MUNIN-NODE.CONF(5)

💅 NAME 💅

munin-node.conf — the config file for Munin-node, aka the little agent bestie that Munin pulls all its data from 🎀

---

✨ DESCRIPTION ✨

okay so munin-node.conf is literally the configuration file for munin-node, the agent that Munin fetches data from. she's the one doing the actual work, no cap. 👑

the format here? dictated entirely by Net::Server. so if you go run perldoc Net::Server you'll get the full list of options the file supports by way of that module. this page is mainly covering the Munin-specific extensions though — the extra sparkle on top, iykyk. 🌸

the following options are of special interest:

• allow RE — the IP based access list lives here. you can repeat this statement as many times as you want, slay. but bestie, important: it's actually a regular expression after the keyword, so to allow localhost you have to write it like this:

      allow ^127\.0\.0\.1$

• cidr_allow NETWORK/MASK — an alternative to allow RE. lets you write the access list in CIDR format instead. for instance, cidr_allow 192.0.2.0/24 would allow connections from any IP from 192.0.2.1 to 192.0.2.254. and cidr_allow 127.0.0.1/32 is the equivalent to the example above. note that the netmask must be provided, even though it's just /32. this option requires that the Net::CIDR Perl module be installed.
• host IP — the IP number of the interface munin-node should listen on. by default munin-node listens to all interfaces. to make munin-node listen only on the localhost interface — making it unavailable from the network — do this:

      host 127.0.0.1

🎀 Additional options 🎀

• host_name <host> — if set, overrides the hostname munin-node uses in its 'hello'-negotiation with munin. a telnet localhost 4949 will show you the hostname munin-node is currently using. and if munin-node and the main munin installation do not agree on the hostname, munin will skip all the plugins of the machine in question. 😭 so like, get this one right.
• paranoia <yes|no|true|false|on|off|1|0> — if set, checks permissions of plugin files, and only tries to run files owned by root. default on. stay safe out there. 🔒
• ignore_file <regex> — files matching <regex> in the node.d/ and node-conf.d/ directories will be overlooked. bye felicia. 👋
• tls <value> — can have four values: paranoid, enabled, auto, and disabled. paranoid and enabled require a TLS connection, while disabled will not attempt one at all. the current default is disabled because auto is broken. auto causes bad interaction between munin-update and munin-node if the node is unprepared to go to TLS. if you see data dropouts (gaps in graphs) please try to disable TLS.
• tls_verify_certificate <value> — this directive can be yes or no. it determines if the remote certificate needs to be signed by a CA that is known locally. default is no.
• tls_private_key <value> — this directive sets the location of the private key to be used for TLS. default is /etc/munin/munin-node.pem. the private key and certificate can be stored in the same file. 🗝️
• tls_certificate <value> — this directive sets the location of the TLS certificate and optional intermediate CA certificates to be used for TLS. default is /etc/munin/munin-node.pem. the private key and certificate can be stored in the same file.
• tls_ca_certificate <value> — this directive sets the CA certificate to be used to verify the node's certificate, if tls_verify_certificate is set to yes. default is /etc/munin/cacert.pem.
• tls_verify_depth <value> — this directive sets how many signings up a chain of signatures TLS is willing to go to reach a known, trusted CA when verifying a certificate. default is 5. going deep fr fr. 🕳️
• tls_match <value> — this directive, if defined, searches a dump of the certificate provided by the remote host for the given regex. the dump of the certificate is two lines of the form:

      Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email
      Issuer  Name: /C=c/ST=st/O=o/OU=ou/CN=cn/emailAddress=email

so, for example, one could match the subject distinguished name by the directive:

      tls_match Subject Name: /C=c/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=email

note that the fields are dumped in the order they appear in the certificate. it's best to view the dump of the certificate by running munin-update in debug mode and reviewing the logs.

unfortunately, due to the limited functionality of the SSL module in use, it is not possible to provide finer-grained filtering. by default this value is not defined.

---

🌈 EXAMPLE 🌈

a pretty normal configuration file, bestie — copy this vibe:

log_level 4
log_file /var/log/munin/munin-node.log
port 4949
pid_file /var/run/munin-node.pid
background 1
setsid 1

host *
user root
group root
setsid yes

ignore_file \.bak$
ignore_file \.rpm(save|new)$
ignore_file ^README$

allow ^127\.0\.0\.1$

ignore_file \.dpkg-(old|new)$
ignore_file \.rpm(save|new)$

see the documentation or Munin homepage <http://munin-monitoring.org/> for more info. 🦋

---

🫶 AUTHORS 🫶

Jimmy Olsen. (yes, that's really the name, and honestly? main character energy. 👑)

---

💜 COPYRIGHT 💜

Copyright (C) 2002-2006 Audun Ytterdal, Jimmy Olsen, Dagfin Ilmari Mansåker, Nicolai Langfeldt

this is free software; see the source for copying conditions. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 🫠

this program is released under the GNU General Public License.

---

and that's the whole page, bestie 💖 go forth and configure your node, you're literally gonna eat. periodt. ✨

Munin 2.0.78 — dated 2026-09-30 — that's the tea, signing off, mwah 💅