Nothing to Report

Using SMTP, and a Nagios plugin called ‘Check_bandwidth3′ it is possible to monitor network traffic from Remote Windows hosts using Nagios3

Prerequisites:

• Nagios – (see my earlier blog post for installation/configuration of Ubuntu 10.10 system)
• Perl – (this is installed by default on Ubuntu 10.10 system)
• Perl Net::SNMP module

In my case, the prerequisites were all satisified apart from the Perl SNMP module… install it like this:

sudo perl -MCPA -e shellinstall Net::SNMP

• The ‘Check_bandwidth3′ plugin – download from here: https://www.monitoringexchange.org/inventory/Check-Plugins/Software/SNMP/check_bandwidth3

(We will later copy the ‘check_bandwidth3′ program to /usr/lib/nagios/plugins/ directory for usage…)

• Configure SNMP on a Windows Client – for ‘Read-Only’ access

Configuring SNMP on the Windows Host

This is my Windows Client SNMP Configuration:

Set the SNMP to start Automatically, and Start the service

Then configure the ‘Agent’ according to the settings in the ‘Agent’ tab (shown below)…

Set SNMP service to 'Automatic' and Start

Select the ‘Agent’ tab – add a ‘Contact’ and ‘Location’, and select the ‘Services’ which are appropriate to your configuration

Agent Configuration

Goto ‘Traps’ tab, add a ‘community name’ (e.g. SKDSNMP.RO) and click on ‘Add to List’ button…

Add an SNMP 'Community Name' which can be accessed

In ‘Trap Destinations’ section of the same window, click on the ‘Add’ button to add a ‘Trap Destination’, then type the IP address of the Nagios Server, and Save changes…

Add a 'Trap Destination'

In the ‘Security’ tab of the SNMP Service configuration, Add the ‘Community Name’ (which we nominated earlier) to the Communities which are able to be tranmitted via the network, and set this community to be READ ONLY…

Add 'Community Name' in 'Security' tab and set to type = 'READ ONLY'

Then, perhaps it is a good idea to add some security to the SNMP service by at least limiting access to the service by certain hosts (see service configuration change below where I have added the IP address of the Nagios host, and changed access by listed hosts only)

Add the Nagios Host IP and set access by named hosts

It *MAY* be necessary to modify the Firewall rules on the Windows Host to allow access by the SNMP port (UDP Port 161). This was certainly necessary on one of the Windows machines which I was monitoring before I could connect from the Nagios host using the ‘Check_bandwidth3′ plugin.

Add Firewall port for UDP port 161

Our Windows Host should now be ready to serve SNMP information to our Nagios Server command-line… the output should be identical to the earlier test

Installation/Configuration of the ‘Check_bandwidth3′ plugin to work with Nagios:

• Unpack package into a temporary directory. (eg: /tmp) and copy the ‘Check_bandwidth3′ script into your plugins directory [/usr/lib/nagios/plugins/]

sudo cp check_bandwidth3 /usr/lib/nagios/plugins/

• By default, check_bandwidth3 will store all cache files under the directory /tmp/.traffic. If you want to change this, please edit the file and change the $_storage variable towards the top, or use –save command-line option. [I left this as default]
• Make sure ‘Check_bandwidth3′ can create and/or write to the $_storage directory

Run a test to see if we can remotely access Windows Host NIC details:

We can now test to see if we can obtain the bandwidth information of a network interface on our remote Windows Client using the following command (on our Nagios Server)

sudo /usr/lib/nagios/plugins/check_bandwidth3 --interface v1://192.168.1.16/SKDSNMP.RO:1

The output from this command is shown below:

Test the plugin from the Nagios server on the commandline

Configure Nagios to use ‘Check_bandwidth3′ plugin:

With a working ‘Nagios’ and ‘NConf’ configuration (see my earlier blog posts) we can now configure the Nagios server to use the ‘Check_bandwidth3′ plugin, along with the command-line attributes that we require (see ‘./check_bandwidth3 –help’) for full details on all available options.

Goto the administration view of NConf in a browser (probably http://yourhost/nconf).

Create a new ‘Checkcommand’:

Find in the menu on the left hand side of the screen an item called ‘Checkcommands’ and click on the ‘Add’ link. It will take you to a window (as shown below) where it is possible to configure a new base ‘Checkcommand’ which we will use to check bandwidth settings on our remote hosts

The new ‘Checkcommand’ form has some predefined fields which can be populated by details which we used in our command-line test (above). Here we can provide variables which will be injected into the command when it is being sent by Nagios to a remote host

Create the ‘Checkcommand’ as follows:

Checkcommand Name – [this can be any name you like, but pays to choose a sensible and meaningful name]

check_bandwidth3

Check Command Line – [this is the command which will be generated by Nagios when we are querying a remte host]

$USER1$/check_bandwidth3 --interface $ARG1$://$HOSTADDRESS$/$ARG2$:$ARG3$

Command description - [a description which will be helpful for the administrator to know what the Arguments to the above command refer to]

ARG1=Protocol Version,ARG2=SNMP Community, ARG3=NIC

Amount of Params – [this refers to the Number of Arguments which will be passed into the command when executed by Nagios]

Change this item to '3'

Now save the configuration of this new ‘Checkcommand’ – We will be referring to this in the next section (your configuration should look somthing like this):

Create a 'Checkcommand' for using the 'Check_bandwidth3' plugin within Nagios

Create a new Host-Specific Service:

Find in the menu on the left hand side of the screen an item called ‘Services’ and click on the ‘Add’ link. It will take you to a window (as shown below) where it is possible to configure a new host-specific ‘Service’ which we will use to administer our Windows Host

Add the following details in this form:

Service Name – Provide a unique name for this Host Specific service

Check Command – Choose from the pulldown menu the  ‘Check_bandwidth3′ command (which we configured in the previous section)

Assigned to Host – Choose from the pulldown menu the host which we want to monitor (this host must have been configured to share SNMP details as discussed in the previous section)

Check Period – At this stage, we are keeping it simple, so choose the default ‘Check Period’ = 24×7

Add a new 'Service' for a specific host

The settings should look similar to those shown in the screenshot above. Save these settings then click on ‘Services’ and click on the ‘Show’ link on the left hand side of the screen… choose the newly created ‘Service’ and click the corresponding icon (which looks like a pencil) on the Right-Hand side of the screen – this will allow you to edit the service settings (see below)

Find the new 'Service' and choose 'Edit'

The interface will return you to a screen which is very similar to the one which we originally used to create the new ‘service’, however, now there are items at the bottom of the screen which can be edited in order to specify the variables which should be used as ‘Arguments’ when Nagios is sending the command to the specifed host… in this case, we want to:

- Use Version 1 of the SNMP protocol: [so ARG1 = v1]

- Use the Community Name: [so ARG2 = SKDSNMP.RO]

- Obtain details of the 1st NIC on the Windows Server which I am monitoring: [so ARG3 = 1]

Edit the Arguments which should be passed by Nagios to the 'Check_bandwidth3' plugin when monitoring THIS host

Click on the ‘Submit’ button to save your changes

Synchronise the Changes to Nagios Configuration:

Finally, we need to ‘Regenerate the Nagios Configuration’ in order to load the selected changes into the Nagios config files, and for the Nagios system to start monitoring this Host… Choose the item called ‘Generate Nagios Config’ from the menu on the Left-Hand side of the screen

Generate Nagios Config to sync changes to the Nagios system

The changes should take a few seconds to sync, and you should get the following response. Pay attention to the ‘Syntax Check’ at the bottom of the response… if there are any problems, expand this section and find out if there are any syntax issues with your newly created service’

Configuration has been Synchronised to Nagios

Review the Configuration Changes in Nagios:

At this point, Nagios should be configured to start monitoring bandwidth of your Windows host. It does take a few minutes for this configuration ch (anges to be displayed in your Nagios web front-end (Goto http://<your_host>/nagios3 – login, and choos the ‘Service Detail’ option on the Left-Hand side of the screen)

Nagios front-end - 'Service Detail'

If your changes are not evident after a few minutes, it may be necessary to reload Nagios daemon.

sudo /etc/init.d/nagios3 reload

Eventually you should see the newly configured host-specific bandwidth monitoring service appear in the ‘Service Details’ section… it may look something like the following screenshot – but (as you can see) I have a permissions problem with the Nagios user not being able to write to the /tmp/traffic/192.168.1.16/1 directory

Problems with the Host Monitoring - privileges on /tmp/.traffic directory (on Nagios server)

I can resolve this problem by performing the following commands (which are (1) a ‘recursive’ request to change ownership of the /tmp/.traffic directory for the ‘nagios’ user, and (2) a ‘recursive’ modification of privileges on the /tmp/.traffic directory to ensure that it is writable by the nagios process user):

sudo chown -R nagios:nagios /tmp/.traffic/

sudo chmod -R 755 /tmp/.traffic/

Checking the ‘Service Detail’ section of Nagios interface after a few minutes, I can see that the modification has allowed Nagios to report on the bandwidth of the remote Windows NIC

The Remote Windows Host network bandwidth is now being monitored by Nagios

Addendum:

check_bandwidth3 checks on 64-bit Hosts

Since writing this blog post, I have been emailed on more than one occasion by users who have not been able to get the ‘check_bandwidth3′ Nagios plugin to work as it was described above.

I have not had the chance till now to test this functionality for myself due to having been using Nagios to monitor a predominantly 32-bit Windows Host environment. Today, I was able to confirm that the plugin indeed DOES work for checking bandwidth on 64-bit hosts, but enabling the functionality was somewhat different from what I expected and was used to from the 32-bit hosts which I had configured previously.

The configuration for a 64-bit host is indeed no different from that which must be considered (and has been documented above). The secret to receiving a reliable response from the 64-bit host is in correctly determining the so-called ‘Interface Number’ for the host which you are targeting.

I have said previously regarding the Windows 32-bit hosts that the (default, primary) NIC ‘Interface Number’ to target when executing a ‘check_bandwidth3′ command is often either ’1′ or ’65539′ (I have no idea why 65539 appears to be commonly used by the Windows environment for the default LAN NIC – it just is). In the case of the Windows Server 2008 R2 (64-bit) host which I configured today, I received (positive) replies from the ‘check_bandwidth3′ program which indicated ZERO network traffic was being transmitted via the (unused) ports – See example below:

Example 'check_bandwidth3' check on WRONG 'interface' of 64-bit Windows Host

In the above screenshot, I am logged in to the remote Nagios Server (using Putty) as the user = ‘nagios’ – this is important, because the user must have read/write access to the default storage location on the server where the data will be written to.

The SNMP Community String I am using = ‘Data’ and the Windows Host is configured to accept and return SNMP to the Nagios Host (as described in post above)

The important thing to notice in the above screenshot is that there is ZERO traffic being transmitted via the targeted ‘Interface’ (in this case, :1).

I do not yet have a foolproof way to identify the correct host ‘interface’ to target so, in my case, trial and error has been the method of choice (perhaps somebody can provide a mechanism which makes this task easier?). The screenshot below shows the ‘check_bandwidth3′ tests which I performed from the commandline on the Nagios server to identify the correct ‘Interface’ number to target. In my case, I was concurrently performing a large file transfer to the target host to be sure that I would notice when I identified the correct ‘Interface’ number.

Identifying the correct NIC 'Interface' number for 'check_bandwidth3' on Windows Host

The above screenshot shows the methodical iteration testing performed with the ‘check_bandwidth3′ on Nagios server command-line in order to identify that the correct ‘Interface’ number to target should be (in my case) #11

NOTE: you will also see that the last test performed (in the above screenshot) was for ‘Interface’ number = 12. This interface number returned a negative response from the ‘check_bandwidth’ program which seems to indicate that the other tested interfaces were apparently still ‘valid’ Windows Host interfaces, but were simply not correct for our purposes.

The last step in correctly configuring your Nagios installation is to correct your Nagios configuration (as described above) to change the ‘Interface’ number accordingly, then save changes