INTRODUCTION | INSTALLING | HOW IT WORKS | EXAMPLES | USING RRD-ALARM WITH A MIB |
RRD-alarm consists of the file rrd_alarm.c
, and other configuration files: it was designed to be very simple yet effective. You can use it stand-alone or as a plugin for another application (for example a network application). If you want to check values of an RRD file periodically, you can use crontab
to launch it at a regular intervals of time.
./configure make(da aggiustare)
RRD-alarm uses the files generated by RRDtool to check if the average of the values in a period of time is above or below a certain threshold. You can choose which file to check, in which period of time you want to look for the value (for example, in the last two hours), which kind of threshold (below or above), and the value of the threshold. Moreover, you can choose how many repetitions of values (below or above the threshold) must verify before doing the action, the seconds that must be elapsed before repeting that action (it could be useful when the action is simply to inform someone of what has happened, avoiding to say him the same thing twice), and the kind of action that must be taken when those rules are satisfied.
rrd_alarm filename [option:parameter]where filename is the file containing one or more lines of configuration parameters needed by RRD-alarm: the configuration file must have the following syntax:
The next step is to use RRD-alarm: you have to prepare a configuration file storing all the information needed by RRD-alarm. This file must contain a line for every threshold you want to check and every line has parameters separated by TAB character. In particular, you have to specify for every line:
1 isdn.rrd above 5 3 now-1h now \\ echo ``Errors above 5% in ISDN line'' 86400(The meaning of this line is : ``Line 1: if the values contained in the file isdn.rrd are above 5 for at least 3 consecutive times in the last hour (now-1, now), then echo Errors..., unless the same action was done in the last 86400 seconds.'').
If the name used to save this file is alarm.conf
, then you can use this file with rrd-alarm simply typing:
rrd_alarm alarm.conf
#!/bin/sh rrdfiles="/home/daniele/rrd-alarm/tables/" rrdfiles_int="interfaces/" filename="ipBytes" rrdtool="/usr/local/rrdtool-1.0.44/bin/rrdtool" `../rrdtool create ${rrdfiles}${rrdfiles_int}${filename}.rrd \ --step 60 \ DS:output:COUNTER:100:U:U \ RRA:AVERAGE:0.5:1:24`This script creates an RRD file ``ipBytes.rrd'' in the directory
The next step is to update periodically the database: again, you can use a script to do that:
#!/bin/sh rrdfiles="/home/daniele/rrd-alarm/tables/" rrdfiles_int="interfaces/" filename="ipBytes" rrdtool="/usr/local/rrdtool-1.0.44/bin/rrdtool" line=`cat /proc/net/dev | /bin/grep eth0 | cut -b8-` outbytes=`echo $line | /bin/awk '{print $9}'` `$rrdtool update ${rrdfiles}${rrdfiles_int}${filename}.rrd \ N:$outbytes > /dev/null`This script simply updates the database with the current number of output bytes of the eth0 interface.
Then you have to do the configuration file for RRD-alarm: the configuration file could look like this:
1 /home/daniele/rrd-alarm/tables/interfaces/ipBytes.rrd \\ above 10000 3 now-1h now 86400\\ /home/daniele/rrd-alarm/action/mail.sh(This file contains one line, i.e. ``1 /home/.../ipBytes.rrd above 10000 3 now-1h now /home/.../mail.sh 86400'', so simply skip all of the \\ character).
alarm.conf
, and that the file mail.sh is a simple script that send a mail to the network administrator:
#!/bin/sh `/bin/date > /home/daniele/rrd-alarm/action/message.txt` `/bin/hostname >> /home/daniele/rrd-alarm/action/message.txt` `mail admin -s "Too many outbut bytes" < \ /home/daniele/rrd-alarm/action/message.txt`Now you are ready to use RRD-alarm! If you use the option -v, then the output could look like this:
[daniele rrd-alarm]$ rrd_alarm alarm.conf -v File: /home/daniele/rrd-alarm/tables/interfaces/ipBytes.rrd Interval: Start = Sat Aug 16 01:26:00 2003 End = Sat Aug 16 01:31:00 2003 6 time/s above 10000.00 Interval: Start = Sat Aug 16 01:33:00 2003 End = Sat Aug 16 01:35:00 2003 3 time/s above 10000.00 Interval: Start = Sat Aug 16 01:37:00 2003 End = Sat Aug 16 01:40:00 2003 4 time/s above 10000.00In this case, there are three intervals in which the threshold has been exceeded for at least 3 consecutive times: 6 times in the first interval, from Sat Aug 16 01:26:00 2003 to Sat Aug 16 01:31:00 2003, 3 times from Sat Aug 16 01:33:00 2003 to Sat Aug 16 01:35:00 2003, and 4 times from Sat Aug 16 01:37:00 2003 to Sat Aug 16 01:40:00 2003.
[daniele rrd-alarm]$ rrd_alarm alarm.conf -V ------------------------------------------ 65473.770492 - Sat Aug 16 01:26:00 2003 27044.846175 - Sat Aug 16 01:27:00 2003 60681.688525 - Sat Aug 16 01:28:00 2003 14004.744809 - Sat Aug 16 01:29:00 2003 31297.295082 - Sat Aug 16 01:30:00 2003 36483.104918 - Sat Aug 16 01:31:00 2003 ------------------------------------------ 12712.213115 - Sat Aug 16 01:33:00 2003 11612.833552 - Sat Aug 16 01:34:00 2003 31477.370000 - Sat Aug 16 01:35:00 2003 ------------------------------------------ 42710.704918 - Sat Aug 16 01:37:00 2003 18260.445082 - Sat Aug 16 01:38:00 2003 17160.147541 - Sat Aug 16 01:39:00 2003 16435.152459 - Sat Aug 16 01:40:00 2003 ------------------------------------------ File: /home/daniele/rrd-alarm/tables/interfaces/ipBytes.rrd Interval: Start = Sat Aug 16 01:26:00 2003 End = Sat Aug 16 01:31:00 2003 6 time/s above 10000.00 Interval: Start = Sat Aug 16 01:33:00 2003 End = Sat Aug 16 01:35:00 2003 3 time/s above 10000.00 Interval: Start = Sat Aug 16 01:37:00 2003 End = Sat Aug 16 01:40:00 2003 4 time/s above 10000.00The last step is to use
crontab
to update the database at regular intervals of time, and to launch RRD-alarm:
0-59 * * * * /home/daniele/rrd-alarm/update.sh 0 0-23 * * * /home/daniele/rrd-alarm/rrd_alarm \\ /home/daniele/rrd-alarm/conf/alarm.conf -d \\ /home/daniele/rrd-alarm/saved/This file consists of two lines, so ignore the \\, then save the file (for example, crontab), then type:
crontab crontabNow, every minute the update.sh script is executed, and every hour RRD-alarm is launched.