配置SNMP和MRTG
作者：maijian
配置SNMP和MRTG：MRTG是利用SNMP協(xié)議去查詢指定有SNMP協(xié)議的設備，定時統(tǒng)計其設備的流量或負載，再將統(tǒng)計結果繪成統(tǒng)計圖，從統(tǒng)計圖上能很容易、直觀地就能查出流量或負載。本文講述的是用MRTG在IIS上實現(xiàn)入侵檢測功能。
配置snmp 和 mrtg
版本：Ubuntu 10.04
安裝snmpd(server端) 和 snmp(工具如snmpwalk)
編輯 vim /etc/default/snmpd
- SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -g snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1'
改成
- SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -g snmp -I -smux -p /var/run/snmpd.pid'
這樣就可以提供給外部接口調(diào)用，Ubuntu默認把snmp服務只對內(nèi)服務
編輯vim /etc/snmp/snmpd.conf(***先備份好原來的snmpd.conf文件)
把默認的項全部注釋掉(按照它默認的不知道為什么搞不成功)
- #1
- com2sec notConfigUser default public
- #2
- group notConfigGroup v1 notConfigUser
- group notConfigGroup v2c notConfigUser
- #3
- view systemview included .1.3.6.1.2.1.1
- view systemview included .1.3.6.1.2.1.25.1.1
- view all included .1
- #4
- access notConfigGroup "" any noauth exact all none none
- #下面這兩個可以保留沒影響
- syslocation Unknown(mj) (configure /etc/snmp/snmpd.local.conf)
- syscontact Root(mj) (configure /etc/snmp/snmpd.local.conf)
- /etc/init.d/snmpd restart 重啟snmp服務
因為我們只關系cpu，內(nèi)存等負載，所以不需要我們自己寫腳本，snmp本身已經(jīng)有這些功能，看后面常用OID
- snmpwalk -v 1 -c public IP OID
例子:
- snmpwalk -v 1 -c public 192.168.22.210 .1.3.6.1.4.1.2021.4.6.0
安裝mrtg
創(chuàng)建/var/www/mrtg網(wǎng)頁目錄
編輯vim /etc/mrtg.cfg
mrtg.cfg可以使用cfgmaker生成
- cfgmaker --global "WorkDir: /var/www/mrtg"
- --global "Options[_]: growright,bits"
- --ifref=ip
- --output /etc/mrtg.cfg
- public@192.168.22.210
- cfgmaker --global "WorkDir: /var/www/mrtg"
- --global "Options[_]: growright,bits"
- --ifref=ip
- public@192.168.22.210
我們把--output /etc/mrtg.cfg這個選項去掉，把結果直接輸出到屏幕,如下
**************************************************************
- # Created by
- # /usr/bin/cfgmaker --ifref=ip public@192.168.22.210
- ### Global Config Options
- # for UNIX
- # WorkDir: /home/http/mrtg
- # for Debian
- WorkDir: /var/www/mrtg
- # or for NT
- # WorkDir: c:\mrtgdata
- ### Global Defaults
- # to get bits instead of bytes and graphs growing to the right
- # Options[_]: growright, bits
- EnableIPv6: no
######################################################################
- # System: mj-desktop
- # Description: Linux mj-desktop 2.6.32-22-generic #36-Ubuntu SMP Thu Jun 3 22:02:19 UTC 2010 i686
- # Contact: Root(mj) (configure /etc/snmp/snmpd.local.conf)
- # Location: Unknown(mj) (configure /etc/snmp/snmpd.local.conf)
######################################################################
- ### Interface 1 >> Descr: 'lo' | Name: 'lo' | Ip: '127.0.0.1' | Eth: '' ###
- ### The following interface is commented out because:
- ### * it is a Software Loopback interface
- #
- # Target[192.168.22.210_127.0.0.1]: /127.0.0.1:public@192.168.22.210:
- # SetEnv[192.168.22.210_127.0.0.1]: MRTG_INT_IP="127.0.0.1" MRTG_INT_DESCR="lo"
- # MaxBytes[192.168.22.210_127.0.0.1]: 1250000
- # Title[192.168.22.210_127.0.0.1]: Traffic Analysis for 127.0.0.1 -- mj-desktop
- # PageTop[192.168.22.210_127.0.0.1]:
- Traffic Analysis for 127.0.0.1 -- mj-desktop
- #
- # # # System: # mj-desktop in Unknown(mj) (configure /etc/snmp/snmpd.local.conf) #
- # # Maintainer: # Root(mj) (configure /etc/snmp/snmpd.local.conf) #
- # # Description: # lo #
- # # ifType: # softwareLoopback (24) #
- # # ifName: # lo #
- # # Max Speed: # 1250.0 kBytes/s #
- # # Ip: # 127.0.0.1 (localhost) #
- #
- #
- ### Interface 2 >> Descr: 'eth0' | Name: 'eth0' | Ip: '192.168.22.210' | Eth: '08-00-27-f9-de-39' ###
- Target[192.168.22.210_192.168.22.210]: /192.168.22.210:public@192.168.22.210:
- SetEnv[192.168.22.210_192.168.22.210]: MRTG_INT_IP="192.168.22.210" MRTG_INT_DESCR="eth0"
- MaxBytes[192.168.22.210_192.168.22.210]: 1250000
- Title[192.168.22.210_192.168.22.210]: Traffic Analysis for 192.168.22.210 -- mj-desktop
- PageTop[192.168.22.210_192.168.22.210]:
- Traffic Analysis for 192.168.22.210 -- mj-desktop
- System: mj-desktop in Unknown(mj) (configure /etc/snmp/snmpd.local.conf)
- Maintainer: Root(mj) (configure /etc/snmp/snmpd.local.conf)
- Description: eth0
- ifType: ethernetCsmacd (6)
- ifName: eth0
- Max Speed: 1250.0 kBytes/s
- Ip: 192.168.22.210 (mj-desktop.local)
**************************************************************
上面產(chǎn)生的是針對192.168.22.210一臺機的模板，我們把它保存成/etc/mrtg.conf，以此為模板慢慢建立起來
這些網(wǎng)頁代碼前面要有tab，***按照輸出copy進去不要修改
#Options[_]: growright, bits 把注釋去掉
默認是只監(jiān)控目標機的eth0網(wǎng)卡，loopback本地網(wǎng)卡監(jiān)控是注釋掉的，這個不用修改
執(zhí)行生成頁面
- indexmaker -output=/var/www/mrtg/index.html /etc/mrtg.cfg
- env LANG=C /usr/bin/mrtg /etc/mrtg.cfg
可以把env LANG=C /usr/bin/mrtg /etc/mrtg.cfg加入到crontab里面定時執(zhí)行(每個5分鐘執(zhí)行一次)
- */5 * * * * env LANG=C /usr/bin/mrtg /etc/mrtg.cfg
***訪問http://localhost/mrtg/
上面只是針對一臺目標機器，我們可以繼續(xù)上面的cfgmaker來產(chǎn)生再多一臺目標機器，把結果輸出到屏幕，然后在把對應的項添加到原有的mrtg.conf文件里面
我們在監(jiān)控網(wǎng)絡流量的基礎上添加其它應用
(自己寫腳本，數(shù)據(jù)不準確，僅供學習)
- #建立一個內(nèi)存使用情況
- /home/mj/mem.sh
- #!/bin/sh
- total=`snmpwalk -v 1 -c public 192.168.22.210 .1.3.6.1.4.1.2021.4.5.0 | awk '{printf("%d\n",$4/1024);}'`
- free=`snmpwalk -v 1 -c public 192.168.22.210 .1.3.6.1.4.1.2021.4.6.0 | awk '{printf("%d\n",$4/1024);}'`
- echo $(($total-$free))
- echo 0
- Target[mem]: ` /home/mj/mem.sh `
- MaxBytes[mem]: 1024
- Title[mem]: Memory State of WY1 IP 192.168.22.210 Server
- PageTop[mem]:
- Memory State of WY1 IP 192.168.22.210 Server
- ShortLegend[mem]: MB
- kmg[mem]: MB
- kilo[mem]: 1024
- YLegend[mem]: Memory Usage
- Options[mem]: growright,gauge,nopercent
- #建立一個cpu使用情況
- Target[cpu]: `snmpwalk -v 1 -c public 192.168.22.210 .1.3.6.1.4.1.2021.11.11.0 | awk '{printf("%d\n%d\n",100-$4,0);}'`
- MaxBytes[cpu]: 100
- Title[cpu]: CPU State of WY1 IP 192.168.22.210 Server
- PageTop[cpu]:
- CPU State of WY1 IP 192.168.13.103 Server
- kmg[cpu]: %
- YLegend[cpu]: CPU Usage
- Options[cpu]: growright,gauge,nopercent
這里有個地方要注意是，就是target里面的值必須是兩行的，可以加上一個print 0上去，否則執(zhí)行
- env LANG=C /usr/bin/mrtg /etc/mrtg.cfg會返回
- Expected a Number for 'out' but nothing'錯誤
原因是
- Your script must return at least two values on separate lines, just add
- 'echo "0"' or something to the end of the script.
- http://oss.oetiker.ch/mrtg/nable-mrtg.en.html#nabble-td831392
(下面是mrtg提供的sample)
- #cpu
- LoadMIBs: /usr/share/snmp/mibs/UCD-SNMP-MIB.txt
- Target[185cpu]:ssCpuRawUser.0&ssCpuRawUser.0:public@121.9.243.185 + ssCpuRawSystem.0&ssCpuRawSystem.0:public@121.9.243.185 + ssCpuRawNice.0&ssCpuRawNice.0:public@121.9.243.185
- RouterUptime[185cpu]: public@121.9.243.185
- MaxBytes[185cpu]: 100
- Title[185cpu]: CPU Load
- PageTop[185cpu]:
- Active CPU Load %
- Unscaled[185cpu]: ymwd
- ShortLegend[185cpu]: %
- YLegend[185cpu]: CPU Utilization
- Legend1[185cpu]: Active CPU in % (Load)
- Legend2[185cpu]:
- Legend3[185cpu]:
- Legend4[185cpu]:
- LegendI[185cpu]: Active
- LegendO[185cpu]:
- Options[185cpu]: growright,nopercent
target是各個值加起來，要把它寫成一行
- #mem
- LoadMIBs: /usr/share/snmp/mibs/HOST-RESOURCES-MIB.txt
- Target[185mem]:(memTotalReal.0&memTotalReal.0:public@121.9.243.185 - memAvailReal.0&memAvailReal.0:public@121.9.243.185)*100/(memTotalReal.0&memTotalReal.0:public@121.9.243.185)
- Title[185mem]: Percentage Used Memory
- PageTop[185mem]:
- Percentage Used Memory
- options[185mem]: growright,gauge,transparent,nopercent
- Unscaled[185mem]: ymwd
- MaxBytes[185mem]: 100
- YLegend[185mem]: Memory %
- ShortLegend[185mem]: Percent
- LegendI[185mem]: Used
- LegendO[185mem]: Used
- Legend1[185mem]: Percentage Used Memory
- Legend2[185mem]: Percentage Used Memory
***上網(wǎng)查找mrtg的現(xiàn)成例子,如net，cpu，mem負載，tcp連接數(shù)等等,還有就是記得target里面的空格之類的多余符號可能會導致生成頁面失敗
【編輯推薦】
責任編輯：zhaolei
來源：
CSDN
