A problem only alerts once it is confirmed, after the delay or the number of failures you set, on a probe, a host or a whole folder. During a storm, messages go out at most once every few minutes, at the pace you choose; whatever comes in meanwhile is grouped into the next message, and nothing is lost.
Can I silence alerts during maintenance work?
Yes, on any folder, host or probe, and for everything it contains. A maintenance window has a start, an end, an author and a comment. Meanwhile the probes keep running and their state stays on screen: only the notifications are muted.
An acknowledgment covers one specific problem. It clears by itself when the probe returns to OK, and the alert comes back if the state gets worse.
Security
Where are passwords and SNMP communities stored?
In an encrypted vault, never in clear text. On the poller, the vault is encrypted with a key tied to its machine, and it opens by itself on restart. On the master, you choose: it forgets the secret as soon as it has passed it on to the poller, or it keeps it, encrypted with a key tied to its own machine. A recovery key can restore a vault either way.
Can a compromised master take control of the pollers?
No, and that is a design rule. The master pushes no updates: a poller only changes its collectors when an administrator acts on the poller itself, after seeing the changes and confirming them. And since the master never connects to the pollers, it has no door to open toward them.
License and adoption
How much does banshee cost?
Nothing. banshee is free software under the AGPL-3.0 license, with no per-host or per-probe fee, and there is only one edition, the same for everyone. Sponsors support the project.
Can I migrate from another monitoring tool?
No import tool from other monitoring software is planned at this point: hosts and probes are created in banshee.
Can I get help deploying it?
The project is looking to build a network of partners who specialize in deploying banshee and writing collectors, so that companies adopting it get guarantees and support. The software itself stays the same for everyone. To talk about it, or to become one of them, write to the team.
For the big picture, read banshee at a glance. A question that is not here? Contact the team.