Re: [cobalt-users] newbie needs help / complete traffic monitoring

[Jens Kristian Søgaard <jens@xxxxxxxxxxxxxxxxxxxx>]

> > > seems not to be bad; but how do you calculate ftp/email traffic ?

> > > do you know any complete solution ? (in the way the cobalt does, but not
> > > the way the cobalt does :-)) 
 
> > Well, I use a combination of ip-chains (or ipfwdm on RaQ2), IPAC and a
> > Perl-script I've written.
 
> Could you describe how you do it?

Yes, ofcourse. But it is not in any way "simple" or very easy to set up.

First you download, compile and install either ipfwadm (RaQ2) or ipchains (RaQ3) on the server. Check out that it works (it should if you're not running a special kernel).

Then download, compile and install IPAC (ip accounting package). Check out that it works.

Put fetchipac into cron, so that it collect performance data for example every 5 or 15 minutes (it's not cpu intensive in any way, so just let it run once in a while). Put ipacsum in cron, so that it summarizes data on convienient times (for each 24 hours, then each week, each month and finally once a year). This reduces disk usage and greatly speeds up the process, when you want to have a report displayed for a specific month, for example.

You'll then need to a write a program that creates the configuration files for ipac. Either that, or you'll have to add a few lines to the configuration each time you use a new ip (this may be acceptable to you).

Lastly write a program that interprets the data coming from ipacsum and displays them on a webpage. The programs needs to do things like:

                    1. Read the byte counters from ipac
                    2. Translate the ip-numbers into sitenames.
                    3. Seperate the counter into TCP/UDP and In/Out -- or even WWW/FTP/MAIL/DNS/etc if you like.
                    4. Do a few mumbo jumbo calculations on the data (subtract the bytes used when the server is talking with                                 itself).
                    5. Write a HTML page with the information.


It's a quite convient system. You could modify it a bit so that performance data were stored in a MySQL database and then viewed from a PHP page. That would be faster and better; but I don't think that's necessary at all. I like the Perl version...


-- 
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@xxxxxxxxxxxxxxxxxxxx