Introduction to open-source monitoring tools

Declaration: A Brief Introduction to MRTG, cacti, nagios, ntop, and zabbix functions and advantages and disadvantages. Refer to some articles on the Internet and other blogs, including image cutting, I just made a porter myself. It is not completely original. I would like to pay tribute to all my friends who have learned the excerpt!

MRTG: MRTG is developed using perl. It uses SNMP Protocol to implement communication between management workstation and device agent processes, so as to monitor device management and running status. The MRTG installation and configuration are simple and the graphic interface is intuitive, because it was widely favored by network administrators at that time.

Disadvantages of MRTG: 1. text-based databases and data cannot be reused

2. data can only be viewed by day, week, month, or year

3. Only two DS (one line and one block) can be drawn)

4. A graph must be drawn every time data is retrieved, which wastes system resources.

5. No Management Function

RRDtool: In view of the shortcomings of MRTG, the author of MRTG developed rrdtool to replace MRTG. This software is a powerful drawing engine, and many languages can call rrdtool for drawing.

(Round robin database ):

Official Address: http://oss.oetiker.ch/rrdtool/

Some database tools created by Tobi Oetiker. He is also designed to process time series data such as bandwidth, temperature, CPU load, etc. This data is stored in some column databases, so the system storage footprint is sufficient to continue

Advantages: 1. rrdtool is a data recorder with excellent performance and a powerful drawing engine.

2. It uses the rrd data storage format and the data used can be reused;

3. In terms of plotting, it can define any time period for plotting and draw multiple DS instances.

Disadvantages: 1. Although powerful data storage and drawing functions are provided, rrdtool does not provide data collection functions similar to those integrated in MRTG;

2. At the same time, it provides too many parameters, which makes it inconvenient to use on the command line interface;

3. In addition, rrdtool does not provide management functions.

 

Cacti (cactus ):Http://www.cacti.net/

1. Cacti is a forefront of rrdtool. It has built-in quick data acquisition tools, excellent drawing templates, and many well-designed data acquisition scripts, this allows you to easily draw trend diagrams of host load, network traffic, and other information by combining the powerful data capture, data storage, and drawing functions of rrdtool.

2. cacti is a software implemented in php. Its operation requires the support of website servers (such as apache) and PHP environments. At the same time, cacti also requires Mysql to work with PHP programs to store some variable data and call the variable data, such as host name, Host ip address, snmp group name, port number, template information, and other variables.

3. The statistics of host load and network traffic by rrdtool must be achieved through the SNMP protocol. The data captured by SNMP is stored in rrd files generated by rrdtool, which are usually located in the rra directory of cacti. Rrdtool processes rrd files for data update and storage, and rrd files are static Archive files (Round Robin Archive ), the number of data records it can store has been defined at the time of creation.

4. A graphic analysis tool for continuous traffic monitoring developed based on PHP, mysql, snmp (UDP: 161), and rrdtool

Cacti Working principle:

Cacti instance application

--- Network settings

--- Host system

(1) network interface traffic (inbound and outbound bandwidth)

(2) monitor CPU load, memory, and so on

(3) Monitoring disk space, number of processes, and so on

--- Common monitoring objects of cacti

(1) server resources: CPU, memory, disk, process, connections, etc.

(2) server types: WEB, Mail, FTP, database, middleware, etc.

(3) Network Interfaces: traffic, forwarding speed, and Packet Loss Rate

(4) network device performance, configuration files (comparison and backup), and number of routes

(5) Security Device Performance, connections, and attacks

(6) device running status: fan, power supply, temperature

(7) data center operating environment: current, voltage, temperature and humidity

 

Nagios Introduction: Chinese support: Tian Chaoyang

Nagios is an application for system and network monitoring and complies with the GPL protocol. It monitors hosts and services under the conditions you set, and provides alarm information when the status gets worse and better.

Nagios was initially designed to run on a Linux system, but it can also run on Unix-like systems and has a C-language compiler. The program topic is ansi c.

Further features of Nagios include:

1. Monitor network services (SMTP, POP3, HTTP, NNTP, PING, etc );

2. Monitor host resources (processor load, disk utilization, etc );

3. A simple plug-in design allows you to easily expand your service detection methods;

4. Parallel service check mechanism;

5. Have the ability to define the network hierarchy. Use the "parent" host definition to express the relationship between network hosts. This relationship can be used to discover and clarify host downtime or inaccessibility;

6. When a service or host problem occurs or is resolved, the alarm is sent to the contact (via EMail, SMS, or user-defined method );

7. You can define the event handle function to locate more problems when a host or service event occurs;

8. Automatic Log rollback;

9. Support and monitor the redundancy of hosts;

10. An optional WEB interface is used to view the current network status, notification and fault history, and log files.

Composition:

Nagios generally consists of a main program (Nagios), a plug-in program (Nagios-plugins), and four optional ADDON (NRPE, NSCA, NSClient ++, and NDOUtils. Nagios monitoring is implemented through plug-ins. Therefore, Nagios and Nagios-plugins are necessary components for server work. Among the four ADDON

(1) NRPE: it is used to execute script INS on the monitored remote Linux/Unix hosts to monitor these host resources.

(2) NSCA: used to allow the monitored remote Linux/Unix host to actively send monitoring information to the Nagios server (this is especially used in redundant monitoring mode)

(3) NSClient ++: used to monitor components installed on Windows Hosts

(4) NDOUtils: used to store the configuration information of Nagios and the data generated by each event to the database for fast retrieval and processing of the data.

In the four ADDON types, NRPE and NSClient ++ work on the client, NDOUtils work on the server, and NSCA must be installed on both the server and client.

 

NTOP introduction:

1. MRTG obtains information based on SNMP. For port traffic, MRTG can provide accurate statistics, but the information above Layer 3 cannot be known. This is the strength of NTOP. NTOP can display the network usage and network bandwidth usage details of each node computer more intuitively. NTOP is a network sniffer which plays an irreplaceable role in monitoring network data transmission and troubleshooting. You can analyze network traffic to identify various problems on the network, such as the bottleneck effect or performance degradation. You can also determine whether a hacker is attacking the network system. If it is suspected that the network is under attack, the packets intercepted by the sniffer can determine what type of packets are being attacked and their sources, so as to respond in a timely manner, or adjust the network to ensure the efficiency and security of network operation.

II. through NTOP, managers can also easily determine which traffic belongs to a specific network protocol, which host accounts for the main traffic, which host is the target of each communication, and the packet sending time, the interval of data packet transmission between hosts. This information provides valuable information for network administrators to determine network problems and optimize network performance.

NTOP provides the following features:

① Automatically identifies useful information from the network;

② Convert intercepted data packets into a format that is easy to recognize;

③ Analyze communication failures in the network environment;

④ Detect communication bottlenecks in the network environment;

⑤ Record the network communication time and process;

⑥ Automatically identifies the operating system in use by the client;

7. You can run it in command line or Web.

We can see the difference between ntop as a monitoring tool and cacti and nagios. In terms of monitoring, ntop is to analyze network traffic to identify various problems on the network, to put it bluntly, it is similar to a packet capture monitoring tool, but more functions are achieved through inductive plotting.

 

Zabbix: Distributed System Monitoring

Official homepage: http://www.zabbix.com/

Information about zabbix is being reviewed and will be sent later