Zabbix: Additional Functionality (netflow, traffic stats)

[treyh]

Hello,

I am looking for a replacement for Nagios+Cricket.

Configuring Zabbix to monitor hosts was very straight forward and I was able to set this up.

I have googled for examples to configure zabbix for traffic statistics, which is what I'm using cricket for now, but haven't had much luck. I did find a guide to monitoring ethernet interfaces for unix servers running the agent but what I really need is to monitor ethernet and serial interfaces on cisco routers.

Is there a tutorial out there where someone has customized zabbix or written a plugin to do this, or do I have to write a custom perl script using something like net::telnet::cisco to accomplish this?

[swaterhouse]

Use SNMP. I think the snmp template is at least a good place to start, otherwise you can just setup the items individually.

[rraver]

The most I have been able to gather is general stats on interfaces for the errors, throughput, speed, duplex, and up/down status. I haven't seen anything that will give you the granularity that netflow does, you would need to setup a collector that then would format the data and dump it into the same db. Even then you would have to do some heavy customization work to be able to graph and display the information in the UI. This is a big area I think most tools don't incorporate and draw the line and graphing the traffic in general. There are several independent tools and some okay open source tools for doing this, but they do not incorporate the other features in zabbix.

[treyh]

traffic monitoring

Rraver,

Can you explain to me how you setup this:
============================
The most I have been able to gather is general stats on interfaces for the errors, throughput, speed, duplex, and up/down status.
============================

I am pulling snmp info from servers running the agent but when I try to collect snmp info from cisco routers I get blank data.

I can however run the commands from command line to pull the info from routers that I need.

Thank you.

[treyh]

Update

I experimented enough to discover what I was doing wrong.

I am now able to pull snmp info from the test cisco router.

What I need to know now is how to pull down specific interface information and stats.

I'm sure I just need the specific MIB to use but I haven't found the correct one yet.

[swaterhouse]

What information and stats are you looking for?

Bandwith is measured in Octets but sent back as a runnning counter (i.e. total # of octets transferred since day one)

the OID for inbound traffic on Port 5 is:

interfaces.ifTable.ifEntry.ifInOctets.5

Outbound is:
interfaces.ifTable.ifEntry.ifOutOctets.5

To change the port just change the 5 to whatever port number you want to monitor

To get badwith utilization per second (in Bytes) you need to multiply by 8 and change the value so it is stored as Delta (speed per second)

If there is other cunters you are looking for I would suggest getting a MIB browser tool to find the correct OID. This one is free and has the default cisco MIB included.

http://www.ireasoning.com/mibbrowser.shtml

[rraver]

Most interface stats can be gathered through the IF-MIB which is a standard MIB across multiple vendors. Specifically if you look at the ifOutOctets and ifinOctets you can see the amount of traffic going through the device. You can't get more specific statistics from Netflow, NBAR, or any other way. The OID for this is 1.3.6.1.2.1.2.2.1.16 and 1.3.6.1.2.1.2.2.1.10 respectively. Usually you will have to add a .1, .2, .3 and so on for the interface on the router. Depending on the device it will depend on what interface you are looking at. There are other values you can grab to verify like the ifType and ifDescr to verify it's the right interface you want. Here is a link to the Cisco SNMP Object Navigator that goes through the different things that can be pulled specific to the interfaces...

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.2.1.2.2.1.16

Hopefully this helps out.

[treyh]

hello

thank you for the posts, this is the information I'm looking for

[treyh]

which interface

What order do the interfaces go in?

========Update==========

I skipped over the ifDescr , thank you again

[rraver]

cool, let me know if you have any other questions.

[treyh]

mib

Hello,

I loaded a cisco mib for 1.3.6.1.4.1.9.9.109.1.1.1.1.8

It works with snmpwalk:
zabbix# snmpwalk -v 2c -c communityname 192.168.0.1 1.3.6.1.4.1.9.9.109.1.1.1.1.8
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.8.1 = Gauge32: 2

Zabbix gives this error:
000700:20070531:171510 OID [1.3.6.1.4.1.9.9.109.1.1.1.1.8] value #2 has unknow type [81]
*yes that is a typo on zabbix's part "unknow" instead of "unknown"

I restarted net-snmp, zabbix server and agent, and then finally rebooted but that didnt' work.

My next guess would be to recompile zabbix and reinstall, am I correct?

[rraver]

do you have other SNMP pulls working? I would think that there would be something wrong with item where it defines the type. I am uncertain about this though. Let me know what configuration you have for that item and how anything else goes.

[Alexei]

Are you sure you use same version of SNMP in ZABBIX? v2c?

[treyh]

net-snmp

Here are more details about my setup.

Freebsd 6.2
php 5.1.1 (installed from source)
Apache/2.0.59 (installed from source)
mysql-5.0.41 (installed from source)
net-snmp 5.3.1 (installed from ports)
zabbix 1.4 (installed from source)

Here is my configure command:

./configure --enable-server --enable-agent --with-mysql=/var/apps/mysql --with-net-snmp

When I configured should I have specified the location for net-snmp?

The router is running v2, and so is my server, and thats what I chose in zabbix.

[treyh]

actions

Hello,

My actions are also not working.

The trigger is working because it shows up in Events but the action isn't showing up or emailing me.

Action Type: Send message
Source: Trigger
Conditions: Host group = "freebsd_server"
Send Message: Single User
User: trey
Repeat: No
Status: Enabled

If if the mail config is wrong there should still be an action showing up correct?