OSS network monitoring

Since we don't have our new networking forum yet, I'll post this here. (well, I didn't see it yet anyway)

Ok, I've just brought up a new network and now I'm thinking bout a solution to monitor all of the sites and services. In the past, I have used numera's network monitor... but I don't really like it and it doesn't do everything that I'd want.

I want to build my own solution and be able to build on it as I need.

I'm thinking Nagios for the network link status and alerting. I will expand this later to include various servers and their services.

Then I'm going between MRTG and Cacti for the bandwith monitoring (netflow). I may setup both to see how I like it.

We're talking ~15 sites linked via partial star/partial mesh topology, mostly checkpoint and cisco gear (firewalls, routers, switches, callmanager+unity). The primary WAN links range from 10Mb to 100Mb. The LAN links range from 100Mb to 1000Mb. I will be monitoring both Windows and Linux servers. Services may include things such as vpn, ssh, active directory, dns, dhcp, http(s), smtp, file/print, and even specialized services that may just listen on a nonstandard ports that common only to my environment.

Right now, I've allocated a server with dual 3.2ghz processors, 2gb ram and 2 80Gig SATA drives setup in a RAID1 array. I can increase memory if needed, and I have access to more network storage if needed.

I think I'm going to go with OpenSuSE as the OS. I was initally going to use Fedora7, but their latest release is only on DVD and unfortunately, my server has no DVD drive and I don't feel like messing with it in a rackmount.

Can anyone recommend any other *nix/open source solution that may be of interest to me? Or, toss out some ideas that you'd like to see in your network monitoring solution or features that I may not have thought about?
I've been browsing around wiki and I've found some REALLY cool projects.

My initial goal is to just get the network monitoring/alerting up and running as well as traffic stats/graphing. Then I'll slowly add on the other services.

Sounds like your on the right track so far..

At the ISP I worked at, we used Solarwinds and Whats Up Gold to monitor our servers/services links etc...but thats definitely not open sournce, and pretty expensive software.

I think you have all the basics covered as far as monitoring a network and server environment goes.

Health of servers(HD Space, Memory, LAN Link Utilization, services status, host name etc)
Network informatoin(Max throughput capacity, current throughput, highest throughput, packet loss, response time, etc etc).

I've evaluated Solarwinds and I really liked it. I just had Whats Up Gold recommeneded to me the other day too. Thanks for your input.

I can get authorization to get one or both of those services. It doesn't have to be OSS... I just want it to be.

http://www.jffnms.org

I tried it a while back (2 years), can't remember while I never started using it.

Why didn't you like it?

I've had many of projects that I've started but never finished due to lack of time. But, is it ever worth looking at?

Not sure if this project would interest you or not. Its a type of monitoring and really helped recently when i went and updated all the switches in my facility for documentation purposes.

http://sourceforge.net/projects/switchmap/

Quote:

---

Originally Posted by phishphreek

Why didn't you like it?

I've had many of projects that I've started but never finished due to lack of time. But, is it ever worth looking at?

---

Actually I've never worried about bandwidth and performance, because then you have to look at it. I like my tools simple like legos for toddlers, so I use Argus which is a simple up or down tool.

http://argus.tcp4me.com/

I like Nagios too, but I've been using Argus much longer.

It is not open source
but we use from paessler.com prtg and ipcheck
just click and play and the money is peanuts
it took 20 minutes to set up each, OSS can't beat that

you can also use ntop on a mirror of your switch
just be sure that your switch can hold on
keep a watch on the CPU of your switch when you put it on
if you hear that everything is going slower than it can't
and you will have to choose some ports of your switch
that are most important

http://ekz.skynetblogs.be

ekz: Thanks for the tip. Wow... 20 minutes? I'll have to take a look at it.

I spent ALL of Friday, Saturay and Sunday getting Nagios and Cacti up and running. Mind you, I've never really used either of these products and I had a lot of planning/learning to do. I think that 3 days work isn't too bad to get something like this up and running. I've had people tell me that it was going to take me at least a month to get it all up and going. Now I'm going back and setting up all the actual service checks... which I expect to take another week or so doing a little here and there on important services... I don't care much about dumb devices like printers at this time.

Intially, I just wanted to get an up/down of all the hosts and monitor a few services. Now I want to monitor much more. One thing that I DON'T like is that the host names are case sensitive in Nagios... so I'm constantly getting config errors. But, I'm getting much better. I have 125 devices being monitored right now... from routers, switches, servers, printers, etc. I think there is only 300 or so services being monitored at this time... I have a lot of work to do. haha I've actually found a couple of problems that I didn't know about while setting this up. I thought that was kinda cool even though it creates more work.

However, my network is rather complicated and I'm going to have to setup a distributed monitor. (Thanks for vmware!) Overall though, it is going pretty smoothely. I like how it's working even if it is a bit complicated. The documentation is pretty decent and I don't mind reading.

Now I might be able to finally setup a printer accounting application too. I've been wanting to do that for a while too. Might as well do it now.

I doing all of this in my "free" or personal time to make my life easier. I've never had this capability before... so it's going to be VERY nice to KNOW what my status is when I walk in the door in the morning and not just *hope* that everything is fine.

the centreon(formerly oreon) is a good front end for nagios written in php.

lordwud: Thanks! looks like that would help out a lot.

Ok Lordwud, the initial "look" was deceiving.

What is so special about this software? Except that it took 2 hours to locate and install every stinking dependancy for it? It needs a dozen perl addons and about 2 dozen PEAR modules. Not only that, but their stupid "functions" file has a bug in it when checking the users/groups and I had to edit out the check just to get it to install.

I had it read in my existing config and I was able to find no benefit of using this interface over the original Nagios interface... except that this one is more clean and not as clunky. I don't really care how "nice" my interface looks for something like this. I just want it to work and work well.

I saw the ability to add/edit hosts directly from the web UI, but is that really a benefit? It really isn't that difficult to do it from the flat files that Nagios uses. The hard part about setting up Nagios was planning, defining what hosts/services to monitor and creating templates for that. Once that was done, it was a simple copy/paste of the templates a couple hundred times.

Granted... it was very late last night when I finally did install it and my eyes were very droopy by the time I finished the install/initial config. I'll look it over more in detail this morning.

What I find very disturbing is that there are no docs in english. The english install manual is a freaking flash video.

Quote:

---

Originally Posted by caveman8fb

Actually I've never worried about bandwidth and performance, because then you have to look at it. I like my tools simple like legos for toddlers, so I use Argus which is a simple up or down tool.

http://argus.tcp4me.com/

I like Nagios too, but I've been using Argus much longer.

---

Haha! I felt like you did for a while too. It wasn't my responsiblity at the time to care about it. I had too much other stuff to take care of and I'd just pass it onto my superior.

What do you tell your bosses when they ask about LAN/WAN utilization or if it was possible to add X service and Y service? "I don't know?" Thats what we had to keep doing... and it was getting VERY old. We knew that our WAN was maxed out, but we knew only after everyone started complaining about performance.

We had some tools (numera network monitor), but it was never setup properly to begin with, and their licensing scheme sucks. It could only be installed in one place, there was no web UI and only one user could be viewing it at a time. So, you either had to physically go to the console or terminal services into it.

Quote:

---

Originally Posted by Spyrus

Not sure if this project would interest you or not. Its a type of monitoring and really helped recently when i went and updated all the switches in my facility for documentation purposes.

http://sourceforge.net/projects/switchmap/

---

I quickly looked at this the other day. I plan on playing with it more today. It looks promising. Simple tool and invaluable info. When we installed the new network, we kept tabs on every device on every port and etc... but that will become a pain to manage as we go forward.

I know this has been covered in the past, and I was looking at the original thread last night... but what do people use for printer monitoring? Right now, I'm just looking at up/down status, and checking things like pagecount and consumables.

Does anyone log it to a syslog server and have some script to analyze that data? I'm just looking for simple stats. How much printing, which times of days/which days of week, months of year, etc. Which departments print the most, etc. If I knew that type of info, I could get nicer printers for the onces who need it and cut back on the users who won't.

Right now, most of my network printers are HP2000 and HP4200 series with some 8000 series thrown in here and there. I think the color lasers are 3600 series. I may have the odd Lexmark OptraS 2450 laying around... but most of them were replaced with the 4200 series.

Quote:

---

Originally Posted by phishphreek

I know this has been covered in the past, and I was looking at the original thread last night... but what do people use for printer monitoring? Right now, I'm just looking at up/down status, and checking things like pagecount and consumables.

Does anyone log it to a syslog server and have some script to analyze that data? I'm just looking for simple stats. How much printing, which times of days/which days of week, months of year, etc. Which departments print the most, etc. If I knew that type of info, I could get nicer printers for the onces who need it and cut back on the users who won't.

Right now, most of my network printers are HP2000 and HP4200 series with some 8000 series thrown in here and there. I think the color lasers are 3600 series. I may have the odd Lexmark OptraS 2450 laying around... but most of them were replaced with the 4200 series.

---

I just started using: Print Inspector

It was recommended in this thread: http://antionline.com/showthread.php?t=275691

After using it for a couple weeks it works pretty well. It gives you page count, which user used it, it does NOT have to sit on the print server and puts together decent reports. The application is a mere 100 dollars too for unlimited printers as best as I could tell.

*Also for monitoring LAN/WAN traffice our enterprise uses NetQoS (http://www.netqos.com/), its a pretty good application, I am not sure of the cost behind it though