Re: Monitoring Sensors

[Bennett Todd <bet () rahul net>]

Different folks have different strategies for monitoring.

My own preference is for end-to-end functional monitoring.

For IDS sensors, I like to arrange for a special signature that will
trigger a keepalive "alarm" when I send a special probe packet past
it; then I arrange a generator to send one of those packets every
so often, and then process the alerts, wherever they're ultimately
forwarded, to move the keepalives aside for special examination;
then a periodic monitor process sets off an alarm if it doesn't
see one of these keepalive alerts for too long (several "probe"
intervals).

Same trick as I use for other server monitoring wherever I can
figure out a way to; e.g. I'll monitor an email relay server by
periodically routing a keepalive message through it to a monitoring
mailbox.

-Bennett

Attachment: _bin
Description: