NetData on a Synology NAS

I have been exploring NetData for a while as I was looking for a better solution to monitor my small homelab. For alerting I have Nagios running on a Raspberry Pi 2, which suffices to get alerts when something is wrong. As this does not really provide useful insights on what happened over time and lacked detailed insight for network equipment, I looked into various solutions over time but did not find what I was looking for. For a long time I tried Observium, but as that was primarily intended for the network side and did not fully meet my needs. It did do what it promised but the SNMP setup required everywhere, the slow SNMP polling mechanism and issues it caused made me decide to move on to something else.

Currently I am trying out Netdata and have a simple setup with a central NetData parent / collector running on a Pi5 (data is stored on an NVMe disk) with all other systems in my homelab streaming the data to and minimum local processing (Thin Mode as per the Netdata documentation). Setting up monitoring for network over SNMP is also pretty simple and although the UI is a lot simpler than Observium, it does what I need right now. NetData documentation is pretty good, so I will not cover my basic setup or the various options available in this post but focus on adding a Synology NAS..

Today I added my Synology DS1618+ to this setup so that I can get metrics and alerts via NetData for it as well (currently Nagios uses SNMP to monitor some aspects to it and that simply fails too often causing false alarms that I want to get rid of.

The initial install was based on the Install Netdata on Synology page. Then why still a blog post? The good news is that the basic installation now supports Synology DSM 7.2.2 and higher. However, the description was not accurate and left me with a NetData system that had warning alerts that still had to be resolved.. Therefore I share the steps I used install and resolve the issues (and update these when needed).

Initial installation

To install the stable version (now 2.5.1) of NetData, enable automatic update and disable the sharing of usage datas, ssh into the Synology NAS using an account that can run sudo and run the command:

wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh && sh /tmp/netdata-kickstart.sh --stable-channel --disable-telemetry

Now I do want NetData to run as non-root, but despite the statements on the installation page (at this moment) that this would require additional steps, this turned out not to be true. The installation script already created a netdata user and group and is also running as this. However, the delivered setup is not quite correct as created netdata user was not member of the netdata group. To correct this (or just to be sure) and make this change active run:

sudo synogroup --memberadd netdata netdata
sudo systemctl restart netdata

Netdata is now running on the NAS on port 19999 and it’s web UI can be accessed on that port. Please note that you may need to open your NAS’ firewall to be able to connect to it. Alternatively, you can also use SSH port forwarding (add -L 19999:localhost:19999 to your SSH command and NetData will be available as http://localhost:19999 as long as your SSH session is active).

Move Netdata to Storage [Addition 2025-05-18]

After running NetData for a while and despite being in Thin Client (i.e. streaming) mode, it will fill-up your root partition (the one where DSM lives), which is not good. To prevent this from becoming a problem, I moved NetData to a data volume post installation by running the following commands prior to the installation:

sudo systemctl stop netdata
sudo mv /opt/netdata /volume1/
sudo ln -s /volume1/netdata /opt/
sudo systemctl start netdata

Resolve restricted access to Synology’s Docker

After installation, NetData was unable to get the docker container names from the Docker engine running on my Synology NAS. This was caused by /var/run/docker.sock not being accessible. The easiest solution for this I found was to add user netdata to the group root, which owned the socket with:

sudo synogroup --memberadd root netdata

To make this change changes active run:

sudo systemctl restart netdata

Resolve system_clock_sync_state Alert

For unclear reasons, Synology DSM 7.2.2 does not seem to synchronize the system time with the real-time clock when NTP is enabled. Suggestions were provided in this forum post, which were in the right direction but outdated. To disable this error I found that editing /etc/chrony.conf.user and adding:

rtcsync

would do the trick after restarting chronyd with sudo systemctl restart chronyd the alert was cleared within seconds.

Setup Metric Streaming

As I had my existing setup and did not want the NAS to be busy with monitoring or stream it’s data to the (relatively slow) disks it has, I performed the following configuration changes:

  1. stop the running netdata with: sudo systemctl stop netdata
  2. change to the config directory: cd /opt/netdata/etc/netdata
  3. edit the main config file with sudo ./edit-config netdata.conf and change:
    1. to disable to web UI, add/change in section [web]:
      mode = none
    2. to disable the machine learning, add/change in section [ml]:
      enabled = no
    3. to disable health alerts, add/change in section [heath]:
      enabled = no
  4. create and edit the stream config file with sudo ./edit-config stream.conf and add/change in section [stream]:
    1. enabled = yes
    2. destination = <<YOUR NETDATA PARENT>>:19999
    3. api key = <<YOUR NETDATA STREAM API KEY>>
  5. change ownership and permissions of the created files with:
    1. sudo chgrp netdata netdata.conf stream.conf
    2. sudo chmod 640 netdata.conf stream.conf
  6. start netdata with: sudo systemctl start netdata

Netdata will soon start streaming metrics to you parent / collector server.

Conclusion

Having NetData running on my Synology NAS immediately gives me an insight in what is happening on the NAS out of the box. I still would be interested to see if more sensors area available via other plugins, but the basic metrics provided out of the box are already very useful.

The work is not yet done, as I currently still get 3 alerts for 10min_disk_backlog, this seems to happen more often and is something that can be tweaked according to this bug report. For now I have silenced them and will look into that at a later moment.

Happy New Year!

All the best for 2023 and that it may be a great and healthy year with more stability and peace than 2022!

The last almost two years I have not posted anything, simply because I did not have much time for it but also ais I did not really do anything noteworthy for a blog post. Currently I am working on several small projects again that probably will result in a post here about it.

Please note that I wil soon be moving my ancient Gitlab repository to something else (most likely Gitea as it seems to have all the features I need and is under active development). Links from this blog to my code may then change and I have not yet found a way to keep them working.

I will keep this short but expect to post some updates soon.

Running PivacyIDEA with FreeIPA

for quite some time I have been using FreeIPA to manage 2FA tokens (TOTP, Yubikey, SMS/eMail). As part of my MacOS Server Migration series and moving my OpenDirectory / Authentication services to FreeIPA, I also had to move PrivacyIDEA from my legacy MacOS Server and decided to move it to the FreeIPA server to have all authentication services on the same host. I am aware that FreeIPA also has OTP support built-in, but as that only supports TOTP tokens, this did not suit my needs.

In this post describes how to get this working, without interfering with the FreeIPA web interface/services. This turned out to be a bit tricky as it requires additional rights granted to work under SELinux.

Update 2019-09-18: added how to migrate an existing PrivacyIDEA instance.

Continue reading “Running PivacyIDEA with FreeIPA”

MacOS Server Replacement #4 – Moving (Free)Radius to FreeIPA

After migrating OpenDirectory (LDAP) to FreeIPA, the next step in my MacOS Server replacement is to migrate the (Free)Radius service as well so that FreeIPA becomes the single authentication source within my network like the MacOS Server has been for years. There are several online guides available describing how to setup FreeRadius on FreeIPA, also on the FreeIPA HowTo list, though as I ended up using fragments of multiple guides to install and configure FreeRadius on FreeIPA with LDAP and MSCHAPv2 support (needed for EAP and other mechanisms) I wrote this post as a single step by step guide.

Continue reading “MacOS Server Replacement #4 – Moving (Free)Radius to FreeIPA”

Manage devices with legacy Firefox versions on MacOS

I still have a few old web-managed devices of which the web UI does not work (correctly) with modern browser versions. It found out that they worked fine with Firefox 17.0.9esr (yes I know that is really old) and for quite a while I kept an outdated VM available to manage them. Since the OS that runs on now also is way beyond EOL I worked out a way to use older versions of the FireFox browser (as they keep a great archive of their historic versions).

Yes, one shouldn’t use obsolete browser versions as it is not safe for normal browsing, but to access a web interface of an internal device (that otherwise can’t be managed) should be safe enough as long as one doesn’t visit other sites. In this post I will describe how I set this up and also how I ensured that the browser would not conflict with a regular installation of the Firefox Browser

Continue reading “Manage devices with legacy Firefox versions on MacOS”

Integrating Synology DS with FreeIPA

I recently decided to replace my outdated Synology DS 1010+ NAS (in service 24×7 for over 8 years without major issues) with a new DS 1618+ NAS. Of course the new NAS is a lot faster, has an additional drive bay but to me most important was to replace the hardware and benefit from the newer version of DSM (Synology’s NAS software platform). However, this post is not about my new NAS (there are sufficient other sites describing / testing / comparing these devices).

Of course, now that I am integrating everything with FreeIPA (replacing my MacOS OpenDirectory setup) I also needed the Synology NAS to be fully integrated with FreeIPA. Jack Henschel’s excellent post that gave me some clue’s but wasn’t quite clear in how things worked and what was really needed. The article itself was clear in the steps to take but not everything worked for me immediately so I had to find out why and how to fix that and document that in this post.

Continue reading “Integrating Synology DS with FreeIPA”

Password-Protecting Shell Scripts

When setting up systems, configuring applications and making changes I prefer to script things rather than follow instructions. Main drawback of scripting is that it takes more time but has (in my view) a number of advantages

  • Scripting makes things reproducible
  • Allows for checking and validation
  • (when needed) can produce change logs
  • It can be reused when the same change has

However, frequently these scripts contain sensitive information (e.g. passwords) and must be transferred to someone (or another system) so they should not be stored in clear text. This post explains how to encrypt shell scripts using openssl for cross-platform use.

Continue reading “Password-Protecting Shell Scripts”

Multiple Mosquitto instances on Debian with Systemd

I have been playing for quite a while MQTT to have my Arduino devices communicate with Node-Red for all kinds of automation. Due to the constraints of the Arduino’s, so far I have not been able to effectively secure this as SSL/TLS is not an option on these devices.

Mosquitto supports multiple listeners out of the box though aside from the listener-specific settings all listeners share the same global (e.g. authentication and plugin) settings. To secure my setup and to work on a more permanent solution I needed different settings per listener for which multiple Mosquitto instances are required (i.e. multiple instances of the mosquitto daemon with their configuration and listeners different IP addresses / ports). This was not difficult on my Debian server but as I did not find much documentation on this I will document the necessary steps in this post.

Continue reading “Multiple Mosquitto instances on Debian with Systemd”