ISPPlanet Network Management System Series - ipMonitor

Using Monitors To Watch Your Network

In fact, ipMonitor's strength is its ability to employ a diverse set of monitoring techniques (right). ipMonitor can "ping" devices to check reachability. It can scan standard ports like SSL, LDAP, DNS, SMTP, IRC, and RADIUS; a missing listening port is a good indication that a service has gone unavailable. But ipMonitor doesn't stop there— it understands protocols like HTTP, POP, DNS, FTP, IMAP, and SQL and employs "QA" monitoring techniques that exercise application functionality (e.g., resolve a domain name, retrieve a file through FTP, log into a mail server). ipMonitor also understands the NT environment—it can sift through NT event logs, access ODBC databases, monitor drive space, and check NT service status. It can also poll with SNMP GET and receive SNMP traps.

Configuring ipMonitor is largely a matter of creating new Monitors: supply a name, select the monitor type, specify generic parameters (e.g., polling frequency, failures before status change, when to suspend for routine maintenance) and set a few type-specific parameters (e.g., the hostname and filename checked by an FTP QA monitor). We created a wide variety of Monitors during our evaluation. A few examples:

•	To scan an uncommon port (port 102 used by RFC 1006), we created a TELNET OR UNKNOWN Monitor. Although the name is misleading, this type of Monitor can be used to scan any UDP or TCP port.
•	To keeps tabs on available disk space, we created a DRIVE SPACE (right) Monitor. Under NT, this reports the capacity of the entire drive on which a share is located, failing when total drive usage exceeds a specified limit.
•	To poll MIB variables, we created a QA SNMP (right) Monitor. This can be used to compare SNMP GET results for a specified object against an absolute value or the value retrieved by the last poll. ipMonitor has limited support for ASN types and expects you to supply the object ID. SNMP polling can detect error or utilization spikes on routers and other network devices that speak SNMP, but ipMonitor does not support ad hoc queries or MIB browsing.
•	To measure web server response time on a regular basis, we created a QA HTTP (right) Monitor. But we were only able to do so with an NT server because SMB access is required to validate page content against HTTP results. This Monitor will increment hit count unless the web server is instrumented to ignore hits from ipMonitor. If this is an issue for you, check a test-only page.
•	To verify URLs on our RedHat Apache web server, we created a QA LINK Monitor. Parameters can be specified to include or exclude links to be checked. Results are returned for every URL, and the Monitor is considered to have failed if any URL is broken.
•	We had no luck creating a QA SQL Monitor. It turns out that this Monitor type requires SQL drivers on the ipMonitor system as well as the system to be monitored.
•	To listen to incoming SNMP traps, we created a QA TRAP [link to img/exmon-trap.gif] Monitor. Unlike others, this Monitor is passive. Arriving traps can be filtered by source IP address, community string, trap type, and object within enterprise traps. Initially we were unable to trigger this Monitor; we reported the problem and found it fixed in this month's update v6.05.

 

If you plan to check eighteen services on the same device, you'll need to create eighteen Monitors. Multiply by the number of devices in your network and this gets tedious quickly. That's where Add Network comes in (left).

ipMonitor provides portscan-based network discovery. Given a Class C (or half C) subnet or host address, ipMonitor will scan ports, describe what it finds, and offer to create a matching set of Monitors. Parameters can be used to limit ports scanned, proposed Monitors can be selectively eliminated, and Monitors that would duplicate existing Monitors can be ignored. We could quibble—accept a mask instead of assuming Class C! But Add Network is a quick, easy way to populate Monitors.

Pt. 1: Getting Started / Initial Config.	Pt. 3: Using Groups / Responding to Trouble
Pt. 2: Using Monitors	Pt. 4: Scheduled Jobs / NT / Status / Final Words