December 2004 - Test - lists.nanog.org

RE: Enterprise syslog management and alert generation.
by Chad Skidmore 08 Dec '04

08 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Posted At: Tuesday, December 07, 2004 11:07 PM > Posted To: NANOG > Conversation: Enterprise syslog management and alert generation. > Subject: Re: Enterprise syslog management and alert generation. > > The X over time is a new one, it's been mentioned a couple > times today, and I can certainly account for it. I've added > it to my rapidly growing list. > > - billn > > As a current Netcool user that is one of several things that we've really come to like with their product. As Alexi says flexability in rules is HUGE, and is one of the reasons we've been very pleased with Netcool Omnibus. If there was an open source alternative I think it would be very attractive. I would agree that the rules engine is key. Oddly enough every operator is a little different and a solid (and easy to use) rules engine can make all the difference in the world. If you can be as good as Netcool then that is pretty impressive. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. - AS12111 http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQbabgU2RUJ5udBnvEQJ9EgCfWpWU4L8cevOJLAy41dtYp0+q3uwAniE8 nqR+/s921KzHs/OkXNMdLUDn =efKB -----END PGP SIGNATURE-----

1 0

RE: Enterprise syslog management and alert generation.
by Paul Jasa 08 Dec '04

08 Dec '04

This is a topic near and dear to my heart. I've been using SEC for a while now, been very happy with it. If you like Perl and its regular expressions, SEC will do the trick. It has a very complex log correlation capabilities, and multiple action methods, strongly recommend it especially if used with syslog-ng http://sourceforge.net/projects/simple-evcorr BTW, the README and instructions on how to set it up and all the options is extremely well-written and thorough, you'll like it. pj ====================================== Paul ====================================== -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Alexei Roudnev Sent: Wednesday, December 08, 2004 12:52 AM To: Bill Nash; nanog(a)merit.edu Subject: Re: Enterprise syslog management and alert generation. In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some with simple logcheck, other with database for rules and hosts; and every time problem is the same - writing rules is 90% of the problem. But... do you have rules, such as fort example _send alert if any system began to generate 10 times logs / hour more vs. average? Or saying _single PCI ERROR on Solaris - ignore, 10 in a straight line - send warning... ----- Original Message ----- From: "Bill Nash" <billn(a)billn.net> To: <nanog(a)merit.edu> Sent: Tuesday, December 07, 2004 12:48 PM Subject: Enterprise syslog management and alert generation. > > > Some people call this 'Netcool' or products of a similiar stripe. I'm > ramping up a project to rebuild some previous work done on this front with > an open source distribution in mind (those of you on the syslog-ng list > have seen mention of it), so I'm fishing for requirements I may not have > already covered. > > I currently have: > Perl regexp engine for applied rules. > Tokenization and extraction of data from inbound syslog data. > Assigning (single|multiple) customized event handlers to rule matches > Ability to run multiple analyzers concurrently > Optional linear rule application versus weighted optimization > SQL storage of rules for centralized management and redistribution. > Fully customized alert generation. > > My current production implementation has handled over 20 gigs a day, at > peak, on a single analyzer (dual amd 2800+), using syslog-ng as a > transport mechanism (forked socket transport with local disk logging for > backup). > > Every network is different, as are particular requirements. Who's got wish > lists? I personally wouldn't mind an on-list discussion about this, as it > applies to standard operations toolsets, but if that's not kosher, feel > free to contact me off-list. > > - billn The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

1 0

Setting up DS-3 and 2 4xT1
by Joshua Brady 07 Dec '04

07 Dec '04

My apologies if some may find this a little off-topic. However, here is my issue. I need a router, which can take 2 4xT1's and a DS-3, while handing a Gbit for internal use. Now to complicate the entire situation, this needs to go into a 3 bedroom apartment, so I need to keep the power bills down if I can :) What would everyone recommend? Off-List replies are fine, I will summarize at the end. Thanks, Joshua Brady

6 5

Intelligent Automation of network tasks
by Ejay Hire 07 Dec '04

07 Dec '04

In my opinion, every network with more than a dozen or so routers needs an automated method to distribute massive configuration changes. There is a lot of fear that something will break during updates, but with some intelligence, that risk can be minimized. Related to this, here is how I distribute Bogons, cognizant of the fact that the system has to be smart enough not to break anything in the event a telnet session breaks. So, here is what I send to my routers.. No ip prefix-list bogons ip prefix-list bogon seq 1 permit 0.0.0.0/0 Ip prefix-list bogon deny 0.0.0.0/7 le 32 Ip prefix-list bogon deny 2.0.0.0/8 le 32 <snip> Ip prefix-list bogon deny 197.0.0.0/8 le 32 Ip prefix-list bogon deny 223.0.0.0/8 le 32 ip prefix-list bogon permit 0.0.0.0/0 le 27 No ip prefix-list bogon seq 1 permit 0.0.0.0/0 Worst case scenario, I break my bogon filters... and that happens very very rarely. The same logic can be applied to access-list using named access lists. Hopefully that will help someone. -ejay

4 3

RE: Intelligent Automation of network tasks
by Hannigan, Martin 07 Dec '04

07 Dec '04

Call me sentimental, but I was using/making my previous staff use rtrmon in the absence of big OSS systems. I believe it's still up at ISC somewhere. I can't remember if it has a "glob all" function. I do remember it would probably be easy enough to integrate. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Tuesday, December 07, 2004 1:54 PM > To: Ejay Hire > Cc: nanog(a)merit.edu > Subject: Re: Intelligent Automation of network tasks > > > > On Tue, Dec 07, 2004 at 12:39:25PM -0600, Ejay Hire wrote: > > > > In my opinion, every network with more than a dozen or so > routers needs > > an automated method to distribute massive configuration > changes. There > > is a lot of fear that something will break during updates, > but with some > > intelligence, that risk can be minimized. > > juniper and cisco both support taking machine generated > configurations generated by a non-router device (eg: unix host). > > http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/product s_feature_guide09186a00801d1dc2.html it's not just in 12.3T, it's also in 12.2S.. on your juniper, try something like "config, load override" - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Trojaned versions of Makelovenotspam doing the rounds ...
by suresh＠outblaze.com 07 Dec '04

07 Dec '04

What a surprise (or not!) http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/ > Virus writers have begun distributing their wares in emails that pose as > Lycos's abandoned "Make love not spam" screensaver. > > The fake screensaver emails contain an attachment with a RAR SFX archive that > has embedded key logger Trojan inside, antivirus firm Sophos warns. Infected > emails come in emails with subject lines such as "Be the first to fight spam > with Lycos screen" and an attachment called "Lycos screensaver to fight > spam.zip". > > Upon successful installation, the key logging Trojan (Mdropper-IT) sends a > message to an Indonesian email address confirming its status. The screensaver > file, rather than displaying the Lycos screensaver, displays a blank screen. [snip]

1 0

Remote sites, aggregates and more-specific routes
by Sam Stickland 07 Dec '04

07 Dec '04

Hi, We currently announce our entire range as the largest possible aggregates. We are about to add the first site that's a sizable distance away. The link to the remote site is relatively expensive, so we don't want to have to backhaul traffic between the sites if we can help it. We seem to have the following options available: 1) Announce the greater aggregate at both ends, and risk having to haul traffic between the sites ourselves. 2) Deaggregate our ranges completely. I don't particulary want to do this, since the predicted 80/20 split in IP address usage across the sites will create a quite a few new routes in the ever growing table. 3) Only announce more-specifics at the remote site, and tag the more specific routes NO-EXPORT if we peer with the AS in both locations. Am I right in thinking that #3 seems is the best option? AFAICS it adds no new unnecessary routes to the global table (outside of our immediate peers and transit providers) and still keeps unneccessary traffic off of the intersite link. Are there any options I missed? Sam

1 0

RE: Unflattering comments about ISPs and DDOS
by J. Oquendo 07 Dec '04

07 Dec '04

> "reconfigure their mail programs to point at Comcast's > servers, and each phone call to the help desk costs $9." And they couldn't spend say: $1.00 per CD with a vb script or instructions on doing this $100.00 (far fetched price) to have an interactive step-by-step flash video created to show their customers $1000.00 (far fetched price) to set up some VXML based number with a "Press 1 to RTFM... Press 2 to RTFM again" Even at an uber high charge (800/866 toll) of say $4.00 per call, they could still implement the changes save tons of money, and tons of aspirin when their headaches go away. Maybe someone here can draft up a $10,000,000.00 pitch it to them become an instant millionaire and save Comcast some money at the same time. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

4 3

using sniffer on high-bandwidth pipes
by todd romero 07 Dec '04

07 Dec '04

does anyone have expirience using a sniffer on a hi-capacity network segment, that might know if there are limitations I need to worry about? example: customers doing EMC database replication across a mpls link, and when the capacity reaches aprox. 250 Mbp/s packets are arriving out of sequence etc. So we need to put sniffers on both sides to capture some data to see whats happeneing when the capacity reaches 250mbps. what kind of system requirements would be needed to be able to be able to capture that amount of data. For some reason, I dont think that the Dolch Pac 65 sniffers we have (running nt4 and sniffer pro2) would be able to handle that kind of data? If they cant, we can probbaly use a sun box. what kind of specs would the box need? tia, tr

8 7

Neutral Colo - Las Vegas, NV
by Charlie Khanna - NextWeb 07 Dec '04

07 Dec '04

Hi, Can anyone tell me if there are any carrier neutral data centers in Las Vegas, NV? Thanks. -Charlie

1 0