Network Traffic Monitoring

[shaiss]

I have one important task I need. I need to be able to monitor web usage. For example, some employees our on youtube and streaming all day and grabbing bandwidth. By the time I get to the logs or their desk its too late.

Will Zabbix allow me to do real time traffic monitoring and determine which employee is hogging the network with non work related usage?

[nelsonab]

Monitoring a person's bandwidth usage can be a challenge. There are no direct ways to say what a person is doing in Zabbix, however with a little work you can accomplish everything you want through Zabbix.

If bandwidth is a real concern in your organization I would first suggest you first install a proxy on your network such as Squid, and force all traffic to go through the proxy. Yes this will cause some users to complain that such and such service does not work at first but you can tune your proxy to allow these things. Next if gambling sites are deemed inappropriate use of resources you can then block the sites at the proxy. Yes there are ways around a proxy but for most users this is sufficient.

You can also install a program like NTop to monitor your bandwidth. For NTop is one of the best open source programs for network monitoring. Unfortunately pumping NTop data into Zabbix isn't possible.

At one point I made an agent for Zabbix which allowed you to sniff the network for traffic. If you need that I can see if I can find the code and dust it off for you.

However there is one more thing you can do which might give you much better resolution. To do this you would need to run the above squid proxy. Write a script which will take the inbound logs and parse them and put the parsed data into Zabbix. This way you can get graphs for sites or data types you are interested in. Doing this will require some scripting work but it would tie the data quite nicely into Zabbix. You can even parse the squid logs by client in real time if you want.