橡yahagi.PDF

Size: px

Start display at page:

Download "橡yahagi.PDF"

しゅんすけやたけ
7 years ago
Views:

1 2 1

2 4 2

3 5 6 3

4 7 8 4

5 9 10 Traffic 5

7 13 14 $ multiping -t -c PING ( ) ( ): 56 data bytes PING bose.com ( ) ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=224 time=144 ms 64 bytes from : icmp_seq=0 ttl=237 time=207 ms 64 bytes from : icmp_seq=9 ttl=224 time=151 ms 64 bytes from : icmp_seq=9 ttl=237 time=208 ms -=-=- PING statistics -=-=- Number of Packets Round Trip Time Remote Site Sent Rcvd Rptd Lost Min Avg Max ( ) % bose.com ( ) % TOTALS % $ 7

9 17 18 $ telnet 80 Trying Connected to Escape character is ^] ^]. get / <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>501 Method Not Implemented</TITLE> </HEAD><BODY> <H1>Method Not Implemented</H1> get to /index.html not supported.<p> Invalid method in request get /<P> <HR> <ADDRESS>Apache/ Server at Port 80</ADDRESS> S> </BODY></HTML> Connection closed by foreign host. $ 9

12 23 24 root ccitt(0) iso(1) joint-iso-ccitt(2) org(3) dod(6) internet(1) directory(1) mgmt(2) experimental(3) private(4) mib(1) enterprises(1) 12

13 25 iso(1).org(3).dod(6).internet(1).mgmnt(2).mib(1). 1: system 2: interfaces 3: at 4: ip IP 5: icmp ICMP 6: tcp TCP 7: udp UDP 11: snmp SNMP 26 13

15 30 15

20 39 equipment polling traffic monitor event trap alram notification Basic IF Traffic Grabber SNMP pkg log mon warning notifier extension IF / Plug-ins Network Monitor Base System Big Brother Network Monitor 20

21 ping,smtp,http,pop3,dns,ftp,telnet,ssh,imap CPU,disk,processes,logs 21

53 54 Availability Report Oct 17 2000 - Nov 1 2000 dev01.lab.eccess.net - cpu Availability: 95.52% Red Yellow Green Purple Clear Blue 4.48% 2.11% 93.41% 0.00% 0.

27 53 54 Availability Report Oct Nov dev01.lab.eccess.net - cpu Availability: 95.52% Red Yellow Green Purple Clear Blue 4.48% 2.11% 93.41% 0.00% 0.00% 0.00% Event logs for the given period Event Start Event End Status Seconds Cause Mon Oct 30 20:13: Mon Oct 30 20:18: yellow 300 up: 12 days, 2 users, 48 procs, load=703 Mon Oct 30 05:38: Mon Oct 30 05:43: yellow 300 up: 11 days, 2 users, 48 procs, load=708 Sun Oct 29 15:03: Sun Oct 29 15:08: yellow 300 up: 10 days, 3 users, 51 procs, load=725 Sun Oct 29 10:53: Sun Oct 29 10:58: yellow 300 up: 10 days, 3 users, 51 procs, load=702 Sun Oct 29 08:03: Sun Oct 29 08:08: yellow 297 up: 10 days, 3 users, 51 procs, load=708 Sun Oct 29 00:28: Sun Oct 29 00:33: yellow 300 up: 10 days, 3 users, 51 procs, load=773 Sat Oct 28 20:23: Sat Oct 28 20:28: yellow 300 up: 10 days, 3 users, 51 procs, load=710 Sat Oct 28 09:53: Sat Oct 28 09:58: yellow 301 up: 9 days, 4 users, 56 procs, load=730 Sat Oct 28 06:18: Sat Oct 28 06:23: yellow 299 up: 9 days, 4 users, 66 procs, load=715 Sat Oct 28 03:33: Sat Oct 28 03:43: yellow 599 up: 9 days, 4 users, 90 procs, load=806 Sat Oct 28 02:03: Sat Oct 28 02:08: yellow 300 up: 9 days, 4 users, 75 procs, load=713 Wed Oct 18 12:41: Wed Oct 18 21:21: yellow up: 4 days, 2 users, 43 procs, load=415 Tue Oct 17 16:06: Wed Oct 18 12:41: red up: 3 days, 1 users, 64 procs, load=464 Time Critical/Offline: 20 hours 35 mins 2 secs Time Non-Critical: 9 hours 40 mins 6 secs 27

28 55 56 <IP Address> <Host Name> [ # <Service> {<Service>}] IP Address: IP Address Host Name: Service: 28

29 57 $ cat bb-hosts # # THE BIG BROTHER HOSTS FILE # kansi1.foo.co.jp # BBPAGER BBNET BBDISPLAY group-compress <H3><I>foo.co.jp Servers</I></H3> ns1.foo.co.jp # dns ssh!telnet mail.foo.co.jp # dns smtp pop3 ssh!telnet # telnet ssh ftp # router interface entry page Router-IF Router Intereface group-compress <H3><I>Router1 Interfaces</I></H3> gw1.foo.co.jp gw2.foo.co.jp group-compress <H3><I>Router2 Interfaces</I></H3> tok-yok-ma30.wan.foo.co.jp tok-osa-dr15.wan.foo.co.jp $ 58 Service BBNET,BBPAGER,BBDISPLAY BBDISPLAY BBPAGER BBNET ping noping: ping noconn: ping dialup: ping :NG smtp,http,pop3,dns,ftp,telnet,ssh,imap http URL : telnet port ~telnet : OK: NG 29

30 59 dialup modem-bank dialup modem-bank hosts;exhosts;services;exservices;day;time;recipients hosts: ( * ) exhosts: services: ( * ) exservices: day: 0-6 ( - ) time: recipients: hosts,services 30

31 61 $ cat bbwarnrules.cfg # bbwarnrules.cfg ns1.* mail.*;;*;;*;*;server-admin@foo.co.jp ## yahagi ## ## strage.*;;*;conn;0-6; ;strage-admin@foo.co.jp ## ## intra.*;;*;;1-5; ;intra-admin@foo.co.jp ## ## *;;*;;*;*;admin@foo.co.jp ## unmatched-*;;*;;*;*;bb@localhost ## # end of bbwarnrules.cfg $ 62 31

32 63 64 $cat bbdef.sh #!/bin/sh # bbdef.sh # LOCAL CLIENT MONITORING CONFIGURATION FOR bb-local.sh # WARNING AND PANIC LEVELS FOR LOCAL SYSTEM INFOMRAION # YOU CAN SET VALUES ON A SPECIFIC FILESYSTEM BY USING # THE etc/bb-dftab FILE DFWARN=85 # (YELLOW) DISK % TO WARN DFPANIC=95 # (RED) DISK % TO PANIC export DFWARN DFPANIC # CPU LEVELS ARE THE 5 MINUTE LOAD AVERAGE x 100 CPUWARN=3000 # (YELLOW) WARN AT LOAD AVG OF 30 (default:1.5) CPUPANIC=6000 # (RED) PANIC AT LOAD AVG OF 60 (default:3) export CPUPANIC CPUWARN # PROCESS MONITORING # THESE VALUES ARE OVERRIDDEN BY THE etc/bb-proctab FILE PROCS="bbrun snmptrapd httpd!inetd" # (YELLOW) WARN IF NOT RUNNING PAGEPROC="cron radiusd sshd syslogd" # (RED) PAGE IF NOT RUNNING export PROCS PAGEPROC # MESSAGE FILE MONITORING (/var/adm/messages or similar) CHKMSGLEN="TRUE" # MAKE SURE MSG FILE IS NON-ZERO LEN MSGS="NOTICE WARNING" # (YELLOW) MESSAGES TO WATCH FORP AGEMSG="NOTICE" # (RED) PAGE IF WE SEE THIS MESSAGE IGNMSGS= # List of messages to ignore if string(s) matches line 32

33 65 # Default colors to send notification messages on PAGELEVELS= red purple # Default red purple export PAGELEVELS # Specify scripts to execute while running mkbb.sh/mkbb2.sh # Echo from them will be displayed on the generated web page BBMKBBEXT="bbradius.sh BBMKBB2EXT="eventlog.sh export BBMKBBEXT BBMKBB2EXT # EXECUTE LOCAL SCRIPTS FROM HERE... # SCRIPTS SHOULD LIVE IN $BBHOME/ext DIRECTORY # BBEXT CONTAINS THE FILENAMES TO EXECUTE # SEPERATE THE SCRIPTS WITH A SPACE: BBEXT="ext1.sh ext2.sh BBEXT="larrd/larrd.pl larrd/bf-larrd.sh export BBEXT $ 66 # PROCESS MONITORING # THESE VALUES ARE OVERRIDDEN BY THE etc/bb-proctab FILE PROCS="bbrun snmptrapd httpd!inetd" # (YELLOW) WARN IF NOT RUNNING PAGEPROC="cron radiusd sshd syslogd" # (RED) PAGE IF NOT RUNNING export PROCS PAGEPROC 33

73 74 http://www.deadcat.net/bb/bb-hist-2.5.tar.

37 /cgi-bin/bb-hist.sh MRTG bb-hist.pl /cgi-bin bb-hist.sh 37

38 Green Window - this is normal status Yellow Window - this is warning status. Red Window - this is critical status!! 38

39 UCD-SNMP(Net-SNMP) snmptrapd 78 OLD SITE = snmpd, snmptrapd, snmpbulkwalk, snmpget, snmpset, snmptest, snmpusm, snmpcheck, snmpgetnext, snmpstatus, snmptranslate, snmpwalk, snmpdelta, snmpnetstat, snmptable, snmptrap 39

40 79 traphandle <OID> <action> <parameters.> traphandle default <action> <parameters.> 80 # SNMP Trap : Cold Start traphandle /usr/bin/mail -s "coldstart Trap" admin@foo.co.jp # SNMP Trap : Warm Start traphandle /usr/bin/mail -s "warmstart Trap" admin@foo.co.jp # SNMP Trap : Link Down traphandle /usr/bin/mail -s "linkdown Trap" admin@foo.co.jp # SNMP Trap : Link Up traphandle /usr/bin/mail -s "linkup Trap" admin@foo.co.jp # SNMP Trap : Authentication Failure traphandle /usr/bin/mail -s "authfail Trap" admin@foo.co.jp # SNMP Trap : Other traphandle default /usr/bin/mail -s "Other Traps" yahagi@foo.co.jp 40

41 81 access-list 30 permit snmp-server contact snmp-server location YOKOHAMA-IW99 snmp-server community himitsu RO 30 snmp-server enable traps config snmp-server host NAISHO tty config envmon snmp 82 From: log-admin To: Date: Mon, 1 Nov :01: (JST) Subject: linkdown Trap nspixp2-gw.foo.co.jp system.sysuptime 24:10:03:09.12.iso.org.dod.internet.snmpV2.snmpModules.snmpMIB.snmpMIBObjects.snmpTrap.snm ptrapoid.iso.org.dod.internet.snmpv2.snmpmodules.snmpmib.snmpmibobjects.snm ptraps.linkdown interfaces.iftable.ifentry.ifindex.1 1 interfaces.iftable.ifentry.ifdescr.1 "Fddi1/0/0" interfaces.iftable.ifentry.iftype.1 Fddi enterprises "administratively down".iso.org.dod.internet.snmpv2.snmpmodules.snmpmib.snmpmibobjects.snmptrap.snm ptrapenterprise enterprises

42 MRTG (Multi Router Traffic Grapher) 84 42

43 85 URL: ( ) 43

45 89 90 cfgmaker { <option> } <community>@<target> <community> : snmp community string <target> : target address or hostname $ cfgmaker himitsu@ix-gw.foo.co.jp > ix-gw.cfg ifinoctets/ ifoutoctets syscontact/location WorkDir: 45

46 91 --ifref=nr... interface references by Interface Number(default) --ifref=ip... by Ip Addres --ifref=eth... by Ethernet Number --ifref=descr... by Interface Description --ifref=name... by Interface Name --ifref=type... by Interface Type 92 # Add a WorkDir: /some/path line to this file ###################################################################### # Description: Cisco Internetwork Operating System Software IOS (tm) GS... # Contact: admin@foo.co.jp # System Name: ix-gw.foo.co.jp # Location: PA, CA, US #... Target[ix-fddi.foo.co.jp]: 1:himitsu@ MaxBytes[ix-fddi.foo.co.jp]: Title[ix-fddi.foo.co.jp]: ix-gw.foo.co.jp (ix-fddi.foo.co.jp): Fddi1/0/0 PageTop[ix-fddi.foo.co.jp]: <H1>Traffic Analysis for Fddi1/0/0 </H1> <TABLE> <TR><TD>System:</TD><TD>ix-gw.foo.co.jp in Otemachi 5F</TD></TR> <TR><TD>Maintainer:</TD><TD></TD></TR> <TR><TD>Interface:</TD><TD>Fddi1/0 (1)</TD></TR> <TR><TD>IP:</TD><TD>ix-fddi.foo.co.jp ( )</TD></TR> <TR><TD>Max Speed:</TD> <TD>12.5 MBytes/s (fddi)</td></tr> </TABLE> 46

47 93 # crontab -l 0-59/5 * * * /usr/local/sbin/mrtg /usr/local/etc/ix-foo.cfg # RunAsDaemon:Yes Interval:5 mrtg --user=mrtg_user --group=mrtg_group mrtg.cfg 94 Target[gw1-3]: 3:himitsu@gw1.foo.co.jp Target[gw1-err-3]: ifinerrors.3&ifouterrors.3:himitsu@gw1.foo.co.jp Target[gw1-if-1]: -/ :himitsu@gw1.foo.co.jp Target[gw1-pingloss]: `/usr/local/bin/check_loss.sh gw1` 47

48 95 Target[<target name>]: <target <target name> : <target kind> : <community> : community string <address> : 96 48

49 97 ifinoctets ifoutoctets Target[gw1-3]: ifinoctets/ifoutoctets Target[gw1-3]: 1 In/Out 98 Target[gw1-err-3]: ifinerrors/ifouterrors Target[gw1-err-3]: & 49

50 99 [interfaces.iftable.ifentry] group : ifindex : ifdescr : iftype : ifadminstatus : ifoperstatus : ifinoctets : ifoutoctets : ifinucastpkts : ifoutucastpkts : ifindiscards : ifoutdiscards : ifinerrors : IfOutErrors 100 ifinoctets ifoutoctets 50

51 101 Target[gw1-if-1]: ifinoctets/ifoutoctets Target[gw1-if-1]: 5 In/Out 102 Interface addres OID/MIB symbol Target[gw1-if-1-disc]: ifindiscards/ & gw1.foo.co.jp Interface ifindiscards/ifoutdiscards Target[gw1-if-1-disc]: / & OID 51

52 103 ifinoctets ifoutoctets Target[sw1-2-11]: Target[sw-2-11]: Target[sw-3-7]: #3/7& #3/7:himi Target[sw-3-7]: 104 ifinoctets ifoutoctets Target[sw1-2-11]: Target[sw-2-11]: - to_web1:himitsu@sw1.foo.co.jp Target[sw-3-7]: to_web1& to_w eb1:himitsu@sw1.foo.co.jp Target[sw-3-7]: ifinerrors to_web1&ifouterrors to_web1:himitsu@sw1.foo.co.jp 52

53 105 Target[<target name>]: `<command>` <target name> : <command> : ` : incoming bytes outgoing bytes target uptime target 106 # ping i c 100 ftp.foo.co.jp PING ftp.foo.co.jp ( ): 56 data bytes. --- ftp.foo.co.jp ping statistics packets transmitted, 95 packets received, 5% packet loss round-trip min/avg/max/stddev = 0.161/0.164/0.221/0.006 ms # -i 0.02 : supervisor only option. FeeBSD ping 20ms 53

54 107 ping packet loss 100 packets transmitted, 95 packets received, 5% packet loss # cat /usr/local/bin/check_loss.sh #!/bin/sh /sbin/ping -f -c 100 $1 /usr/bin/sed 's/%//g' /usr/bin/awk /packet loss/ { printf("%d n%d n", $7, $7) } echo 0 ; echo $* # /usr/local/bin/check_loss2.sh ftp.foo.co.jp /usr/local/bin/check_loss.sh ftp.foo.co.jp # 108 # cat ping-loss.cfg WorkDir: /usr/local/etc/www/mrtg/ping-loss Target[pingloss-ftp]: `/usr/local/bin/check_loss.sh ftp.foo.co.jp` Title[pingloss-ftp]: ftp.foo.co.jp - pingloss MaxBytes[pingloss-ftp]: 100 PageTop[pingloss-ftp]: <H1> ftp.foo.co.jp - pingloss </H1> YLegend[pingloss-ftp]: packet loss(%) ShortLegend[pingloss-ftp]: % LegendI[pingloss-ftp]: loss: LegendO[pingloss-ftp]: loss: Legend1[pingloss-ftp]: packet loss Legend2[pingloss-ftp]: packet loss Legend3[pingloss-ftp]: Maximal 5 Minute packet loss Legend4[pingloss-ftp]: Maximal 5 Minute packet loss Options[pingloss-ftp]: noinfo,growright, gauge, nopercent # 54

55 109 Big Brother/MRTG/RRDTool 55

56 equipment polling traffic monitor event trap alram notification BB Basic IF RRDTool larrd MRTG bbmrtg.sh UCD SNMP BB extension IF / Plug-ins log mon Big Brother Network Monitor BB warning notifier 56

59 117 BBMRTGCFG=" # MRTG device BB Host svc Yellow Red Max Unit mrtg Bytes/s In Out mrtg 750: : Bytes/s In Out mrtg 750:24000:700: :32000:550: Bytes/s In Out mrtg 50% 75% Bytes/s In Out

60 120 60

63 125 :

66 $ snmpwalk himitsu 1 $ snmpwalk himitsu 2 $ snmpwalk himitsu ifdescr $ snmpwalk himitsu iftype $ snmptranslate -IR ifindiscards OID $ snmptranslate Tdp -IR ifindiscards OID MIB Tree $ snmptranslate Tp 2 Interface(2) MIB Tree $ snmptranslate -On OID MIB Symbol $ snmptranslate -On -Tda

68 135 From: (Cron Daemon) To: Date: Fri, 13 Oct :03: (JST) Subject: Cron /usr/local/mrtg/mrtg /usr/local/mrtg/conf/mrtg.cfg -- ERROR: I guess another mrtg is running. A lockfile (/usr/local/mrtg/conf/mrtg.cfg_l) aged 303 seconds is hanging around. If you are sure that no other mrtg is running you can remove the lockfile

74 NetSaint RRDTools FrontEnds 74

75 149 MRTG plugin remote server management plugin

80 : /URL UNIX MAGAZINE OPEN DESIGN No.10 Software Design trafshow, MRTG, ntop Software Design

81 161 SNMP "Snmp, Snmpv2, Snmpv3, and Rmon 1 and 2" -- William Stallings; 3rd edition (January 1999) Addison-Wesley Pub Co; ISBN: ; 2 "Practical Guide to SNMPv3 and Network Management, A" -- David Zeltserman, Dave Zeltserman; (May 4, 1999) Prentice Hall; ISBN: SNMP - - William Stallings Addison-Wesley Publiching Company; ISBN Yet Another network command/tool/system Building Network Monitoring Systems with RRDtool Using Remstats for Network and Server Monitoring 81

82 163 Communication Traffic Project Distributed Benchmark System Network Management re/pubdomain.html ou/snmpdocs/tutorial1.html 82

83 165 URL Angel Network Monitor Big Brother Extensions Archive: Expect fping html IPTraf logsurfer MRTG URL mon NeTraMet MTR NetSaint nocol/multiping ntop NTTCP 83

84 167 RRDTool URL Frontend - CRICKET Frontend - NRG Frontend - ORCA Frontend - Remstats : Scotty seafelt shepherd sing SPONG ssh statscout SWATCH syslog-ng URL 84

85 169 URL Treno Experimental TCP Implementations UCD-SNMP visualroute URL URL General network management portal The Simple Times SNMP FAQ 85

86 171 URL Sample Cisco device security configs Cisco device SNMP configuration tips Free software link Fresh Meat Free Software Index SOURCE FORGE Solaris Freeware Project 86

87 173 IETF NANOG JANOG CAIDA cflowd, RRDTool, etc LBNL's Network Research Group tcpdump, libpcap, arpwatch, traceroute, pathchar 87

橡c10-1.PDF

橡c10-1.PDF SATO/Internet Research Institute Copyright 1999 Shigeki YAHAGI/Intelligent Telecom 2 SATO/Internet Research Institute Copyright 1999 Shigeki YAHAGI/Intelligent Telecom 1 3 GPL,Opensource TCP-Wapper SATO/Internet

橡yahagi.PDF

橡yahagi.PDF