myITforum.com : An excellent way to capture network statistics, for free

I have used HP Openview and Compaq Insight Manager for years. However, recently I stumbled across a wonderful product, which allows a systems administrator to capture statistics from just about anything he or she can imagine. What is this magical product? Multi-Router Traffic Grapher. MRTG, as it is most often called, uses SNMP to poll machines or devices to gather information into a database. This information can then be used to create web pages with graphs displaying daily, weekly, and monthly performance trends.

This package has several great features:

It does not require any foreign agents be installed on the managed machine
Only requirements are OID, SNMP, and a machine to run the package and store the database
It is extremely customizable and flexible
SNMP v1 and v2 mibs supported
Unix and Windows Versions

With the good there is always a little bad:

Documentation is limited and cryptic
SNMP support for Microsoft is a pain (this is not the fault of this package, see Microsoft for complaints)
Tons of files to manage (proper setup helps a great deal)

Over the next several weeks I will provide lots of information on how you can setup MRTG to monitor just about anything on your servers, switches, routers, print servers, and even weather trending.

Installation

Setting up MRTG is straightforward. From the MRTG website, you can download the latest release of the package for your OS of choice. http://people.ee.ethz.ch/~oetiker/webtools/mrtg/. The latest version is version 2.9.21. Uncompress the files to a folder on your local hard drive. MRTG recommends <localdrive>\mrtg-2.9.21.

Next you need to download Perl version 5.005 or better still version 5.6 and install it. http://www.activestate.com/Products/Download/Register.plex?id=ASPNPerl&a=e

Output Data
The installation instructions recommend the folder <localdrive>\www\mrtg for output files if you are using Windows with IIS and plan on running MRTG from the machine that will serve the pages. Create a folder under <localdrive>\InetPub\wwwroot called MRTG. Under the MRTG folder at the very minimum create an Images and a Logs folder.

For my network, I have created the following tree.

Under the MRTG folder, I have a folder for Switches, Routers, Printers and Servers. Under the Switches folders I have a folder for the octet representing the subnets. Within each of these folders I have created a folder called Logs and Images. When I setup my scripts. I use the following convention (the below is for a server in Atlanta):


<snip>
Htmldir: d:\InetPub\wwwroot\MRTG\Servers\Atlanta
ImageDir: d:\InetPub\wwwroot\MRTG\Servers\Atlanta\Images
LogDir: d:\InetPub\wwwroot\MRTG\Servers\Atlanta\Logs
IconDir: ./../Icons
<snip>

Once you have the foundation set up, you are ready to move on. Rest assured that no matter what structure you decide to create in the beginning you will change it several times before you are completely happy. The above will just assist you in getting started.

Server Setup
For a server you wish to manage, install SNMP. Next configure the AGENT, TRAPS and Security settings.

Add some contact information for this server, specify the location or contact number and choose which Services you wish to offer.

Under TRAPS, specify a community name, add it to the list then specify the server to act as a trap destination.

Now setup the community strings. Additionally, you may specify what hosts this server will accept SNMP packets from. I generally fill this box with my workstation, the MRTG server and SNMP server. The reason I use my workstation is because I have a second copy of MRTG running on my workstation where I build the configs. Once they are working, I move them to the production server.

With all of this set up, we are not quite ready to take our cool new toy for a ride. Under the <localdrive>\mrtg-2.9.21\bin folder create a new folder called output or configs (or what every you desire).

Once this is done, you will need to drop to a DOS prompt and change to your MRTG\BIN folder. From that folder run the following command.

From here forward I will use the following conventions:

Communityname= public
IPAddress = 10.10.10.10
.\configs\ = the assumed output folder under MRTG\BIN

perl cfgmaker public 10.10.10.10 --output .\configs\FileName.cfg

This should create a file similar to the following:


#------------------------------------------------------------------------------------------------
# Created by 
# cfgmaker tsolsnmp@10.10.10.10 --no-down --output .\configs\10.10.10.10.cfg

### Global Config Options

#  for UNIX
# WorkDir: /home/http/mrtg

#  or for NT
# WorkDir: c:\mrtgdata

### Global Defaults

#  to get bits instead of bytes and graphs growing to the right
# Options[_]: growright, bits

######################################################################
# System: PRINTSERVER1
# Description: Hardware: x86 Family 6 Model 7 Stepping 3  
#Software: Windows 2000 (Build 2195 Uniprocessor Free)
######################################################################

### Interface 1 >> Descr: 'MS TCP Loopback interface ' | Name: '' | Ip: '127.0.0.1' | Eth: '' ###
### The following interface is commented out because:
### * it is a Software Loopback interface
# 
# Target[10.10.10.10_1]: 1:public@10.10.10.10:
# MaxBytes[10.10.10.10_1]: 1250000
# Title[10.10.10.10_1]: Traffic Analysis for 1 -- PRINTSERVER1
# PageTop[10.10.10.10_1]: <H1>Traffic Analysis for 1 -- PRINTSERVER1</H1>
#  <TABLE>
#    <TR><TD>System:</TD>     <TD>PRINTSERVER1 in Corporate Ridge 644-0521</TD></TR>
#    <TR><TD>Maintainer:</TD> <TD>Brian Sorrells</TD></TR>
#    <TR><TD>Description:</TD><TD>MS TCP Loopback interface   </TD></TR>
#    <TR><TD>ifType:</TD>     <TD>softwareLoopback (24)</TD></TR>
#    <TR><TD>ifName:</TD>     <TD></TD></TR>
#    <TR><TD>Max Speed:</TD>  <TD>1250.0 kBytes/s</TD></TR>
#    <TR><TD>Ip:</TD>         <TD>127.0.0.1 (basorrells.domain.corp)</TD></TR>
#  </TABLE>


### Interface 2 >> Descr: 'Compaq NetFlex-3 Driver
Target[10.10.10.10_2]: 2:public@10.10.10.10:
MaxBytes[10.10.10.10_2]: 12500000
Title[10.10.10.10_2]: Traffic Analysis for 2 -- PRINTSERVER1
PageTop[10.10.10.10_2]: <H1>Traffic Analysis for 2 -- PRINTSERVER1</H1>
 <TABLE>
   <TR><TD>System:</TD>     <TD>PRINTSERVER1 in Corporate Ridge 644-0521</TD></TR>
   <TR><TD>Maintainer:</TD> <TD>Brian Sorrells</TD></TR>
   <TR><TD>Description:</TD><TD>Compaq NetFlex-3 Driver, Version 5.0.1.18</TD></TR>
   <TR><TD>ifType:</TD>     <TD>ethernetCsmacd (6)</TD></TR>
   <TR><TD>ifName:</TD>     <TD></TD></TR>
   <TR><TD>Max Speed:</TD><TD>12.5 MBytes/s</TD></TR>
   <TR><TD>Ip:</TD>         <TD>10.10.10.10 PRINTSERVER1.domain.corp)</TD></TR>
 </TABLE>
#------------------------------------------------------------------------------------------------

What you have just captured is the network card and loopback interfaces for the 10.10.10.10 device.

If you had run the configmaker against a switch with SNMP installed, you would have gotten a config similar to the following:


# Created by 
# cfgmaker public@10.10.10.10 --no-down --output .\configs\10.10.10.10.cfg
### Global Config Options
#  for UNIX
# WorkDir: /home/http/mrtg
#  or for NT
# WorkDir: c:\mrtgdata
### Global Defaults
#  to get bits instead of bytes and graphs growing to the right
# Options[_]: growright, bits

######################################################################
# System: 
# Description: BayStack 450-24T HW:RevD  FW:V1.33 SW:v1.2.0.11
# Contact: 
# Location: 
######################################################################

### Interface 1 >> Descr: 'BayStack 450-24T - 1' 
Target[10.10.10.10_1]: 1:public@10.10.10.10:
MaxBytes[10.10.10.10_1]: 25000000
Title[10.10.10.10_1]: Traffic Analysis for 1 -- 
PageTop[10.10.10.10_1]: <H1>Traffic Analysis for 1 -- </H1>
 <TABLE>
   <TR><TD>System:</TD>     <TD> in </TD></TR>
   <TR><TD>Maintainer:</TD> <TD></TD></TR>
   <TR><TD>Description:</TD><TD>BayStack 450-24T - 1  </TD></TR>
   <TR><TD>ifType:</TD>     <TD>ethernetCsmacd (6)</TD></TR>
   <TR><TD>ifName:</TD>     <TD></TD></TR>
   <TR><TD>Max Speed:</TD>  <TD>25.0 MBytes/s</TD></TR>
   <TR><TD>Ip:</TD>         <TD>10.10.10.10 ()</TD></TR>
 </TABLE>

### Interface 2 >> Descr: 'BayStack 450-24T - 2' | Name: '' | Ip: '' | Eth: '' ###

Target[10.10.10.10_2]: 2:public@10.10.10.10:
MaxBytes[10.10.10.10_2]: 25000000
Title[10.10.10.10_2]: Traffic Analysis for 2 -- 
PageTop[10.10.10.10_2]: <H1>Traffic Analysis for 2 -- </H1>
 <TABLE>
   <TR><TD>System:</TD>     <TD> in </TD></TR>
   <TR><TD>Maintainer:</TD> <TD></TD></TR>
   <TR><TD>Description:</TD><TD>BayStack 450-24T - 2  </TD></TR>
   <TR><TD>ifType:</TD>     <TD>ethernetCsmacd (6)</TD></TR>
   <TR><TD>ifName:</TD>     <TD></TD></TR>
   <TR><TD>Max Speed:</TD>  <TD>25.0 MBytes/s</TD></TR>
 </TABLE>
<Snipped>

The config would have continued for every interface on the switch. I only kept enough to provide a general idea. The complete config can be found here. 659310.10.10.10.cfg

Once you have created the configs for your switches, you will want to modify the header of the file to point to where you want everything stored and to change the general setup of the output files.

At a minimum, I add the following:


Wrkdir: d:\www\mrtg
#Htmldir: d:\InetPub\wwwroot\MRTG\Switches\104-X
#ImageDir: d:\InetPub\wwwroot\MRTG\Switches\104-X\Images
#LogDir: d:\InetPub\wwwroot\MRTG\Switches\104-X\Logs
#IconDir: ./../Icons

The # sign at the beginning of a line makes anything after it a comment. The first line is my working folder. When working with the configs, I like to export everything to a folder that is quick and easy to delete. Once I have the config working, I comment out that line and remove the # from in front of the next four lines.

HTMLdir is the where the HTML files will be stored
ImageDir is where the .png files will be stored
LogDir is where the .log and .old files are stored
IconDir is where you store company logos, MRTG logos, etc

With the config build and a header in place, you are now ready to produce your first html pages.

From the DOS prompt MRTG\BIN folder type the following:

Perl mrtg .\configs\10.10.10.10.cfg

Depending on where you specified your working directory, several files will be created. MRTG is pretty good about telling you where and what type of errors are in a file it there are any.

Assuming no errors, wait a minute or two and run the same command again. Now looking at the HTML file in that folder should have produced the start of a graph. If there is nothing in your graph, review the .log file for content. If everything in the second column is a zero, then the interface is down, or no traffic is being generated. Find a device with traffic and try it again.

In the next couple of days, I will provide additional details regarding configs and how to monitor and manage Windows servers.

Additionally, here is a sample config I use as a template for my switches.
6592X.X.X.X.CFG


		myITforum.com ©2010 \| Legal \| Privacy