RE: Monitoring Sensors

[Christopher Lyon <cslyon () netsvcs com>]

Gene,
Thanks for pointing out the plug-ins. Sorry but I didn't noticed that the
first round looking at NetSaint. Looks like there is some cool plug-ins for
doing just what you said. 


-----Original Message-----
From: Gene Gomez [mailto:gegomez () tycoint com] 
Sent: Friday, September 20, 2002 4:20 PM
To: Christopher Lyon; snort-users () lists sourceforge net
Subject: RE: [Snort-users] Monitoring Sensors

Chris,
NetSaint (or Nagios) can be set up to do far more than just ping and
portcheck.  There are a LOT of plug-ins available for it that do a whole
host of other things, including CPU, Memory, and disk metrics.  It also can
check for process activity.  In short, it can do everything you're talking
about in the below email.
If you're interested, check out nagios_statd (v3 of the statd service,
requires python), or netsaint_statd (v2, requires perl).
We're currently monitoring our sensors, our servers, and all manner of neat
things with NetSaint.  
Plus, we didn't have to buy any software.  :)
 
Gene
-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Christopher
Lyon
Sent: Friday, September 20, 2002 2:38 PM
To: 'Pedro Tedeschi'; snort-users () lists sourceforge net
Subject: RE: [Snort-users] Monitoring Sensors
Pedro, 
There are a couple of theories on how you should monitor your sensors. Just
ping to see if the box is up or actively poll the device for up, down, and
other stats.
What we found to work best is actively poll the device using SNMP. The
reason for this is so that we can poll to make sure processes like snort are
running. Yeah it is good to know if the box is up but what good is it if a
key service has quit working. 
If you load ucd-snmp, assuming you are on a UNIX platform, you can monitor
not only if the box is up and running but you can monitor CPU utilization
and processes. So if mysql, snort or apache decided to quit for whatever
reason you can be notified that they are not running. You can use any SNMP
based product as a manager to poll the sensor for that information. We
activity monitor about 10 sensors and we get paged if any of the critical
processes stop running or if the CPU utilization is hammered. 
NetSaint, from what I can tell, only pings and does a port check. I am sure
there are other SNMP packages out there for little to no money it is just a
question about finding one. At our datacenter we use SNMPc for our
monitoring and it works very well but it is costs money and runs in Windows.

Hope that gives you some help.