Just curious, what kind of commercial/opensource software do you use for syslog analysis and alerting? I also run syslog-ng and have some filters written to ignore some of the more mundane syslog messages. Also have swatch half implemented and semi working, but I'm looking for a cleaner, and more manageable tool for syslog based alerting. On Fri, 2004-09-17 at 03:53, Alexei Roudnev wrote:

I always tried to avoid any deal with SNMP TRAPS as most unreliable and unconvenient way of alerting (unfortunately, it can not be avoided totally). We use 'syslog' (syslog-ng + home written syslog analyzers + copmmercial soft, sometimes) when possible.

----- Original Message ----- From: "Michael Smith" <mksmith@noanet.net> To: <nanog@merit.edu> Sent: Wednesday, September 15, 2004 9:10 AM Subject: RE: Open-Source Network Management Tools

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

...

I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well.

...

Recommendations?

Thanks.

I'd like to expand the question by asking, what Open-Source applications do people use for SNMP Trap collecting and alarming? We're very happy with Nagios for polling, but we have a lot of optical components that send information via Traps that then needs to be culled, trimmed and analyzed.

Thanks,

Mike

-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3

iQA/AwUBQUhq+Zzgx7Y34AxGEQJP6gCgh1KW5vvq2fRh4WBSik1Q7Ay31okAoIAh ZKUgPFi9PZhDpOGIAXXOIY9W =oD9A -----END PGP SIGNATURE-----

Nothing good exists (I tried all opensource I could find). We are developing (improving) our scripts, and I hope to make it the same quality as CCR or snmpstat and post on the sourceforge, but now it is just set of scripts - on one server, and MySQL database + set of scripts - on another, without documentatikn etc. Problem is that it should not be simple filterts; system should: - assign recipients to the host; - allow user to set up temporary BLACK and WHILE filters; - send alert first time, when it see something, and do not send it if messages are repeated (until time expired or number of messages will be to great); - allows filkters such as _too many messages of this kind_ or _logfile size too big_; - etc etc. We have CA (99% junk!) and tried ProactiveNetwork (very good, but syslog and eventlog analizers are still very primitive). I do not need software _write your own filters_, I need written filters, it is difference. (Anyway, we post all syslogs on monitoring web, in a few groups: - all todays messages in a big heap; - access logs; - errors; - logs per host; all logs are saved separately for every date (we generate web links every night, so making unnecessary file rotation) and are gzipped after some time. As a result, I have ull 2 years history of syslog on the web, easy to analyze, and have 'search' script allowing to find anything. ----- Original Message ----- From: "Chris Allermann" <callermann@warpdrive.net> To: <nanog@merit.edu> Sent: Friday, September 17, 2004 6:25 AM Subject: Re: Open-Source Network Management Tools

Just curious, what kind of commercial/opensource software do you use for syslog analysis and alerting?

I also run syslog-ng and have some filters written to ignore some of the more mundane syslog messages. Also have swatch half implemented and semi working, but I'm looking for a cleaner, and more manageable tool for syslog based alerting.

On Fri, 2004-09-17 at 03:53, Alexei Roudnev wrote:

...

I always tried to avoid any deal with SNMP TRAPS as most unreliable and unconvenient way of alerting (unfortunately, it can not be avoided

totally).

...

We use 'syslog' (syslog-ng + home written syslog analyzers + copmmercial soft, sometimes) when possible.

----- Original Message ----- From: "Michael Smith" <mksmith@noanet.net> To: <nanog@merit.edu> Sent: Wednesday, September 15, 2004 9:10 AM Subject: RE: Open-Source Network Management Tools

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

...

I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well.

...

Recommendations?

Thanks.

I'd like to expand the question by asking, what Open-Source applications do people use for SNMP Trap collecting and alarming? We're very happy with Nagios for polling, but we have a lot of optical components that send information via Traps that then needs to be culled, trimmed and analyzed.

Thanks,

Mike

-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3

iQA/AwUBQUhq+Zzgx7Y34AxGEQJP6gCgh1KW5vvq2fRh4WBSik1Q7Ay31okAoIAh ZKUgPFi9PZhDpOGIAXXOIY9W =oD9A -----END PGP SIGNATURE-----

Syslog is a text protocol, so system developer can always write any message. SNMPTRAP is '1.2.3.4.5.6.7.8 'something happen blablabla' type of messages. They are the same in other properties, I do agree - that;s why we detect everything we can by 'polling'. There are many tools, converting one to another, so take it easy -:). ----- Original Message ----- From: "Christian Kuhtz" <christian.kuhtz@BELLSOUTH.COM> To: "Alexei Roudnev" <alex@relcom.net>; "Michael Smith" <mksmith@noanet.net>; <nanog@merit.edu> Sent: Friday, September 17, 2004 6:32 AM Subject: Re: Open-Source Network Management Tools What makes syslog so much more reliable in your opinion? There's no ability to find lost messages or have guaranteed delivery. At least not on 514/udp. If you can toss a trap, you can toss a syslog message. That is, unless I've lost my mind this morning and need to go get more coffee. On 9/17/04 3:53 AM, "Alexei Roudnev" <alex@relcom.net> wrote:

I always tried to avoid any deal with SNMP TRAPS as most unreliable and unconvenient way of alerting (unfortunately, it can not be avoided

totally).

We use 'syslog' (syslog-ng + home written syslog analyzers + copmmercial soft, sometimes) when possible.

----- Original Message ----- From: "Michael Smith" <mksmith@noanet.net> To: <nanog@merit.edu> Sent: Wednesday, September 15, 2004 9:10 AM Subject: RE: Open-Source Network Management Tools

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

...

I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well.

...

Recommendations?

Thanks.

I'd like to expand the question by asking, what Open-Source applications do people use for SNMP Trap collecting and alarming? We're very happy with Nagios for polling, but we have a lot of optical components that send information via Traps that then needs to be culled, trimmed and analyzed.

Thanks,

Mike

-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3

iQA/AwUBQUhq+Zzgx7Y34AxGEQJP6gCgh1KW5vvq2fRh4WBSik1Q7Ay31okAoIAh ZKUgPFi9PZhDpOGIAXXOIY9W =oD9A -----END PGP SIGNATURE-----

***** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 113