Munin dynamic graph zoom (dynazoom) not working (CentOS6,nginx,php-fpm)

Question

• CentOS 6.3
• munin 2.0.17-1
• php54 (php-fpm)
• nginx 1.2.6-1

Setup munin via the 'epel' repo and after tinkering, I got it working with multiple nodes. However the graph zoom did not work on any of the graphs. I ended up switching the *_strategy mode from HTML to cgi per a suggestion I found online - which made it so that none of the graphs are updating (since cgi isn't working) and the zoom is still broken.

All of the guides that I can find online (including the official: http://munin-monitoring.org/wiki/CgiHowto2) refer to using spawnfcgi (which I used to use on an older CentOS5 server) and spawning specific instances for this. However, I'm utilizing php-fpm rather than spawnfcgi on this server am having trouble adapting this to work.

By not working, I mean simply that the graph will not load on the 'zoom' screen but rather shows a broken image link. nginx error log shows:

2013/09/05 16:31:59 [error] 29384#0: *2 open() "/usr/share/nginx/vhosts/munin.mydomain.com/public_html/munin-cgi/munin-cgi-graph/mydomain.com/host.mydomain.com/postfix_mailvolume-pinpoint=1378299671,1378407671.png" failed (2: No such file or directory), client: 10.30.2.1, server: munin.mydomain.com, request: "GET /munin-cgi/munin-cgi-graph/mydomain.com/host.mydomain.com/postfix_mailvolume-pinpoint=1378299671,1378407671.png?&lower_limit=&upper_limit=&size_x=800&size_y=400 HTTP/1.1", host: "munin.mydomain.com", referrer: "http://munin.mydomain.com/static/dynazoom.html?cgiurl_graph=/munin-cgi/munin-cgi-graph&plugin_name=mydomain.com/host.mydomain.com/postfix_mailvolume&size_x=800&size_y=400&start_epoch=1378299671&stop_epoch=1378407671"

Here is the munin.conf:

[16:42:21]$ cat /etc/munin/munin.conf | sed -e '/^#/d' -e '/^$/d'
htmldir /usr/share/nginx/vhosts/munin.mydomain.com/public_html/
includedir /etc/munin/conf.d
graph_strategy cgi
cgiurl_graph /munin-cgi/munin-cgi-graph
html_strategy cgi
[host.mydomain.com]
    address 127.0.0.1
    use_node_name yes
[otherhost.mydomain.com]
    address 1.2.3.4
    use_node_name yes

Here is the vhost for nginx:

[16:44:16]$ cat /etc/nginx/conf.d/vhosts/munin.thegnomedev.com.conf | sed -e '/^$/d' -e '/^#/d'
server {
    listen      80;
    server_name munin.mydomain.com;
    access_log /var/log/nginx/munin.mydomain.com combined;
    error_log /var/log/nginx/error.log warn;
    rewrite_log on;
    root    /usr/share/nginx/vhosts/munin.mydomain.com/public_html/;
    index   index.php index.html index.htm;
    location  /  {
        auth_basic            "Restricted";
        auth_basic_user_file  /usr/share/nginx/vhosts/munin.mydomain.com/.htpasswd;
    }   
    location ^~ /cgi-bin/munin-cgi-graph/ {
        fastcgi_split_path_info ^(/cgi-bin/munin-cgi-graph)(.*);
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        include fastcgi_params;
    }
    location /munin/static/ {
        alias /etc/munin/static/;
    }
    location /munin/ {
        fastcgi_split_path_info ^(/munin)(.*);
        fastcgi_param PATH_INFO $fastcgi_path_info;
                fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        include fastcgi_params;
    }
    # Deny hidden file types
    location ~ /(\.ht|\.git|\.svn) {
    deny  all;
    }
}

At this point, I'm frustrated enough that I think I'm hitting brain lock. I'll admit, it's likely that my lack of full understanding of nginx's syntax as well as how it interacts with php-fpm is probably to blame - especially if there is a simply syntax change that I can make to have this working.

Any help with resolving this with my existing stack would be most appreciated. Have been googling and trying various things for the better part of the day.

Thanks

Answer 1

This is a bug related to SELinx in RHEL according to https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=1000736.

Description of problem:
zooming doesn't work when selinux is in enforcing mode

Version-Release number of selected component (if applicable):
munin-2.0.17-1.el6.noarch
selinux-policy-3.7.19-195.el6_4.12.noarch
selinux-policy-targeted-3.7.19-195.el6_4.12.noarch

Steps to Reproduce:
1. click on munin graph to zoom in

Actual results:
no graph image

Expected results:
graph image

Additional info:
it works with selinux in permissive mode

If you disable SELinux it work fine:

sudo setenforce 0

According to the last comment in the bug report this should be fixed in RHEL 6.5 (Centos should pick it up).

Answer 2

You've mapped location /cgi-bin/munin-cgi-graph/ via FastCGI passthrough to PHP-FPM, but that works for PHP scripts, not for arbitrary CGI scripts such as Munin's CGI grapher, which is actually Perl. To make that CGI script speak the FastCGI protocol, the wrapper you need to use would be the generic spawn-fcgi.