Netflow

NetFlow is a network protocol developed by Cisco Systems to run on Cisco IOS-enabled equipment for collecting IP traffic information. It is proprietary and supported by platforms other than IOS, such as Juniper routers, Linux or FreeBSD and OpenBSD.

Cisco routers that have the Netflow feature enabled generate netflow records; these are exported from the router in User Datagram Protocol (UDP) or Stream Control Transmission Protocol (SCTP) packets and collected using a netflow collector. Other vendors provide similar features for their routers but with different names:

Jflow or cflowd for Juniper Networks
NetStream for 3Com/H3C
NetStream for Huawei Technology
Cflowd for Alcatel-Lucent

network flow has been defined in many ways. The traditional Cisco definition is to use a 7-tuple key, where a flow is defined as a unidirectional sequence of packets all sharing all of the following 7 values:

1. Source IP address
2. Destination IP address
3. Source port for UDP or TCP, 0 for other protocols
4. Destination port for UDP or TCP, type and code for ICMP, or 0 for other protocols
5. IP protocol
6. Ingress interface (SNMP ifIndex)
7. IP Type of Service

Flexible Netflow and IPFIX support user-defined flow keys. The router will output a flow record when it determines that the flow is finished. It does this by flow aging: when the router sees new traffic for an existing flow it resets the aging counter. Also, TCP session termination in a TCP flow causes the router to expire the flow. Routers can also be configured to output a flow record at a fixed interval even if the flow is still ongoing. In Flexible NetFlow (FNF) an administrator could actually define flow properties on the router.

Install Nagios with Centreon on Debian

Introduction

About Nagios (http://www.nagios.org)

Nagios is a host and service monitor designed to inform you of network problems before your clients, end-users or managers do. It has been designed to run under the Linux operating system, but works fine under most *NIX variants as well. The monitoring daemon runs intermittent checks on hosts and services you specify using external "plugins" which return status information to Nagios. When problems are encountered, the daemon can send notifications out to administrative contacts in a variety of different ways (email, instant message, SMS, etc.). Current status information, historical logs, and reports can all be accessed via a web browser.

About Centreon (http://www.centreon.com)

Centreon is a network, system, applicative supervision and monitoring tool, it is based upon the most effective Open Source monitoring engine: Nagios. Centreon provides a new frontend and new functionalities to Nagios.

Prerequisites that not covered in this guide:

You will need some knowledge of basic Linux administration, in case you will need to do troubleshooting

You will need to be familiar with Nagios architecture, and know how to solve errors that come from nagios config validation

You will need an MTA daemon installed & configured, so nagios will able to send notifications, good examples are sendmail, postfix, exim.

Before we begin

All commands in this guide must be run as root user, in Ubuntu you can become a root user by using command "sudo -s".

This guide is indented for Debian/Ubuntu based distributions. It was tested on Debian 4.0r2, and Ubuntu 7.10 Server/Desktop.

Warning: Centreon installer will not work on Ubuntu 8.04 LTS, the installer failing to detect Apache User/Group names. It is because those settings are defined via environment variables in apache2.conf, those variables are located in /etc/apache2/envvars.

Still, you can use the installer after replacing 2 configuration options in apache2.conf

To do it, follow those commands:

# cp /etc/apache2/apache2.conf /etc/apache2/apache2.conf.default

# sed "s/\${APACHE_RUN_USER}/www-data/g" /etc/apache2/apache2.conf.default > /etc/apache2/apache2.tmp

# sed "s/\${APACHE_RUN_GROUP}/www-data/g" /etc/apache2/apache2.tmp > /etc/apache2/apache2.conf

# rm /etc/apache2/apache2.tmp

I recommend, to restore default apache configuration after Centreon Installation is finished:

# mv /etc/apache2/apache2.conf.default /etc/apache2/apache2.conf

Install required Ubuntu/Debian packages:

Sudo for Debian

# apt-get install sudo

dos2unix, Converts DOS <-> Unix text files, alias tofromdos

# apt-get install tofrodos

Apache 2 web server

# apt-get install apache2

Nagios 2

# apt-get install nagios2 nagios-plugins nagios-images nagios-nrpe-plugin

MySQL 5 database server

# apt-get install mysql-server-5.0

PHP5 + required modules

# apt-get install php5 php5-cli php-db php-date php5-gd php5-mysql php5-snmp \

php5-ldap php-mail php-mail-mime php-net-smtp php-net-socket php5-xmlrpc

RRDTool

# apt-get install rrdtool librrds-perl

Perl "ini" files support

# apt-get install libconfig-inifiles-perl

SNMP

# apt-get install snmp snmpd libnet-snmp-perl

Open file /etc/snmp/snmpd.conf for editing.

Find:

#com2sec readonly default public

Remove "#" sign

Save & restart SNMP deamon:

# invoke-rc.d snmpd restart

Test it:

# snmpget -v1 -c public localhost sysDescr.0

Successful output will be something like:

SNMPv2-MIB::sysDescr.0 = STRING: Linux monitor01 2.6.22-14-server #1 SMP Tue Feb 12 08:27:05 UTC 2008 i686

Additional pear modules

# pear channel-update pear.php.net

# pear upgrade pear

# pear install -f -a DB_DataObject DB_DataObject_FormBuilder MDB2 Numbers_Roman \

Numbers_Words HTML_Common HTML_QuickForm HTML_QuickForm_advmultiselect \

HTML_Table Auth_SASL HTTP Image_Canvas Image_Color Image_Graph \

Image_GraphViz Net_Traceroute Net_Ping Validate XML_RPC SOAP

Install optional packages, not required

PHPMyAdmin - web based Mysql console

# apt-get install phpmyadmin

JOE - Text editor

# apt-get install joe

Install Centreon

Download latest version of Centreon, http://www.centreon.com/Download/Download.html

By the time of writing the latest version is 1.4.2.6:

# wget http://download.centreon.com/centreon/centreon-1.4.2.6.tar.gz

Uncompress the archive

# tar xzvf centreon-1.4.2.6.tar.gz

Create symbolic link for nagios2, Centreon installation requires it

# ln -s /usr/sbin/nagios2 /usr/sbin/nagios

Run installation script

# cd centreon-1.4.2.6

# bash ./install.sh

Answer questions during install script

Are you sure to continue ?

[y/n], default to [n]: y

Were is installed Nagios ?

default to [/usr/local/nagios]: /usr/lib/cgi-bin/nagios2

Were is your nagios etc directory ?

default to [/usr/lib/cgi-bin/nagios2/etc]: /etc/nagios2

Were is your nagios var directory ?

default to [/usr/lib/cgi-bin/nagios2/var]: /var/lib/nagios2

Were is your nagios plugins (libexec) directory ?

default to [/usr/lib/cgi-bin/nagios2/libexec]: /usr/lib/nagios/plugins

Were is your nagios bin directory ?

default to [/usr/lib/cgi-bin/nagios2/bin]: /usr/sbin

Were is your nagios image directory ?

default to [/usr/lib/cgi-bin/nagios2/share/images]: /usr/share/nagios/htdocs/images/logos

Where do I install centreon ?

default to [/usr/local/centreon]: /usr/local/centreon

Do you want me to create this directory [/usr/local/centreon]?[Y/n] y

Where is sudo configuration file?

default to [/etc/sudoers]: /etc/sudoers

Where is installed RRD perl modules [RRDs.pm] ?

Just put directory, not full path.

default to [/usr/local/rrdtool/lib/perl]: /usr/lib/perl5

Where is rrdtool binary ?

default to [/usr/bin/rrdtool]: /usr/bin/rrdtool

Where is mail binary ?

default to [/usr/bin/mail]: /usr/bin/mail

Where is PEAR Path ?

default to [/usr/share/pear]: /usr/share/php

Do you want to install Centreon Plugins ?

[y/n], default to [y]: y

Do you want to install Centreon Traps Plugins ?

[y/n], default to [y]: y

Where is your SNMP configuration file?

default to [/etc/snmp/]: /etc/snmp

You already seem to have installed the plugins Centreon.

Do you want overwrite this file ? You must regenerate this one from Centreon interface.

[y/n], default to [n]: y

Specify user do you use for Centreon cron

Default to [nagios]

Apply writing permissions for plugins directory:

# chmod 775 /usr/lib/nagios/plugins

Restart Mysql server

# invoke-rc.d mysql restart

Restart Apache web server

# invoke-rc.d apache2 restart

Finalize the installation with the Centreon Web interface:

open in webrowser: http:///centreon/

replace with your server ip address or hostname.

Follow Centreon Setup instructions:

- Press Start

- Check "I Accept" and press Next

- Make sure that selected "Nagios Version" is "2.x", then press Next

- On next 2 screens, make sure that all components status is "OK", then press Next

- If everything is ok, then press Next again

- Fill required DB info, then press Next

· Root Password for MySQL: [Enter your DB root password]

· Centreon Database Name: centreon

· Centreon Data Storage Database Name: centreon_ods

· Database Password: centreon

· Confirm it: centreon

· MySQL Client version (Password Haching Changes): >=4.1 - PASSWORD()

- Press Next in the screen of DataBase Verification

- Fill required Admin user info, then press next.

- Check "No" in "LDAP Authentication" screen, then press Next

- Press Next again

- Press Next in "Creating Database" screen

- Press on "Click here to complete your install"

Fix paths to meet Nagios installation on Debian based distributions:

Login to Centreon Interface

Go to: Options -> Centreon -> General Options -> Nagios

Change settings to some options, as writed below:

Init Script: /etc/init.d/nagios2

Directory + Binary: /usr/sbin/nagios2

Press Save

Go to: Configuration -> Nagios -> CGI CFG, Press on Edit Icon

Change settings to some options, as writed below:

Physical HTML Path: /usr/share/nagios2/htdocs

URL HTML Path: /nagios2

Nagios Process Check Command: /usr/lib/nagios/plugins/check_nagios /var/cache/nagios2/status.dat 5 '/usr/sbin/nagios2'

Press Save

Go to: Configuration -> Nagios -> Nagios CFG, Press on Edit Icon

Change settings to some options, as writed below:

Log File: /var/log/nagios2/nagios.log

Temp File: /var/cache/nagios2/nagios.tmp

P1 File: /usr/lib/nagios2/p1.pl

Object Cache File: /var/cache/nagios2/objects.cache

Status File: /var/cache/nagios2/status.dat

Log Archive Path: /var/log/nagios2/archives/

Downtime File: /var/lib/nagios2/downtime.dat

Comment File: /var/lib/nagios2/comment.dat

Lock File: /var/run/nagios2/nagios2.pid

State Retention File: /var/lib/nagios2/retention.dat

Performance Data Processing Option: Yes

Service Performance Data Processing Command: process-service-perfdata

Press Save

Go back to terminal console, then...

Apply permissions, so Web interface can also send External Commands

# chmod g+rx /var/lib/nagios2/rw/

Also change ownership of nagios archive logs directory

# chown nagios:adm /var/log/nagios2/archives

Enable Centreon Data Storage (ods) deamon:

# update-rc.d ods defaults

Add htaccess user for nagios CGI:

# htpasswd -bc /etc/nagios2/htpasswd.users nagiosadmin P@ssw0rd

Reboot Server

# sync;sync;init 6

Start adding Hosts, Services, Contacts, Commands, Escalations...

Open Centreon web interface and Login

Start adding hosts, services, users

Restart Nagios to apply the changes, go to: Configuration -> Nagios

Select as writed below:

- Include Comments: Yes

- Run Nagios debug (-v): Yes

- Run Optimisation test (-s): Yes

- Move Export Files: Yes

- Restart Nagios: Yes, Restart

Press Export

This will restart Nagios & apply all changes you made in Web Interface.

You will do it every time you make changes like adding/modifying: hosts, commands, contacts, services...etc...etc...

Monitoring Servers,Network Devices with Opmanager in Debian

OpManager is a network monitoring software that can automatically discover your network; group your devices into intuitive maps, monitor devices in real-time and alert instantaneously on failure. It serves as a complete network monitoring solution by providing complete fault and performance functionality across your WAN and LAN infrastructure.

System Requirements

Processor: 32-Bit x86 Compatible
998 MHz and above
Memory: 999 MB
Disk space: 200MB
Operating System: RedHat 7.x and above, Debian 3.0 and above

Preparing Your System

You need to install the following packages as root

# apt-get install libgdbmg1 libexpat1

Create the following user and group

# adduser nobody
# groupadd nobody

Install Opmanager in Debian Etch

First you need to download the trail version of opmanager for Linux from here . Now you should have ManageEngine_OpManager_7_linux.bin file. You need to run this file using the following command as root

# ./ ManageEngine_OpManager_7_linux.bin

This will start the installation and you should see the following welcome installation shield you need to click next here

Now you should see the following License Screen select” I accept the …..” option and click Next

Next one is you should choose between trail version and Free edition. Here you need to choose trail version and click next

Select you Language and click next

If you want to change the installation directory you can do so otherwise click next

Enter the web server port as 4430 because 443(https) might be using another application so I would suggest 4430 click next

Installation details screen click next

Opmanager Installation is in progress

Extracting Files are in progress

Installation Completed Screen click finish

The file libdb-3.2.so may not exist in your system. OpManager bundles this file under lib/backup under OpManager Installation directory. Copy this file to lib directory ie.(Execute this command under /opt/AdventNet/ME/OpManager – this is the default location where OpManager is installed under Linux distribution)

# cd /opt/AdventNet/ME/OpManager/

# cp lib/backup/libdb-3.2.so lib/

Now you need to start the opmanager using the follow command

# /opt/AdventNet/ME/OpManager/bin/StartOpmanagerServer.sh

Once it started you should see the following screen

Now you need to go to open https://serverip:4430 in your web browser you should see the following screen here you need to login using the following details

Username: – admin

Password: – admin

Opmanager Startup Script

If you want to start your opmanager automatically when you reboot your server you need to download this script

Download opmanager file into /etc/init.d directory and run the following command

#chmod 755 opmanager

Now you need to update the startup script link using the following command

#update-rc.d opmanager defaults 50

Thats it your opmanager is ready to use

Now you need to check this manual for how add devices and services.

Linux MRTG Configuration with SNMP

Step:1 To check snmp rpm package is installed or not which is required to MRTG.

# rpm –qa | grep snmp

Step:2 If not installed please install it by using rpm package or by yum

# yum install net-snmp-utils net-snmp

Step:3 Run snmpwalk utility to request for tree of information about network entity. In simple words query snmp server for your IP address

# snmpwalk -v 1 -c public localhost

or

# snmpwalk -v 1 -c public 192.168.10.95

If not installed please configure the following step

Step:A Rename the existing file snmpd.conf with snmpd.conf.old

# mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.old

Step:B Create new snmpd.conf file & Enter the following line in the new configuration file to set the Read Only community string to craz33guy.

# vi /etc/snmp/snmpd.conf

Add the Line in the snmpd.conf file: rocommunity craz33guy

Step:C Restart the snmp service and check the snmp configuration of the snmp service

# service snmpd restart

# snmpwalk -v 1 -c public 192.168.8.5

Step: 4 Mrtg software may install during initial installation; you can verify if MRTG installed or not with following RPM command:

# rpm -qa | grep mrtg

If not installed please install it by using rpm package or by yum

#yum install mrtg

Step: 5 Create document root to store mrtg graphs/html pages:

# mkdir -p /var/www/html/mymrtg/

Step: 6 Run the following cfgmaker command to create mrtg configuration file:

# cfgmaker --global 'WorkDir: /var/www/html/mymrtg' --output /etc/mrtg/8.5.cfg craz33guy@192.168.8.5

Step: 7 Create default index page for your MRTG configuration:

# indexmaker --output=/var/www/html/mymrtg/index.html /etc/mrtg/8.5.cfg

Step: 8 Copy all tiny png files to your mrtg path:

        # cp -av /var/www/html/mrtg/*.png /var/www/html/mymrtg/

Step: 9 Run mrtg command from command line with your configuration file:

               #  env LANG=C /usr/bin/mrtg /etc/mrtg/8.5.cfg

Step: 10 Add a new MRTG line in /etc/cron.d/mrtg for each new configuration file you create and restart the crond service.

0-59/5 * * * * root env LANG=C /usr/bin/mrtg /etc/mrtg/8.5.cfg

        # service crond restart 

Installing and Configuring Nagios

1) Getting Nagios

You need root access on the server, where you would like to install Nagios. Login as root.

Create a directory for downloads.

#mkdir -p /usr/src/backs/nagios
#cd /usr/src/backs/nagios

Download source of nagios and nagios-plugins at http://www.nagios.org/download/.

#wget http://keihanna।dl।sourceforge.net/sourceforge/naagios
/nagios-1.2.tar.gz
#wget http://easynews.dl.sourceforge.net/sourceforge/nagiosplug
/nagios-plugins-1.3.1.tar.gz

2) Compilation and installation of Nagios

Login as root and create a user, say "nagios"

#su
#adduser nagios
#passwd nagios
Changing password for user nagios.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

In some servers normal users may not have permission to use 'mail' inorder to send alerts.

usermod -G mail nagios

Make a directory for working with the source code.

mkdir -p /usr/src/works/nagios
cd /usr/src/works/nagios/
tar -zxvf /usr/src/backs/nagios/nagios-1.2.tar.gz
cd nagios-1.2/
./configure
The default is fine for normal operation. for details see the file 'INSALL'.
./configure --prefix=prefix --with-cgiurl=cgiurl --with-htmurl=htmurl
--with-nagios-user=someuser --with-nagios-grp=somegroup
./configure
make all
make install
make install-init # Needed to add the service 'nagios'.
make install-commandmode
make install-config

Install the plugins

cd ../
tar -zxvf /usr/src/backs/nagios/nagios-plugins-1.3.1.tar.gz
cd nagios-plugins-1.3.1/
./configure
NOTE:- For mysql and postgresql plugins to work, their  libraries have
to be installed. so to avoid installing those we will use 'check_tcp'
Instead later with seperate port for mysql and postgresql.
make
make check
make install

Libraries will be installed in '/usr/local/nagios/libexec' position by the default installation. If there is no contents do the following.

 mkdir /usr/local/nagios/libexec
mv /usr/lib/nagios/plugins/* /usr/local/nagios/libexec/
ln -s /lib/libcrypto.so.0.9.7a /lib/libcrypto.so.4

3) Post install Configuration of Nagios

Edit apache's httpd.conf file. (the location of the httpd.conf file may differ)

vim /etc/httpd/conf/httpd.conf

Add the following line at the end of the file.

Include /etc/httpd/conf/nagios.conf

Create the file '/etc/httpd/conf/nagios.conf'.

vi /etc/httpd/conf/nagios.conf

Add the following contents to this file.

-------------------------------------------------
ScriptAlias /nagios/cgi-bin/ /usr/local/nagios/sbin/

AllowOverride AuthConfig
Options ExecCGI
Allow from all
Order allow,deny


Alias /nagios/ /usr/local/nagios/share/

Options None
AllowOverride AuthConfig
Order allow,deny
Allow from all

--------------------------------------------------

Make sure the updations done with http is fine and restart apache.

#service httpd restart

Create '.htaccess' file in '/usr/local/nagios/share/' and '/usr/local/nagios/sbin/'.

#touch /usr/local/nagios/share/.htaccess
#touch /usr/local/nagios/sbin/.htaccess

Add the following contents to both these files.

AuthName "Nagios Access"
AuthType Basic
AuthUserFile /usr/local/nagios/etc/htpasswd.users
require valid-user

Create the username, password for logging into the Nagios interface.

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin
ls -l /usr/local/nagios/etc/htpasswd.users

Make it available for the user who runs httpd.

chmod o+r /usr/local/nagios/etc/htpasswd.users

Restart the httpd service.

service httpd restart

4)Advanced Nagios Configurations.

Rename the sample files to the real names.

cd /usr/local/nagios/etc/
for i in *sample ; do mv $i `echo "$i" |sed s/-sample//` ; done

Edit the main conf file, nagios.cfg. and change only these lines.

check_external_commands=1

Make these Cgi specific changes in cgi.cfg.

use_authentication=1
authorized_for_system_information=nagiosadmin
authorized_for_configuration_information=nagiosadmin
authorized_for_system_commands=nagiosadmin
authorized_for_all_services=nagiosadmin
authorized_for_all_hosts=nagiosadmin
authorized_for_all_service_commands=nagiosadmin
authorized_for_all_host_commands=nagiosadmin

Add servers that need to be monitored

Make the Host specific changes to the hosts.cfg.

 Generic host definition template
define host{
name                            generic-host
notifications_enabled            1
event_handler_enabled            1
flap_detection_enabled           1
process_perf_data                1
retain_status_information        1
retain_nonstatus_information     1

register                         0
}


define host{
use                    generic-host            ; Name of host
template to use

host_name              
alias                  
address                
check_command          check-host-alive
max_check_attempts      10
notification_interval  120
notification_period    24x7
notification_options    d,u,r
}

Repeat for all the hosts we want to check.

Group them in hostgroups.cfg

define hostgroup{
hostgroup_name  
alias          
contact_groups  
members        <,,..>
}

Repeat for all the hosts groups.

Specify the services that need to be checked

Edit the details of all the services, we want checked by Nagios in services.cfg.

 Generic service definition template
define service{
name                            generic-service
active_checks_enabled            1
passive_checks_enabled           1
parallelize_check                1
obsess_over_service              1
check_freshness                  0
notifications_enabled            1
event_handler_enabled            1
flap_detection_enabled           1
process_perf_data                1
retain_status_information        1
retain_nonstatus_information     1
register                         0
}


define service{
use                            generic-service
host_name                      
service_description            
is_volatile                     0
check_period                    24x7
max_check_attempts              3
normal_check_interval           3
retry_check_interval            1
contact_groups                  
notification_interval           120
notification_period             24x7
notification_options            w,u,c,r
check_command                  
}

Repeat for each service on each host.

Specify Alert Contacts

In order to specify details of the contacts for alerts, we need to edit contacts.cfg.

 'nagios' contact definition
define contact{
contact_name                    
alias                          
service_notification_period    24x7
host_notification_period        24x7
service_notification_options    w,u,c,r
host_notification_options      d,u,r
service_notification_commands  notify-by-email,notify-by-epager
host_notification_commands
host-notify-by-email,host-notify-by-epager
email                          
pager                          
}

Repeat for all contacts.

Group the contacts

Edit contactgroups.cfg, in order to specify groups of contacts.

define contactgroup{
contactgroup_name      
alias                  
members                
}

Repeat for all groups to include all contacts

Escelating with nagios

If you need to send selective alerts, for example when critical issues occur, simply configure the escalations.cfg file.

define serviceescalation{
host_name                      
service_description             <>
first_notification              2
last_notification               6
contact_groups                  <>
notification_interval           0
}

Repeat for all escalations Once again, check all the files, nagios.cfg cgi.cfg hosts.cfg hostgroups.cfg, services.cfg, contacts.cfg, contactgroups.cfg, escalations.cfg and checkcommands.cfg Restart httpd and then Nagios.

service httpd restart

Add Nagios to system services.

chkconfig --add nagios
service nagios restart

Check for any errors reported, and solve them one by one if any.
Enable nagios in runlevels, so that it starts on boot.

chkconfig nagios on

Create cron.daily entry if we want to restart the service daily. Here is the script.

vi etc/cron.daily/nagios-restart.cron
#!/bin/sh
/sbin/service nagios restart >/dev/null 2>&1

Make it executable

chmod +x etc/cron.daily/nagios-restart.cron

And finally, Check if nagios is working fine.!!! ;-)

http://NAGIOS-SERVER-NAME/nagios/index.html