banshee/services-collection/services/redis/ssh/memory

Redis memory, by SSH

Returns the memory a Redis server uses, against its maxmemory when one is set or against the machine's memory when none is, its fragmentation, and the keys it evicted to make room, read by redis-cli INFO on the Redis server over SSH. Three watches are offered, each one set on the probe. No password leaves banshee.

Versions

Redis 3.2 and later (total_system_memory), and Valkey, which answers INFO alike. Generic: no folder of version.

How it works

The collector runs, on the server, LC_ALL=C redis-cli -p <port> INFO. When a password file is set, the command starts with REDISCLI_AUTH="$(cat '<file>')": the shell of the server puts the content of the file in REDISCLI_AUTH, the variable the documentation of redis-cli gives to pass a password safely, and redis-cli logs in with it. The password never leaves the server and is never written on a command line. INFO answers one field:value line per figure:

# Memory
used_memory:1052336
total_system_memory:8235962368
maxmemory:4294967296
mem_fragmentation_ratio:1.21
# Stats
evicted_keys:0

used is used_memory, the memory Redis allocated, in MiB.
used-percent is used_memory against maxmemory; when no maxmemory is set (0), against total_system_memory, the memory of the machine, which Redis then grows into until the system runs out. limit says which: maxmemory or system.
fragmentation is mem_fragmentation_ratio, the memory the system gave Redis against the memory Redis uses: much above 1, memory is lost to fragmentation; under 1, Redis is swapped out.
evicted is evicted_keys: it only grows until Redis restarts, and "Keys evicted" raises when it grows.
A Redis that refuses the connection, or whose port nobody listens on, is critical: "Redis is not running". A refused account (NOAUTH, WRONGPASS, NOPERM) stops the collector misconfigured, as does any other answer than INFO.
Nothing is written: INFO only reads.

Prerequisites

An SSH account for monitoring, without write rights (monitoring below), on the Redis server, with redis-cli in its path (installed with the server; redis-tools on Debian and Ubuntu).
When Redis asks for a password (requirepass, the password of its default user), a file owned by that account, mode 0400, holding the password alone, on one line, set in redis:password-file:

install -m 0400 -o monitoring /dev/null /home/monitoring/.redis-password
editor /home/monitoring/.redis-password

No sudo.
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented).

Variables

Name	Label	Says	Default
`redis:port`	Port	the port Redis listens on, on the server	`6379`
`redis:password-file`	Password file	the path, on the server, of the file that holds the password; empty: no password	—

Outputs

Name	Label	Unit	Per instance
`used`	Memory used	MiB	no
`used-percent`	Memory used against its limit	%	no
`limit`	Limit counted against	—	no
`fragmentation`	Fragmentation ratio	—	no
`evicted`	Keys evicted since start	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`full`	Memory nearly full	above a threshold, on `used-percent`	warning above 80 %, critical above 90 %	yes
`fragmentation`	Memory fragmented	above a threshold, on `fragmentation`	warning above 1.5, for 3 runs	no
`evicted`	Keys evicted	increase, on `evicted`	warning beyond 0 in 1 h	no

A Redis used as a cache with maxmemory and an eviction policy is meant to sit near its limit and evict: "Memory nearly full" is then unchecked, and "Keys evicted" is what tells it is too small.

Limits

Redis is reached on the server itself (127.0.0.1); a Redis that listens only on another address, or only over TLS, is not reached.
A Redis that holds little data shows a high fragmentation that means nothing: that is why its watch is unchecked.
The password file is read by the shell of the server: a path may only hold letters, digits and . _ / -.
Only the default user logs in. A Redis 6 ACL user of its own is not served: the documentation of redis-cli gives --user only with -a, which writes the password on the command line.
Not checked against a Redis: the fields are those of the documentation of INFO (redis.io).