IPDR Watchdog
What is the use of this tool ?
Real time IPDR monitoring system that alerts when IPDR is down by sending email and syslog.
How it works ?
- First it checks the Hub-config file present or not
- Then it get the location of the log file from Hub-config.xml file
- After getting the location of the file it checks it can open a log file without any permisssion error
- Also it get the timestamp of latest log entry and compares with the system time to know the log file is latest
- Then it checks the current log file is new or not.If new then it not checks because the log entries will not be completed yet
- You can run this script for netflow as well as tap mode. You have to provide this in argument
- It checks each engine is flushing or not by fetching each engine log entries and checks the flush is not empty
- If the system is down you receive an alert , likewise if the system is up from down status you will receive an alert
- The script deliver the alert log to the syslog . You have to configure the email to receive mail.
Procedure before running the script
- Login as admin and go to (profile0 –> email config)
- Configure email on trisul server
- Start the email notification
- Configure alert whom you want to send mail
- Go to profile0 → All groups alert → and click edit option → change Send to Syslog/Email to Alert
- Log into trisul server and assign a cronjob to run ipdr_watchdog script or you can run manually.
Run cronjob as root user
Options
| Option | Default value | Info |
|---|---|---|
| -n | 2 | No of Engines |
| -c | context0 | Context Name |
| -s | Hostname of your system | Sytem Name |
| -k | 0 | Verbose |
| -t | 70 | Fixed seconds |
| -r | 0 | Router |
| -f | 1 | Flow |
If the trisul is running in netflow mode then run the script with -f option or -r option if it is running with tap mode
The verbose argument will send syslog if the system is running . But doesn't send mail
Examples Using cronjob
* /10* * * * /usr/local/share/trisul-hub/ipdr_watchdog.sh
When the IPDR down you get this type of syslog
May 9 05:55:01 IPDR-TESTING trisul_flushd: Alert:probe0:context0:1715234100:0,0,0,0,0,IPDRUP:mailsubject:Trisul IPDR Alert System DOWN IPDR TESTING:mailsubjectUser ,Last flush time : (Thu May 9 05:55:00 AM UTC 2024)
When you assign a cronjob with -k argument you will get this syslog if the system is running
May 9 07:12:01 IPDR-TESTING infod: IPDR-TESTING RUNNING
When your system is started after the down stauts you will get this syslog
May 9 05:55:01 IPDR-TESTING trisul_flushd: Alert:probe0:context0:1715234100:0,0,0,0,0,IPDRUP:mailsubject:Trisul IPDR Alert System UP IPDR TESTING:mailsubjectUser ,Last flush time : (Thu May 9 05:55:00 AM UTC 2024)
When you start the IPDR system after the IPDR-DOWN then you will be notified through mail that IPDR is up
Examples without using cronjob
/usr/local/share/trisul-hub/ipdr_watchdog.sh /ipdr_watchdog.sh
