![snort logo](/images/snort-logo.png)
Snort mailing list archives
Re: A few questions regarding Solaris
From: Mike Lococo <mikelococo () gmail com>
Date: Tue, 31 Aug 2010 16:06:58 -0400
On 08/31/2010 03:20 PM, Robert Riskin wrote:
Mike thank you very much for the info, i'm curious how you have Zabbix watch your perfmon file with certain columns. I use Zabbix in a separate environment (and I love it) but am planning on deploying in production by year-end.
I add a userparameter to the zabbix_agentd.conf file as follows (ignore linebreaks, it should all be on one line): UserParameter=snort.perfmon[*],tail -n1 '/var/log/snort /$1/snort.stats' | awk -F ',' '{print $ $2}' This uses tail to grab the last line of a stats file, and pipes that line into awk in order to print a particular column. $1 and $2 are zabbix variables that allow you to create "items" that monitor different interfaces and columns without having to create a separate "userparameter" for every one. Note the extra dollar-sign in the awk print statement... which is necessary because both awk and zabbix use dollar-signs in their variable names. I then add items to a host/template for each interface and column that I want to monitor with keys like so: snort.perfmon[eth1,46] snort.perfmon[eth1,47] snort.perfmon[eth2,46] snort.perfmon[eth2,47] The four items above would monitor received packets (column 46) and dropped packets (column 47) for eth1 and eth2. Zabbix won't calculate a ratio for you, but you can plot both values in a stacked graph, which is a good rough substitute. Also be wary of the update interval in zabbix vs the update interval for the perfmon pre-processor, you want them to be roughly the same so you're not polling the same value over and over again or missing values. I update my stats about every 10 minutes. Cheers, Mike Lococo ------------------------------------------------------------------------------ This SF.net Dev2Dev email is sponsored by: Show off your parallel programming skills. Enter the Intel(R) Threading Challenge 2010. http://p.sf.net/sfu/intel-thread-sfd _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- A few questions regarding Solaris Robert Riskin (Aug 30)
- Re: A few questions regarding Solaris waldo kitty (Aug 30)
- Re: A few questions regarding Solaris Mike Lococo (Aug 30)
- Re: A few questions regarding Solaris Robert Riskin (Aug 31)
- Re: A few questions regarding Solaris Mike Lococo (Aug 31)
- Re: A few questions regarding Solaris Robert Riskin (Aug 31)
- Re: A few questions regarding Solaris Mike Lococo (Aug 31)
- Re: A few questions regarding Solaris Robert Riskin (Aug 31)