How to notify/alert when the SSH/RDP service is not running in GCE VM - google-cloud-platform

Question

GCP Operation's suite doesnot have a pre built metric to monitor the SSH (Linux) / RDP (Windows) service running in the GCE VM. Also I have tried to find it in GCP Logging but couldn't find any logs about the service running in the OS.
Is there any other way to monitor the health of SSH / RDP Service in GCE VM's ? And to forward an alert if it is not in running state.

Answer 1

I updated my answer:
You can use Cloud Logging to monitor status of SSH daemon and connections to it on your VM instances:
install logging agent that will send logs to Cloud Logging (formerly Stackdriver):
curl -sSO https://dl.google.com/cloudagents/add-logging-agent-repo.sh
sudo bash add-logging-agent-repo.sh
sudo apt-get update
sudo apt-get install google-fluentd
sudo apt-get install -y google-fluentd-catch-all-config
edit logging agent configuration located at /etc/google-fluentd/config.d/syslog.conf to collect entries from auth.log by adding:
<source>
type tail
# Parse the timestamp, but still collect the entire line as 'message'
format /^(?<message>(?<time>[^ ]*\s*[^ ]* [^ ]*) .*)$/
path /var/log/auth.log
pos_file /var/lib/google-fluentd/pos/auth.log.pos
read_from_head false
tag auth
</source>
restart google-fluentd to apply updated configuration:
sudo service google-fluentd restart
go to Cloud Console -> Logging -> Logs Explorer and look for events related to SSH daemon:
configure alerts; in addition, have a look at the 3rd party examples here and
here.
You can use same approach for checking and monitoring RDP on Windows:
install logging agent
edit logging agent configuration located at C:\Program Files (x86)\Stackdriver\LoggingAgent\fluent.conf
restart logging agent
go to Cloud Console -> Logging -> Logs Explorer and look for events related to RDP service.
configure alerts
EDIT
In order for the incidents to not close automatically, you can create two metrics:
1st logs termination signal and 2nd that logs SSH startups.
Then you should create an alert that fires when the first one is above zero AND second one is below one.
In that way, incident will last until sshd is started again.