Consul 1.16.1在Ubuntu 20.04上os_service检查报错‘not implemented’求助

环境 #

• Ubuntu 20.04（qemu环境）
• Consul 1.16.1
• Vault 1.14.1

问题描述 #

按照Consul官方文档配置os_service类型检查来监控Vault的systemd服务，无论怎么调整配置（包括仅保留os_service和interval的极简配置），启动Consul时都会报"not implemented"错误，导致Consul启动失败。

服务配置 #

services = [
{
  name = "vault"
  port = 8200
    checks = [
      {
        http = "vault1.foo.bar.com:8200/sys/health"
        interval = "15s"
        timeout = "10s"
      },
      {
        name = "Vault Service"
        os_service = "vault.service"
        interval = "15s"
      },
      {
        name = "Vault gRPC health check"
        grpc = "vault1.foo.bar.com:8201"
        grpc_use_tls = true
        interval = "10s"
      },
    ]
}
]

错误日志 #

consul[82355]: ==> Starting Consul agent...
consul[82355]:                Version: '1.16.1'
consul[82355]:             Build Date: '2023-08-05 21:56:29 +0000 UTC'
consul[82355]:                Node ID: '3e269875-156b-d7e7-8cfa-2b84c9487ef9'
consul[82355]:              Node name: 'vault1'
consul[82355]:             Datacenter: 'west' (Segment: '')
consul[82355]:                 Server: false (Bootstrap: false)
consul[82355]:            Client Addr: [127.0.0.1] (HTTP: 8500, HTTPS: -1, gRPC: 8502, gRPC-TLS: -1, DNS: 8600)
consul[82355]:           Cluster Addr: 10.12.1.94 (LAN: 8301, WAN: 8302)
consul[82355]:      Gossip Encryption: true
consul[82355]:       Auto-Encrypt-TLS: false
consul[82355]:            ACL Enabled: false
consul[82355]:     ACL Default Policy: allow
consul[82355]:              HTTPS TLS: Verify Incoming: false, Verify Outgoing: false, Min Version: TLSv1_2
consul[82355]:               gRPC TLS: Verify Incoming: false, Min Version: TLSv1_2
consul[82355]:       Internal RPC TLS: Verify Incoming: false, Verify Outgoing: false (Verify Hostname: false), Min Version: TLSv1_2
consul[82355]: ==> Log data will now stream in as it occurs:
consul[82355]: 2023-08-30T21:46:51.171Z [WARN]  agent: skipping file /etc/consul.d/.vault.hcl.swp, extension must be .hcl or .json, or config format must be set
consul[82355]: 2023-08-30T21:46:51.171Z [WARN]  agent: skipping file /etc/consul.d/consul.env, extension must be .hcl or .json, or config format must be set
consul[82355]: 2023-08-30T21:46:51.184Z [WARN]  agent.auto_config: skipping file /etc/consul.d/.vault.hcl.swp, extension must be .hcl or .json, or config format must be set
consul[82355]: 2023-08-30T21:46:51.184Z [WARN]  agent.auto_config: skipping file /etc/consul.d/consul.env, extension must be .hcl or .json, or config format must be set
consul[82355]: 2023-08-30T21:46:51.186Z [INFO]  agent.client.serf.lan: serf: EventMemberJoin: vault1 10.12.1.94
consul[82355]: 2023-08-30T21:46:51.186Z [INFO]  agent.router: Initializing LAN area manager
consul[82355]: 2023-08-30T21:46:51.189Z [WARN]  agent.client.serf.lan: serf: Failed to re-join any previously known node
consul[82355]: 2023-08-30T21:46:51.189Z [ERROR] agent: error creating OS Service client: error="not implemented"
consul[82355]: 2023-08-30T21:46:51.190Z [ERROR] agent: Error starting agent: error="Failed to register service \"vault\": not implemented"
consul[82355]: 2023-08-30T21:46:51.190Z [INFO]  agent: Exit code: code=1
systemd[1]: consul.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: consul.service: Failed with result 'exit-code'.
systemd[1]: Failed to start "HashiCorp Consul - A service mesh solution".
systemd[1]: consul.service: Scheduled restart job, restart counter is at 5.
systemd[1]: Stopped "HashiCorp Consul - A service mesh solution".
systemd[1]: consul.service: Start request repeated too quickly.
systemd[1]: consul.service: Failed with result 'exit-code'.
systemd[1]: Failed to start "HashiCorp Consul - A service mesh solution".

疑问 #

请问这是bug还是配置问题？

这个错误并非配置问题，而是Consul的os_service检查仅在Consul Enterprise版本中支持，开源版本（OSS）并没有实现这个功能，所以会抛出"not implemented"错误。

对于开源版本，你可以用以下两种方式替代监控systemd服务状态：

1. 使用脚本检查 #

编写一个简单的shell脚本，检查vault服务的状态，然后配置Consul的script类型检查：

首先创建脚本/usr/local/bin/check_vault_service.sh：

#!/bin/bash
systemctl is-active --quiet vault.service
exit $?

给脚本添加执行权限：

chmod +x /usr/local/bin/check_vault_service.sh

然后修改Consul服务配置，替换os_service检查为：

{
  name = "Vault Service"
  script = "/usr/local/bin/check_vault_service.sh"
  interval = "15s"
}

2. 结合Vault的健康检查API #

你已经配置了Vault的/sys/health HTTP检查，这个接口本身就能反映Vault服务的运行状态（返回200表示活跃可用），如果Vault进程崩溃，这个HTTP请求会直接失败，也能间接监控服务状态。如果需要同时确认systemd层面的状态，优先用上面的脚本方案。

内容的提问来源于stack exchange，提问作者Weetabix