Network Management and
Monitoring with Linux: Some handy tools for managing today's ubiquitous networks

dragon:~$ /usr/bin/snmpwalk

usage: snmpwalk [-p ] host community [object-id]

dragon:~$ /usr/bin/snmpwalk  localhost public system

system.sysDescr.0 = "Linux version 2.0.24 (root@dragon) 
                     (gcc version 2.7.2) #6 Mon Nov 25 15:08:40 MET 1996"
system.sysObjectID.0 = OID: enterprises.tubs.ibr.linuxMIB
system.sysUpTime.0 = Timeticks: (39748002) 4 days, 14:24:40
system.sysContact.0 = "David Guerrero"
system.sysName.0 = "dragon "
system.sysLocation.0 = "Madrid (SPAIN)"
system.sysServices.0 = 72
system.sysORLastChange.0 = Timeticks: (39748006) 4 days, 14:24:40
system.sysORTable.sysOREntry.sysORID.1 = OID: enterprises.tubs.ibr.linuxMIB.linuxAgents.1
system.sysORTable.sysOREntry.sysORDescr.1 = "LINUX agent"
system.sysORTable.sysOREntry.sysORUpTime.1 = Timeticks: (39748007) 4 days, 14:24:40

dragon:~$

 

The C-API is located in /lib/libsnmp.so.3.1.

You can check the related header files as follows:

• /usr/include/snmp/snmp.h
• /usr/include/snmp/snmp_impl.h
• /usr/include/snmp/asn1.h
• /usr/include/snmp/snmp_api.h

and more information in the man pages snmp_api(3) and variables(5).

There's also a Perl extension module to interface with the CMU C-API that easily integrates calls to this library in Perl scripts.

MRTG: Multi Router Traffic Grapher

MRTG is an advanced tool written by Tobias Oetiker and Dave Rand to graphically represent the data SNMP agents brings to SNMP managers. It generates nice HTML pages with GIF graphics about inbound and outbound traffic in network interfaces in almost real time. This abstracts the idea of dealing directly with objects of an MIB with a command line tool like CMU-SNMP. This is the simplest and most powerful tool to monitor my routers I have found on the Internet.

MRTG uses an SNMP implementation coded entirely in Perl, so there is no need to install other packages. The main program is written in C to speed up the logging process and the generation of GIF images. The graphics are generated with the help of the GD library from Thomas Boutell, author of the WWW FAQ.

One of the highlights of MRTG is its expandability and powerful configuration. It's very easy to monitor any SNMP variables instead of traffic, like error packets, system load, modem availability and others. It's even possible to import data from an external program to feed the data, so you can use it to monitor login sessions and other information not available through SNMP.

It comes with some tools to watch your router for interfaces, extract their characteristics and generate a base configuration file you can easily tweak to accommodate your needs.

Another interesting feature of MRTG is the amount of information it generates. It permits four levels of detail for each interface: traffic in the last 24 hours, the last week, the last month and a yearly graphic. This allows you to gather information for statistical purposes. It maintains an accumulated database with all this information with the help of a consolidation algorithm that prevents the data in the logs from eating up your disk space.

It also generates a main page that contains the GIF images of the daily details of every interface of a router, which lets you have a complete idea of what's happening in your router with a simple look. You can see the main page and a detail page generated by MRTG in Figures 3 and 4.

Figure 3. Interface Main Page	Figure 4.Interface Detail Page
Click in the figures to see a larger image

Let's see a basic installation procedure. First of all, you need the distribution of MRTG. At the time of this writing, the latest version was 2.1; check the URL in the references sidebar for the latest version.

A package you must install before compiling MRTG is the GD graphic library. The URL is in the references sidebar, too. The current version of GD is 1.2, and you shouldn't have any problems compiling and installing it. Simply run make in the directory you unpacked the distribution and a file called libgd.a will be generated. Copy this file to /usr/local/lib and all the .h files to the directory /usr/local/include/gd.

At this point you should have GD up and running. Now is the time to build the MRTG package. Unpack the distribution, and edit the ../../common/January1998/Makefile, indicating where to find the GD libraries and header files, and the Perl 5.003 binary:usually /usr/bin/perl or /usr/local/bin/perl. This is done through the variables GD_LIB, GD_INCLUDE and PERL.

Build the main program by typing make rateup, and when the compilation finished, enter make substitute to include the correct PATH to the Perl interpreter within the set of Perl scripts that MRTG uses.

Copy the following files to the final destination of the binaries (for example, /usr/local/mrtg): BER.pm, SNMP_Session.pm, mrtg and rateup. You can also copy to this location the two configuration programs, indexmaker and cfgmaker.

Ensure that all the programs have the execution bit set. Now we're ready to build a simple configuration file. At this point you should have SNMP read access to your router. In a Cisco router, the configuration lines to allow this are the following:

access-list 99 permit 193.147.0.8
access-list 99 permit 193.147.0.9
access-list 99 permit 193.147.0.130
snmp-server community public RO 99

This allows read-only requests from the addresses specified in the access list 99 using "public" as a password (community). If you want to allow every node in the network Read Only (RO) access to the router, you can have a line like this one:

snmp-server community public RO

If you have another brand of router, check the manuals to determine how to allow SNMP access to them.

The cfgmaker script greatly simplifies the task of building the configuration file. All you have to do is run it with the following arguments:

cfgmaker <community>@<router-host-name or IP>

For example:

cfgmaker public@mec-router.rediris.es > mrtg.cfg

It will discover every interface in your router and write a section in the file with its specifications of numbers of interfaces, maximum speed, description, etc, with some HTML tags to include them in the detail page. It's possible to edit this HTML layout to suit your language, preferences, etc. You can see in Figure 5 the output for one of the interfaces of my router.

Now you can run the mrtg program for the very first time. Simple execute:

./mrtg mrtg.cfg

If all goes well, it will contact your router, request some values, and generate some log files and several GIFs in the current directory. Don't worry about the complaints about the log and graphs not found, as this will happen only the first time. Remove the graphs and run the program again. The graph generated shows the traffic in the interval since you last ran the program. It also generates HTML pages for each interface.

Now it's time to instruct MRTG to run properly in your system. First, create a directory under the Document Root of your web server (assuming you run a web server on the same system) to accommodate the pages and graphs MRTG will generate each time it runs. Add this directory to the top of your configuration file with the directive WorkDir: /usr/local/web/mrtg (assuming that your Document Root is located in /usr/local/web). The next time MRTG runs, it will create the logs and graphs in this directory, allowing you to access them via http://your_host.domain/mrtg.

Now, you would like to build a main page for all the interfaces like the one shown in Figure 3. This can't be accomplished with the indexmaker tool. Run:

indexmaker mrtg.cfg <router-name regexp> > /usr/local/web/mrtg/index.html

It will generate an HTML page with the daily graphs of interfaces whose router name matches the previous regular expression and links to their single detail pages.

As you can imagine the MRTG program must be run on a regular basis to collect the data for each interval and generate the graphs periodically, in order to maintain the illusion of real-time monitoring. This is done through the following line in the crontab (assuming /usr/local/mrtg-bin as the mrtg program final destination):

0,5,10,15,20,25,30,35,40,45,50,55 * * * * \
/usr/local/mrtg-bin/mrtg \
/usr/local/mrtg-bin/mrtg.cfg > \
/dev/null 2>&1

In a Red Hat distribution, the correct line to append to the /etc/crontab file would be:

0,5,10,15,20,25,30,35,40,45,50,55 * * * * root \
/usr/local/mrtg-bin/mrtg \
/usr/local/mrtg-bin/mrtg.cfg > \
/dev/null 2>&1

If everything is working fine, you can spend some time tuning your configuration and HTML index page. A good enhancement is to include in the <HEAD> section of the index page a <META .....> to force the browser to reload every 300 seconds to maintain the latest information on the screen.

Another enhancement you can include in your configuration file is the WriteExpire directive, which forces MRTG to create .meta files for each GIF and HTML page, eliminating unnecessary caching time by proxy servers and browsers. For this to work, you must also configure your Apache server (assuming you run the Apache web server) to read these .meta files and send the correct "Expire" headers with the MetaDir directive in the XXXX file.

You can look for additional directives in the example configuration from the distribution; it's very well documented. It's possible to alter all the layout of the images and pages generated by MRTG.

I hope you enjoy this program. If you do, send the authors a postcard; you can find their address on the MRTG home page.

Other Programs

There is a similar program called Router-Stats, written by Iain Lea, the author of the well-known tin news reader. Router-Stats updates its graphics once a day and shows very interesting stats about hourly usage and other aspects. One problem with Router-Stats is it uses a lot of external programs to do its work (CMU-SNMP for SNMP tasks, GNUPLOT to draw the graphics, NetPBM to make some graphic conversions, and GIFTOOL to convert them to the final GIFs). You can check the URL for Router-Stats in the references sidebar.

There is another category of software that goes one step beyond in network management tasks and offers a complete solution for both monitoring and maintaining the distinct configuration of a whole network. This kind of solution permits us to draw a complex graphic representation of our network and browse through the nodes, checking specific items of the configuration and other interesting features.

At this level, we can talk about two commercial solutions broadly used: HP-OpenView from Hewlett-Packard and SunNet Manager from Sun. They provide a complete platform for managing all the resources of the network from great graphical interfaces. They also come with network discovery tools to find all the network's elements that have running SNMP agents and databases to store all the data gathered from the network for statistical purposes. One important feature of these environments is their ability to be integrated with other vendors' more specific products, like Cisco's CiscoWorks, that allows a network manager to maintain a database with all its router configuration and even monitor graphically the back panels of their routers and all their connections.

There are two drawbacks to these products: they are commercial and they have no ports to Linux. Of course, there are also public domain solutions for these tasks. One of the best packages I've found for this is Scotty. Scotty is a TCL-based package that allows you to implement site-specific network management software using high-level, string-based APIs. Its companion product, Tkined, is a network editor that provides extensions to build a complete framework, integrating some tools designed to discover IP networks, support the network layout process or troubleshoot IP networks using SNMP in combination with other standard tools (e.g., traceroute). Scotty also includes a graphical MIB browser to allow you to explore MIB information.

You can check the references listing for both commercial and public domain network management software pointers.

Conclusions

SNMP is a simple but powerful protocol that can help us monitor our resources with little stress to the network. It's possible the extensions being developed now will increase the complexity and capabilities of this tool but they will also increase the resources needed to implement them.

In this article, we have explored a couple of tools found on the Net. There are a lot of tools being developed each day. You can check the Usenet newsgroup comp.protocols.snmp for announcements of new software and MIBS.