<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>takizo, not takezo &#187; nms</title>
	<atom:link href="http://systems.takizo.com/category/nms/feed/" rel="self" type="application/rss+xml" />
	<link>http://systems.takizo.com</link>
	<description>the systems admin blog</description>
	<lastBuildDate>Thu, 09 Sep 2010 04:11:00 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Install and Configure Thold on Cacti</title>
		<link>http://systems.takizo.com/2009/08/21/install-and-configure-thold-on-cacti/</link>
		<comments>http://systems.takizo.com/2009/08/21/install-and-configure-thold-on-cacti/#comments</comments>
		<pubDate>Fri, 21 Aug 2009 11:51:14 +0000</pubDate>
		<dc:creator>takizo</dc:creator>
				<category><![CDATA[nms]]></category>

		<guid isPermaLink="false">http://systems.takizo.com/?p=756</guid>
		<description><![CDATA[There are a bunch of Cacti&#8217;s plugins which can do better monitoring. One of the recommended and popular plugin for Cacti is Thold. Thold is a plugin to monitor bandwidth usage and trigger an alert when it reaches the threshold. Plugin Architecture needs to be installed in order to activate it on Cacti. Let&#8217;s start [...]]]></description>
			<content:encoded><![CDATA[<p>There are a bunch of Cacti&#8217;s plugins which can do better monitoring. One of the recommended and popular plugin for Cacti is Thold. Thold is a plugin to monitor bandwidth usage and trigger an alert when it reaches the threshold. Plugin Architecture needs to be installed in order to activate it on Cacti. </p>
<p>Let&#8217;s start  the installation and configuration.</p>
<p><span id="more-756"></span></p>
<h2>Backup Your Cacti Files</h2>
<p>Plugin Architecture will make some changes on some Cacti file, it&#8217;s recommend to backup Cacti&#8217;s core file before install Plugin Architecture. If Cacti application is monitoring thousand of routers, It&#8217;s advices not to backup RRA/RRD files together. Backing up RRA/RRD file will take up a lot of disk space and it&#8217;s time consuming. Log file folder can be excluded as well, since only the core files need to be backup.</p>
<p>Take /usr/local/share/cacti as the example of the located Cacti&#8217;s files, lets backup Cacti&#8217;s core files without RRA/RRD and log files;</p>
<pre>
<code>
cd /usr/local/share
tar -vzcf cacti-backup.tar.gz --exclude=cacti/rra/* --exclude=cacti/log/* cacti
</code>
</pre>
<p>After backup has been done, Plugin Architecture installation is ready to roll.</p>
<h2>Install Cacti Plugin Architecture</h2>
<p>Cacti Plugin Architecture can be downloaded from <a target="_blank" target="_blank" href="http://www.cactiusers.org">cactiusers.org</a>. Documentation of Cacti Plugin Architecture installation is available on <a target="_blank" target="_blank" href="http://cactiusers.org/wiki/PluginArchitectureInstall">Cacti Users&#8217; documentation wiki</a>.</p>
<h2>Install and Configure Thold Plugin</h2>
<p>Refer to <a target="_blank" href="http://cactiusers.org/wiki/PluginArchitectureInstall">Cacti&#8217;s plugin installation</a>, before installing Thold plugin, Settings plugin is needed for Thold plugin. Both of the plugin is available on <a target="_blank" href="http://cactiusers.org" target="_blank">Cacti Users</a> website. </p>
<p>Make sure Thold plugin has been activated on include/global.php. Installation has been done, but Thold setting on is not show Cacti&#8217;s Setting page? Permission needs to be granted before Thold setting is shown on Setting panel. To do so, go to User Management, and select your username. On Realm permission, make sure Plugin Management is check. </p>
<p>Now Thold tab should be shown on Cacti&#8217;s Setting panel.</p>
]]></content:encoded>
			<wfw:commentRss>http://systems.takizo.com/2009/08/21/install-and-configure-thold-on-cacti/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Detect DDoS Source &amp; Destination IP Address with OURMON</title>
		<link>http://systems.takizo.com/2008/06/26/detect-ddos-source-destination-ip-address-with-ourmon/</link>
		<comments>http://systems.takizo.com/2008/06/26/detect-ddos-source-destination-ip-address-with-ourmon/#comments</comments>
		<pubDate>Thu, 26 Jun 2008 09:00:32 +0000</pubDate>
		<dc:creator>takizo</dc:creator>
				<category><![CDATA[Open Source]]></category>
		<category><![CDATA[Software tips/tricks]]></category>
		<category><![CDATA[Tip of the Day]]></category>
		<category><![CDATA[freebsd]]></category>
		<category><![CDATA[nms]]></category>
		<category><![CDATA[unix+freebsd]]></category>

		<guid isPermaLink="false">http://systems.takizo.com/?p=265</guid>
		<description><![CDATA[We have OURMON running on one of network segment for quite some time, it is very helpful and resourceful when DDoS attack happened, especially to help our customer to find out which destination is targeted on the attack and from which sources. Below is the graph that we previously captured while running OURMON version 2.70. [...]]]></description>
			<content:encoded><![CDATA[<p>We have OURMON running on one of network segment for quite some time, it is very helpful and resourceful when DDoS attack happened, especially to help our customer to find out which destination is targeted on the attack and from which sources. Below is the graph that we previously captured while running OURMON version 2.70. </p>
<p><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-ddos-01.jpg" width="520" height="226" alt="" title="" /></p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-ddos-03.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-ddos-03.jpg" width="520" height="225" alt="" title=""  /></a></p>
<p><strong>OURMON Version 2.81</strong></p>
<p>On the recent released of OURMON, the topn graphs didn&#8217;t show the traffic by Mbit/s instead of bit/s. The long no. is confusing when the NOC engineer is doing the monitoring(minimal 7 digits will show up). I have made some changes on omupdate.pl, one of OURMON script that generate html static page, to show extra value &#8211; Mbit/s. Our current OURMON graph looks something like below;</p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-281.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-281.jpg" width="520" height="220" alt="" title=""  /></a></p>
<p>Below will show you how to add extra Mbit/s value on your OURMON Topn section;</p>
<p>edit <em>omupdate.pl</em> file</p>
<p><em>vi /usr/local/mrourmon/bin/omupdate.pl</em></p>
<p>On line 3137, add the code looks like below;</p>
<pre>
<code>
my $uappf = $items[$i+2];       # old hw app flags
my $uappl = $items[$i+3];       # app lower case
my $uapph = $items[$i+4];       # app upper case
my $bps = int(($items[$i+1] * 8)/30);
my $mbps = sprintf("%.2f", ($bps/1024)/1024); # convert bits to mbits
my $uaf = get_appflag($uappf, $uappl, $uapph);
</code>
</pre>
<p>this line of code <em>my $mbps = sprintf(&#8220;%.2f&#8221;, ($bps/1024)/1024);</em> is to declare the new variable <em>$mbps</em> and convert the bit/s value to Mbit/s by dividing 1024*1024.</p>
<p>Next is to display the value on the page, do something on line of code 3146;</p>
<pre>
<code>
"<b>bits/sec:</b> $bps, <b>Mbits/sec:</b> $mbps, "
</code>
</pre>
<p>Done, wait for a few second for the web page to refresh with extra Mbit/s value. Btw, you can remove bit/s if you want to, to save some extra space <img src='http://systems.takizo.com/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://systems.takizo.com/2008/06/26/detect-ddos-source-destination-ip-address-with-ourmon/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OURMON Installation and Configuration on FreeBSD 7 with Multi-threading Support</title>
		<link>http://systems.takizo.com/2008/06/25/multi-thread-ourmon-in-freebsd/</link>
		<comments>http://systems.takizo.com/2008/06/25/multi-thread-ourmon-in-freebsd/#comments</comments>
		<pubDate>Wed, 25 Jun 2008 15:57:38 +0000</pubDate>
		<dc:creator>psyber.monkey</dc:creator>
				<category><![CDATA[nms]]></category>
		<category><![CDATA[ourmon network+analysis nms networking security]]></category>

		<guid isPermaLink="false">http://systems.takizo.com/?p=264</guid>
		<description><![CDATA[OURMON is popular known as open source Network Monitoring and Anomaly Detection System. It&#8217;s very useful for a web hosting provider or Internet Service Provider to study their network behavior and detection for any network attack such as DoS or DDoS. Beside study your network behavior, it also can analyze your network protocols activities, tcp [...]]]></description>
			<content:encoded><![CDATA[<p>OURMON is popular known as open source Network Monitoring and Anomaly Detection System. It&#8217;s very useful for a web hosting provider or Internet Service Provider to study their network behavior and detection for any network attack such as DoS or DDoS.</p>
<p>Beside study your network behavior, it also can analyze your network protocols activities, tcp w0rm activity, p2p activity and etc.</p>
<p>Here is the step by step OURMON installation and configuration on FreeBSD with multi-threading support.</p>
<p>OUR source package can be downloaded on official <a target="_blank" href="http://sourceforge.net/projects/ourmon" target="_blank">sourceforget download page</a>. I strongly suggest that do not install OURMON from port (due to the update on the package is quite slow), but before proceed on OURMON source install, there are several dependencies need to be installed;</p>
<p><strong>PCRE</strong></p>
<p><em>cd /usr/ports/devel/pcre &amp;&amp; make install clean distclean</em></p>
<p><strong>libpcap</strong></p>
<p><em>cd /usr/ports/net/libpcap &amp;&amp; make install clean distclean</em></p>
<p><strong>RRDTool</strong></p>
<p><em>cd /usr/ports/databases/rrdtool &amp;&amp; make install clean distclean</em></p>
<p><strong>Apache Web Server </strong></p>
<p><em>cd /usr/ports/www/apache20 &amp;&amp; make install clean distclean</em></p>
<p><strong>OURMON Installation and Configuration</strong></p>
<p>After above dependencies has been installed, now we proceed with OURMON installation and configuration;</p>
<p>untar yor ourmon package and your will see a folder name <em>mrourmon</em>. Copy the folder to /usr/local;</p>
<p><em>cp -rf mrourmon /usr/local/</em></p>
<p>In order to enable multi-threading support, there are some changes need to be made on your OURMON&#8217;s Makefile.</p>
<p><em>cd /usr/local/mrourmon/src/ourmon<br />
vi Makefile.bsd</em></p>
<p>On line 27 and 30, uncomment the line which look like below;</p>
<p><em>CFLAGS=-O4 -DBSD -DTHREAD<br />
LFLAGS=-O4 -static -DTHREAD</em></p>
<p>Also on line 18, change the BINDDIR to the directory that we are going to install ourmon;</p>
<p><em>BINDIR=/usr/local/mrourmon/bin</em></p>
<p>After that, save the file and we are ready to roll, go to OURMON root directory and run configure.pl for installation;</p>
<p><em>cd /usr/local/mrourmon</em><br />
<em>./configure</em></p>
<p>Follow the on screen guide to go through the installation, after ourmon is install, we are ready to fire it up&#8230; But there are minor changes need to be made in order to support multi-threading. Open up ourmon start up file and make the below changes;</p>
<p><em>vi /usr/local/etc/rc.d/ourmon.sh</em></p>
<p>On line 11, add extra argument (-T 2 ) into OURMON launch command and it will look like this;</p>
<p><em>/usr/local/mrourmon/bin/ourmon -T 2 -a 30 -s 256 -f /usr/local/mrourmon/etc/ourmon.conf -i bce1 -D /usr/local/mrourmon/tmp &amp;</em></p>
<p>the argument -T 2 is to spawn 2 ourmon processes, if you have more processor on your server, you might want to add more; after that monitor on your server load, see whether it will crash your server or not <img src='http://systems.takizo.com/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p>
<p>Run top command and monitor on your server load.</p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-load.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-load.jpg" alt="" width="520" height="228" /></a>.</p>
<p><strong>Apache Configuration</strong></p>
<p>By default, OURMON web html files are located at <em>/usr/local/www/data/ourmon</em>, we suggest that you setup virtualhost to access to OURMON from your web browser;</p>
<p><em>NameVirtualHost *:80</p>
<p>ServerAdmin sysadm@systems.takizo.com<br />
ServerName ourmon.systems.takizo.com</em></p>
<p><em> DocumentRoot /usr/local/mrourmon/web.pages</em></p>
<p><em><br />
AllowOverride All<br />
Order Deny,Allow<br />
Deny from all<br />
Allow from 202.188.1.5 # only allow authorized IP Address to access your OURMON.<br />
</em></p>
<p><em> ErrorLog /var/log/ourmon-error_log<br />
CustomLog /var/log/ourmon-access_log common<br />
</em></p>
<p>You might also interest to change the viewing of OURMON site at your own convenience at <em>/usr/local/www/data/ourmon/index.html</em>, remember to make a copy before you make any changes.</p>
<p>Below are some graph that shown on our OURMON page;</p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-01.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-01.jpg" alt="" width="520" height="183" /></a></p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-02.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-02.jpg" alt="" width="520" height="185" /></a></p>
<p><a href="http://systems.takizo.com/wp-content/photos/08/june/ourmon-03.jpg"><img src="http://systems.takizo.com/wp-content/photos/08/june/_ourmon-03.jpg" alt="" width="520" height="230" /></a></p>
<p>updated : 19/10/2008</p>
<p>1. when start ourmon with &#8220;/usr/local/etc/rc.d/ourmon.sh start&#8221; return error :</p>
<p>sysctl: unknown oid &#8216;debug.bpf_bufsize&#8217;<br />
sysctl: unknown oid &#8216;debug.bpf_maxbufsize&#8217;</p>
<p>change &#8220;sysctl -w debug.bpf_bufsize=8388608&#8243; &amp; &#8220;sysctl -w debug.bpf_maxbufsize=8388608&#8243; in /usr/local/etc/rc.d/ourmon.sh to &#8220;sysctl -w net.bpf.bufsize=8388608&#8243; &amp; &#8220;sysctl -w net.bpf.maxbufsize=8388608&#8243; to solve the error.</p>
<p>2. should the promicuous interface not picking up any traffic, bring it down (e.g. ifconfig rl0 down) and bring it up (ifconfig rl0 up) again should do the trick. Use tcpdump -i rl0 to see if it see any traffice.</p>
]]></content:encoded>
			<wfw:commentRss>http://systems.takizo.com/2008/06/25/multi-thread-ourmon-in-freebsd/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
