NETWORK MONITORING APPLICATION USING NAGIOS A LINUX BASED SOFTWARE FADLANSHAH BIN HAMZAN UNIVERSITI TEKNOLOGI MALAYSIA

Transcription

1 NETWORK MONITORING APPLICATION USING NAGIOS A LINUX BASED SOFTWARE FADLANSHAH BIN HAMZAN UNIVERSITI TEKNOLOGI MALAYSIA

2 UNIVERSITI TEKNOLOGI MALAYSIA PSZ 19:16 (Pind. 1/97) BORANG PENGESAHAN STATUS TESIS JUDUL: NETWORK MONITORING APPLICATION USING NAGIOS A LINUX BASED SOFTWARE Saya: FADLANSHAH BIN HAMZAN SESI PENGAJIAN: 2006/ (HURUF BESAR) mengaku membenarkan tesis ini disimpan di Perpustakaan Universiti Teknologi Malaysia dengan syarat-syarat kegunaan seperti berikut : 1. Hakmilik tesis adalah dibawah nama penulis melainkan penulisan sebagai projek bersama dan dibiayai oleh UTM, hakmiliknya adalah kepunyaan UTM. 2. Naskah salinan di dalam bentuk kertas atau mikro hanya boleh dibuat dengan kebenaran bertulis daripada penulis. 3. Perpustakaan Universiti Teknologi Malaysia dibenarkan membuat salinan untuk tujuan pengajian mereka. 4. Tesis hanya boleh diterbitkan dengan kebenaran penulis. Bayaran royalti adalah mengikut kadar yang dipersetujui kelak. 5.*Saya membenarkan/tidak membenarkan Perpustakaan membuat salinan tesis ini sebagai bahan pertukaran di antara institusi pengajian tinggi. 6. **Sila tandakan ( ) SULIT (Mengandungi maklumat yang berdarjah keselamatan atau kepentinganmalaysia seperti yang termaktub di dalam AKTA RAHSIA RASMI 1972) TERHAD (Mengandungi maklumat TERHAD yang telah ditentukan oleh organisasi/ badan di mana penyelidikan dijalankan) TIDAK TERHAD Disahkan oleh (TANDATANGAN PENULIS) Alamat Tetap: 16, JALAN JEJALA SATU, 8/11A, SECTION 8, SHAH ALAM, SELANGOR (TANDATANGAN PENYELIA) EN. ALIAS BIN MOHD (NAMAPENYELIA) Tarikh :NOVEMBER 2006 Tarikh : NOVEMBER 2006 CATATAN: * Potong yang tidak berkenaan. ** Jika Tesis ini SULIT atau TERHAD, sila lampirkan surat daripada pihak berkuasa/organisasi berkenaan dengan menyatakan sekali tempoh tesis ini perlu dikelaskan sebagai SULIT atau TERHAD.

3 "I declare that I have read this thesis and in my opinion, it is suitable in term of scope and quality for the purpose of awarding a Degree of Bachelor of Electrical Engineering (Telecommunication) Signature : Name of Supervisor : EN. ALIAS BIN MOHD. Date : November 2006

4 i NETWORK MONITORING APPLICATION USING NAGIOS A LINUX BASED SOFTWARE FADLANSHAH BIN HAMZAN This thesis is submitted in partial fulfillment of the requirements for the award of the Degree in Bachelor of Electrical Engineering (Telecommunications) Faculty of Electrical Engineering Universiti Teknologi Malaysia NOVEMBER 2006

5 ii DECLARATION "I hereby declared that this thesis titled Network Monitoring Application Using Nagios a Linux Based Software' is the result of my own effort and materials which are not the efforts of my own works have been clearly acknowledged". Signature : Name of Author : FADLANSHAH BIN HAMZAN Date : NOVEMBER 2006

6 iii In loving memories of my mother, Faridah Binti Hussein and To my father, Hamzan Bin Hashim, my brother, Hasnul Ariff and my sister, Farhanah

7 iv ACKNOWLEDGEMENT By the name of Allah Most Merciful and Gracious, Alhamdulillah, thank to Allah S.W.T for the guidance and knowledge bestowed upon me, without it I would not have been able to come this far. I would like to take this opportunity to express my deepest gratitude to my project supervisor, En. Alias Bin Mohd for his advice and guidance throughout the three semester period when this project took place. My utmost thanks also go to my family, especially my parents to whom I owe my love and gratitude. Thanks to all staffs at Computer Systems Laboratory for giving me full cooperation. I also would like to express my gratitude to my friends, Azhar Bin Zulkifly and Nor Irfan Arjunawanto Mohd. Noor for their helps and advices throughout the project. Not forget to TNB Research Network Administrator, En. Shah Runnizam Mohd. Salleh, for teaching me how to use Linux Operating Systems. To all my friends who their name are not mentioned here that have helped and supported me along the way, I thank you from the bottom of my heart. I wish you all the best in life and hope that our friendship will last forever. Thank you.

8 v ABSTRACT The project is about developing a computer network monitoring application which is supposed to be capabled monitoring pre-defined hosts and services. As a network monitoring application, it is capable of monitoring services on Linux and Windows NT operating system. Using external plug-ins, the application can acquire a number of information from the monitored hosts and services that are pre-defined by the network administrator. Examples of services that can be monitored are HTTP web server, hard drives capacity, PING, memory usage and etc. The application can be controlled via a web browser. It will display the status of the network regarding to the hosts and services in graphical contents. To access the web browser, a login and password is required. This is for securing the critical data of the network. If a problem occurs to the services in the network, the application will alert the network administrator via . This will inform the administrator the basic details of the problem. This project use Nagios as the network monitoring application on Linux Suse 10.1 operating system.

9 vi ABSTRAK Projek ini berkisar tentang pembangunan sebuah aturcara pemantau rangkaian komputer yang mampu untuk memantau penganjur (hosts) komputer dan servis yang telah diisytiharkan. Sebagai sebuah aturcara pemantau rangkaian komputer, ia mampu untuk memantau servis yang menggunakan sistem operasi Linux dan Windows NT. Dengan menggunakan aturcara penghubung (plug-ins) luaran, aplikasi ini mampu untuk mengumpul maklumat daripada penganjur komputer dan servis yang dipantau yang sebelum ini telah disytiharkan oleh pentadbir rangkaian. Antara contoh servis yang boleh dipantau oleh aplikasi ini ialah server web HTTP, kapasiti cakera keras, PING, penggunaan ingatan dan lain-lain. Aplikasi ini boleh dikawal melalui halaman web. Ia akan memaparkan keadaan rangkaian komputer yang berkaitan dengan penganjur komputer dan servis dalam bentuk grafik. Untuk memasuki halaman ini, nama pengguna dan kata laluan diperlukan. Ini bertujuan untuk melindungi maklumat-maklumat penting bagi rangkaian komputer tersebut. Jika rangkaian tersebut bermasalah, aplikasi tersebut akan memberi amaran kepada pentadbir rangkaian melalui mel elektronik. Mel elektronik tersebut akan memberi maklumat asas tentang masalah yang dihadapi. Bagi projek ini, Nagios digunakan bersama sistem operasi Linux Suse 10.1

10 vii CONTENTS CHAPTER SUBJECT PAGE TITLE DECLARATION ACKNOWLEDGEMENT ABSTRACT ABSTRAK CONTENTS LIST OF ABBREVIATION LIST OF FIGURES LIST OF TABLES LIST OF APPENDICES i ii iv v vi vii xi xii xiv xv I INTRODUCTION Thesis Objectives Problem Statement Scope of Work 2

11 viii II LITERATURE REVIEW Nagios Nagios Plug-ins The Supported Protocols Definition of TCP/IP Transmission Control Protocol (TCP) Internet Protocol (IP) Internet Control Message Protocol (ICMP) User Datagram Protocol (UDP) Application Layer 10 III PROJECT DEVELOPMENT Introduction Developing Tools Project Methodology Installing Nagios Server and Plug-ins Setting for Nagios Graphical User Interfaces (GUI) and Password 19

12 ix Pre-defining Hosts and Services for Nagios Setting other important Nagios Configuration Files Setting for monitoring services on Windows NT Server Project Schedule Gantt Chart 26 IV RESULT AND DISCUSSION Introduction Result User and Authentication for Nagios Web Interfaces Adding Username and Password Service Details Hosts and Services Status Alert and Notification History Examples for other Web Interfaces for Nagios Nagios Alert Notification via Self Generated Report for Nagios Server Service Configurations and History Log Nagios Performance Information 44

13 x 4.3 Project Achievement Discussion Lack of knowledge in Linux Operating System environment 48 V DISCUSSION AND FUTURE CONSIDERATION Conclusion Future Consideration Using all Nagios functions Develop new Plug-ins 51 REFERENCES 52 APPENDIX A 54 APPENDIX B 58

14 xi LIST OF ABBREVIATION CGI CPU DNS FTP GUI HTTP ICMP IP NFS NRPE NSCA OS PSM RAM RIP RPM SMS SMTP SNMP SSH TCP UDP UID Computer Graphical Interfaces Central Processing Unit Domain Name Service File Transfer Protocol Graphical User Interfaces Hyper Text Transfer Protocol Internet Control Message Protocol Internet Protocol Network File System Nagios Remote Plug-ins Executor Nagios Service Check Acceptor Operating System Projek Sarjana Muda Random Access Memory Routing Information Protocol Redhat Package Management Short Message Services Simple Mail Transfer Protocol Simple Network Management Protocol Secure Shell Transmission Control Protocol User Datagram Protocol User Identification

15 xii LIST OF FIGURES FIGURE NO. TITLE PAGE Figure 1.1 Application Functioning Flow 3 Figure 2.1 The Functions of Nagios Plug-ins 5 Figure 2.2 Nagios using different testing methods for monitoring tasks 5 Figure 3.1 Project development flow 15 Figure 3.2 A Shell Konsole 16 Figure 3.3 Nagios Compilation Summary 18 Figure 3.4 nagios.conf file 20 Figure 3.5.htaccess file 20 Figure 3.6 Pre-defining hosts 21 Figure 3.7 Pre-defining HTTP and PING services for Linux Operating System 22 Figure 3.8 Pre-defining monitoring time frame for Nagios 22 Figure 3.9 Pre-defining contacts, a user which will receive an alert from Nagios (contacs.cfg) 23 Figure 3.10 Pre-defining group for contacts (contactgroups.cfg) 23 Figure 3.11 Starting NC_Net service 24 Figure 3.12 Monitoring NC_Net process 25

16 xiii Figure 4.1 Homepage for Nagios Server 28 Figure 4.2 User Authentication 29 Figure 4.3 Service Details 31 Figure 4.4 Service Status Details for down Host 32 Figure 4.5 Service Status Details for problem Service 32 Figure 4.6 Alert History 33 Figure 4.7 Contact Notification History 34 Figure 4.8 Tactical Monitoring Overview 35 Figure 4.9 Host Status Details for all Hosts Groups 35 Figure 4.10 Host State Information 36 Figure 4.11 Status Grid for all Host Groups 36 Figure 4.12 Service Overview for all Service Groups 37 Figure 4.13 Status Grid for all Service Groups 37 Figure 4.14 Alert notifications via for down Host 39 Figure 4.15 Alert notifications via for problem Service 39 Figure 4.16 Alert notifications for recovered Host 40 Figure 4.17 Alert notifications for recovered Service 40 Figure 4.18 Hostgroup Availability Report for 7 days 41 Figure 4.19 Service Availability Report for 7 days 42 Figure 4.20 Alert Summary Report for 7 days 42 Figure 4.21 Configuration Information for Host 43 Figure 4.22 History Log 44 Figure 4.23 Performance Information 45 Figure 4.24 Service Check Schedule 46 Figure 4.25 Host and Service Scheduled Downtime 47

17 xiv LIST OF TABLES TABLE NO. TITLE PAGE Table 3.1 PSM 1 Gantt chart 26 Table 3.2 PSM 2 Gantt chart 26

18 xv LIST OF APPENDICES APPENDIX TITLE PAGE APPENDIX A Object Configuration Files for Nagios 54 APPENDIX B Parameters Configuration Files for Nagios 58

19 1 CHAPTER I 1 INTRODUCTION 1.1 Thesis Objectives The first objective for this project is to develop a network monitoring application. This application will be using Linux as a platform and capable to monitor pre-defined hosts and services such as HTTP server. The second objective is to develop an application that is capable to send alert to network administrator when a problem detected in the services or hosts. The application must at least have an ability to send alert via . The third objective is to develop an application that can be access via a web browser. In the web browser, administrator can view all the current information status, historical logs and reports of the hosts and services. The log file from the monitoring process will be kept in a database and can be used for future references.

20 2 1.2 Problem Statement Nowadays, network-monitoring application is easy to acquire. This is because the application is distributed commercially around the world especially in the internet. Although it can easily to acquire, the license for the application is very expensive and come in ready-made package. Usually, small or medium size company needs a reliable network monitoring application for monitoring their small or medium scale computer network. Therefore, a cheap and reliable network monitoring application is an advantage to them. 1.3 Scope of Work The application can monitor services that support HTTP, TCP, UDP and ICMP protocols. It can be used to monitor services on Linux and Windows NT server. The types of status for services are as following: Status of the Hosts i. Pending ii. Up iii. Down iv. Unreachable Status of the Services i. Pending ii. Ok iii. Warning iv. Unknown v. Critical

21 3 In this project, Nagios, a freeware software build by Ethan Galstad is used as the core program for monitoring application. Nagios uses the plug-ins provided by the developer for the monitoring tasks. The plug-ins is very important for Nagios core program. This is because plug-ins will be the intermediate between Nagios and the hosts and services for monitoring tasks. All the hosts and services will be predefined in configuration files for starting the monitoring tasks. Nagios web interface can only be accessed and viewed via a web browser. How the Nagios core program function is shown in Figure 1.1. This application will be installed in main computer that has a network access to all service devices.

22 4 CHAPTER II 2 LITERATURE REVIEW 2.1 Nagios Nagios is a host and service monitoring application designed to inform network administrator about network problems before the clients, end-users or managers do. It has been designed to run under the Linux operating system, but works fine under most *NIX variants as well. The monitoring daemon runs intermittent checks on hosts and services that have been specified using external plug-ins that return status information to Nagios. When problems are encountered, the daemon can send notifications out to administrative contacts in a variety of different ways ( , instant message, SMS, etc.). Current status information, historical logs, and reports can be accessed via a web browser. [2] [10] Nagios Plug-ins Unlike many other monitoring tools, Nagios does not include any internal mechanisms for checking the status of services, hosts, etc. Instead, Nagios relies on external programs (called plug-ins) to do the all the monitoring work. Nagios will execute a plug-ins whenever there is a need to check a service or host that is being monitored. The plug-ins performs the check, then collects information and then simply returns the results to Nagios. Nagios will process the results that it receives

23 5 from the plug-ins and take any necessary actions (running event handlers, sending out notifications, etc). The image in Figure 2.1 show how plug-ins is separated from the core program logic in Nagios. Nagios executes the plug-ins that checks local or remote resources or services of some type. When the plug-ins has finished checking the resource or service, they simply pass the results of the check back to Nagios for processing. [10] Plug-ins Local Resource or Service Nagios Process (Core Logic) Plug-ins Remote Resource or Service Figure 2.1 The functions of Nagios Plug-ins Figure 2.2 Nagios using different testing methods for monitoring tasks

24 6 Figure 2.2 shows an overview of the various test methods supported by Nagios. The upper box with gray background marks all the components that run directly on the Nagios server machine: this includes the server itself, as well as plugins and other auxiliary tools. This unit is in contact with five clients, which are monitored in various different ways. In order to monitor the network service on the first client marked as service (starting from the left), the Nagios server runs its own plug-ins such as check_http, check_tcp, check_ping etc. For the second client it starts the middle plug-ins, check_by_ssh, in order to execute the plug-ins it really wants remotely on the client. In the third case, the plug-ins is also executed directly on the client machine, but now Nagios uses the Nagios Remote Plug-ins Executor or NRPE service, created specially for this purpose. The query is made on the Nagios side with check_nrpe. The fourth method describes the query via Simple Network Management Protocol or SNMP. For this, the client must have an SNMP agent available. Various plug-ins are available for querying data via SNMP. These four methods represent active checks, because Nagios takes the initiatives and trigger the test itself. The fifth method, in contrast, is passive. Here Nagios does nothing actively, but waits for incoming information that the client sends to the Nagios server with the program send_nsca. On the Nagios server, Nagios Service Check Acceptor, NSCA, is running as a daemon that accepts the transmitted results and forwards them to the interface for external commands. There are other ways of performing checks in addition to these. Usually a separate service is installed on the client, which is then queried by the Nagios server

25 7 via a specialized plug-ins. A typical example here is NSClient or NC_Net, which can be used to monitor Windows NT servers. The good thing about using plug-ins architecture is that Nagios can monitor just about anything that can exists in computer networking. If a network administrator can automate the process of checking something, it can be monitor with Nagios. There are already a lot of plug-ins that have been created in order to monitor basic resources such as processor load, disk usage, ping rates, etc. If there is a new service that cannot be monitored by any available plug-ins, a new plug-ins can be developed to perform this task. Therefore using plug-ins is very flexible in computer network monitoring. The only real downside to the plug-ins architecture is the fact that Nagios has absolutely no idea what a network administrator monitored. The administrator could be monitoring network traffic statistics, data error rates, room temperate, CPU voltage, fan speed, processor load, disk space etc. As such, Nagios cannot produce graphs of changes to the exact values of resources for monitored services over time. It can only track changes in the state of those resources. Only the plug-ins themselves know exactly what they are monitoring and how to perform checks. However, plugins can return optional performance data along with status information. This performance data can then be passed on to external applications that could produce graphs of service-specific information (i.e. disk space usage, processor load, etc.). [2] 2.2 The Supported Protocols Definition of TCP/IP TCP/IP refers to the suite of data communication protocols. It is an Internetbased concept and is the framework for developing a complete range of computer communications standards. TCP and IP are only two from dozens of the protocols that compose the suite. TCP/IP has been issued as Internet standards by the Internet

26 8 Architecture Board. Its name comes from two of the more important protocols in the suite: the Transmission Control Protocol (TCP) and the Internet Protocol (IP). [4] Transmission Control Protocol (TCP) Applications that require the host-to-host transport protocol to provide reliable data delivery use TCP because it verifies that data was delivered across the network accurately and in the proper sequence. TCP is a reliable, connectionoriented, byte-stream protocol. [4] Internet Protocol (IP) IP is a connectionless protocol, which means that IP does not exchange control information (called a handshake) to establish an end-to-end connection before transmitting data. IP is not only used in the end systems but also is used in router, a processor that connects two networks and whose primary function is to relay data from one network to the other on its route from the source to the destination end system. In contrast, connection-oriented protocol exchanges control information with the remote computer to verify that it is ready to receive data before sending it. When the handshaking is successful, the computers are said to have established a connection. IP relies on protocols in other layers to establish the connection if connection-oriented services are required. IP also relies on protocols in another layer to provide error detection and error recovery. Because it contains no error detection or recovery code, IP is sometimes called an unreliable protocol. [3] [4]

27 Internet Control Message Protocol (ICMP) The Internet Control Message Protocol (ICMP) is part of the internet work layer and uses the IP datagram delivery facility to send its messages. ICMP sends messages that perform the following control, error reporting, and informational functions for the TCP/IP protocol suite: Flow control. When datagram arrive too quickly for processing, the destination host or an intermediate gateway sends an ICMP source quench message back to the sender. This message instructs the source to stop sending datagram temporarily. Detect unreachable destinations. When a destination is unreachable, the computer detecting the problem sends a destination unreachable message to the datagram's source. If the unreachable destination is a network or host, the message is sent by an intermediate gateway. However, if the destination is an unreachable port, the destination host sends the message. Redirect routes. A gateway sends the ICMP redirect message to tell a host to use another gateway, presumably because the other gateway is a better choice. This message can only be used when the source host is on the same network as both gateways. Check remote hosts. A host can send the ICMP echo message to see if a remote computer's IP is up and operational. When a computer receives an echo message, it sends the same packet back to the source host. [3] [4]

28 User Datagram Protocol (UDP) The User Datagram Protocol gives application programs direct access to a datagram delivery service, like the delivery service that IP provides. This direct access allows applications to exchange messages over the network with a minimum of protocol overhead. UDP is an unreliable, connectionless datagram protocol. "Unreliable" merely means that the protocol has no technique for verifying that the data reached the other end of the network correctly. Within your computer, UDP will deliver data correctly. Why do applications programmers choose UDP as a data transport service? A number of good reasons exist. If the amount of data being transmitted is small, the overhead of creating connections and ensuring reliable delivery may be greater than the work of retransmitting the entire data set. In this case, UDP is the most efficient choice for a host-to-host transport layer protocol. Applications that fit a "query-response" model are also excellent candidates for using UDP. The response can be used as a positive acknowledgment to the query. If a response is not received within a certain time period, the application just sends another query. Still other applications provide their own techniques for reliable data delivery and do not require that service from the transport layer protocol. Imposing another layer of acknowledgment on any of these types of applications is redundant. [3] [4] Application Layer The most widely known and implemented TCP/IP application layer protocols are listed below:

29 11 File Transfer Protocol (FTP): Protocol that performs basic interactive file transfers between hosts. Telnet: Enables users to execute terminal sessions with remote hosts. Simple Mail Transfer Protocol (SMTP): Protocol for basic message delivery services. HyperText Transfer Protocol (HTTP): Protocol that supports the lowoverhead transport of files consisting of a mixture of text and graphics. It uses a stateless, connection- and object-oriented protocol with simple commands that support selection and transport of objects between the client and the server. In addition to widely known protocols, the application layer includes the following protocols: Domain Name Service (DNS): Also called name service; this application maps IP addresses to the names assigned to network devices. Routing Information Protocol (RIP): Routing is central to the way TCP/IP works. RIP is used by network devices to exchange routing information. Simple Network Management Protocol (SNMP): A protocol that is use to collect management information from network devices. Network File System (NFS): A system developed by Sun Microsystems that enables computers to mount drives on remote hosts and operate them as if they were local drives.

30 12 Some protocols, such as Telnet and FTP, can only be use if the user has some knowledge of the network. Other protocols, like RIP, run without the user even knowing that they are exist. [3] [4]

31 13 CHAPTER III 3 PROJECT DEVELOPMENT 3.1 Introduction This chapter explains the development process of the network monitoring application using Nagios. The final product of this project is the operational Nagios with pre-defined hosts and services. It has a capability to monitor service status and alerting network administrator if problems occurred in the services. 3.2 Developing Tools below: The developing tools and equipments that are used in this project are listed Nagios 2.5 Core Program Nagios Plug-ins version 1.4 Apache 2.0 Web Server Suse 10.1 Operating System Windows NT (Windows XP) Operating System NC_Net version 2.28 Apache 2.2 Web Server for Windows NT 32-bit

32 Project Methodology The first step for developing this project is to know how the network architecture, protocol and standard work. This is because the project itself involves a number of network protocols and standards. Next, is to learn on every function of the component that involved in the project. The developer must understand how networking layers work and communicate with each other. For this part, Data Communication and Switching Systems subject gave lots of knowledge regarding to the network architectures. A number of reference books also can help to understand more in all the protocols that involved in this project. To develop the application, Nagios is used on Unix Operating System (OS). In this project, Linux Suse 10.1 operating system is used. Therefore, the project developer must learn is how to use Linux Operating System. The main application for this project is Nagios. There is a guidance book to use Nagios program entitled Nagios System and Network monitoring by Wolfgang Barth [2]. This book can guide the developer through out the project from the Nagios installation until it can start monitoring. The development for this project can be represented as in Figure 3.1.

33 15 Figure 3.1 Project development flow Installing Nagios Server and Plug-ins To install Nagios, the first step is to unpack the source code of Nagios Core program (Nagios Server). The source code by the developer for Nagios is provided in Tarball and RPM format. For this project, a Tarball installation package was used. For unpacking, the command must be done in the shell console that is almost the same as MS-DOS prompt as shown in Figure 3.2. The two commands as shown below is to unpack the source code into the directory created for this purpose: linux: # cd /usr/local/src linux:local/src # tar xvzf nagios-2.5.tar.gz When this is done, a subdirectory with the name Nagios-2.5 will be created in usr/local/src directory.

34 16 Figure 3.2 A Shell Console Before the actual compilation and installation, the groups required for operation, namely nagios and nagcmd, are added. This can be done by using groupadd command. User nagios, who is assigned to these groups, can have permission for accessing Nagios Server is added by using useradd. These steps are shown below: linux: # groupadd g 9000 nagios linux: # groupadd g 9001 nagcmd linux: # useradd u 9000 g nagios G nagcmd d /usr/local/nagios /-c Nagios Admin nagios linux: # grep ^User /etc/apache2/uid.conf linux: # usermod G nagcmd wwwrun After adding the user and group for Nagios Server, the grep command is used for knowing what the Apache Server user identification (UID) is. In this case, the UID is wwwrun. The last command, usermod is for allowed user nagcmd for using Apache web server.

35 17 After this setup is finished, a number of directories must be created, and each directory must be own by nagios user. These two steps can be performed by using command as the following: linux: # mkdir /usr/local/nagios /etc/nagios /var/nagios linux: # chown nagios.nagios /usr/local/nagios /etc/nagios /var/nagios After all the preparation for installing Nagios is finished, change to the directory with Nagios sources code with shell console. Next configure command with parameters specified are differ from the default configurations. This parameters value are considerably simplifies the fine-tuning of the configuration and compatible with the method used in Nagios book by Wolfgang Barth [2]. The entire steps for preparing for source code compilation are shown below: linux: # cd /usr/local/src linux:/usr/local/src # cd nagios-2.5 linux:/usr/local/src/nagios-2.5 #./configure \--sysconfdir=/etc/nagios \-- localstatedir=/var/nagios \--with-command-group=nagcmd After compiled, the compilation summary will appear as in Figure 3.3.

36 18 Figure 3.3 Nagios Compilation Summary. Lastly, make commands are used for Nagios Server installation. First command, make all is to compile all the relevant programs. Later, these programs are copied to the appropriate directories; together with the CGI scripts and documentations by make install command. Make install-init command is for installing a suitable init script for the system to start. Here make automatically tries to detect the correct path, and in this case, the directory is /etc/init.d. Next make install-commandmode will generates the directory that is required for later usage of the command file mechanism. The final make command, make install-config will create example nagios configuration files which are used later. The entire make commands are shown below: linux:/usr/local/src/nagios-2.5 # make all linux:/usr/local/src/nagios-2.5 # make install linux:/usr/local/src/nagios-2.5 # make install-init linux:/usr/local/src/nagios-2.5 # make install-commandmode linux:/usr/local/src/nagios-2.5 # make install-config

37 19 After the entire steps above are performed, another important source code must be installed which are the plug-ins. The plug-ins will collect all information from the hosts and services and send to Nagios server when Nagios start monitoring. The steps are quite the same as installing Nagios Server. These steps are shown below: linux: # cd /usr/local/src linux:/local/src # tar xvzf nagios-plugins tar.gz linux:/local/src # cd nagios-plugins linux:/local/src/nagios-plugins #./configure \--sysconfdir=/etc/nagios \--localstatedir=/var/nagios linux:/local/src/nagios-plugins # make all linux:/local/src/nagios-plugins # make install Setting for Nagios Graphical User Interfaces (GUI) and Password After the installation of the core program and plug-ins, hosts and services are pre-defined in Nagios configuration files so that the monitoring tasks can begin. To view the Nagios Graphical User Interfaces (GUI), Apache (HTTP) server must be setup so that the GUI can be viewed via a web browser. Because of the security reason, a login and password is added to the HTTP server. This is for preventing critical data of the network to be access by unauthorized user. To do this, a file name nagios.conf is added to conf.d folder at /etc/apache2 directory. Then in the same directory, nagios.conf file is defined in httpd.conf file using include command. When finished, restart the Apache 2 web server service. To secure the web access with user and password, a.htacces file is added to sbin folder at /usr/local/nagios directory. This will block the website from being access by other people once the user and password is setup. The password can be added to user nagios by using htpasswd2 command. After a password has been created for user nagios, the web user (wwwrun) must be able to read the generated htpasswd file. This file must be protected from anyone else. The steps for adding security to the web access is are shown in Figure 3.4 and 3.5.

38 20 Figure 3.4 nagios.conf file Figure htaccess file The steps for adding password to user nagios and changing ownership of htpasswd with wwwrun pair are shown below: linux: # cd /etc/nagios linux:/etc/nagios # htpasswd2 c htpasswd nagios linux:/etc/nagios # chown wwwrun htpasswd linux:/etc/nagios # chmod 600 htpasswd

39 Pre-defining Hosts and Services for Nagios To start, Nagios can start monitor status of host for PING and HTTP services. This is only for monitoring services on Linux Operating System. More services is added later such as service to monitor hard drive capacities, memory usage (RAM), Central Processing Unit (CPU) load, system uptime, number of user login and lastly monitoring services under Windows NT Operating System. Figure 3.6 and 3.7 show the examples on how to pre-define hosts and services. For more details format, refer to Appendix A. Figure 3.6 Pre-defining hosts

40 22 Figure 3.7 Pre-defining HTTP and PING services for Linux Operating System Setting other important Nagios Configuration Files To set a Nagios server to work on a certain period, periods must be defined. This can be done by using a timeperiods.cfg file. This is shown as in Figure 3.8. Figure 3.8 Pre-defining monitoring time frame for Nagios To make Nagios a reliable network monitoring application, it must have an ability to alert network administrator if any problems occur in the network. Therefore, in this project, the alert will be forwarded to the network administrator via . Figure 3.9 and 3.10 shows the examples on how to define contact and contact

41 23 group that will receive an alert from Nagios if a problem occur in the monitored services. Figure 3.9 Pre-defining contacts, a user which will receive an alert from Nagios (contacs.cfg) Figure 3.10 Pre-defining group for contacts (contactgroups.cfg) The examples of configuration files above are basic requirement for running Nagios server. However, there are more configuration files needed for Nagios to start monitoring (refer Appendix B). Fortunately, other configuration files are installed when running make install-config command. The installed files are nagios.cfg, cgi.cfg, miscommands.cfg, and checkcommands.cfg Setting for monitoring services on Windows NT Server An external service is needed for monitoring services on the Windows NT server. This external service can be addressed over the network. NC_Net was used in this project as the external service for queried local Windows NT resources. This can

42 24 open up the entire world of windows scripting: every Windows NT script that queries local resources can be extended so that it provides a return value and a one-line textoutput, just as a Nagios plug-ins does. The plug-in that is used inside Nagios for interfacing with the NC_Net is check_nt. This plug-in is capable of monitoring processes, central processing unit (CPU) load, memory usage, system uptime etc. To install the NC_Net, run the installation file, NC_Net.exe that can be downloaded free from When installed, go to the command prompt and run the net start command as in Figure Figure 3.11 Starting NC_Net service The service process can be viewed inside Windows Task Manager under Processes tab as in Figure 3.12.

43 25 Figure 3.12 Monitoring NC_Net process 3.4 Project Schedule The Projek Sarjana Muda (PSM) part 1 main objectives is to gather the information regarding network architectures, Linux Operating Systems, Nagios program and plug-ins and other information that is matter for developing this project. At this part, the objective is to know the general environment of the Linux Operating Systems and Nagios program. For the PSM part 2, the objective is on developing the Nagios program. At this stage, Suse 10.1 operating system can be used intermediately. This can help to focus more on using Nagios. Nevertheless, the developer must keep on learning so that new information can help him or her in the future. Therefore gathering the information regarding Nagios and Suse 10.1 is needed. After configured the Nagios

44 26 programs, the application is tested on the real network and repair any problem that occurred during the testing until the project is finished. All the schedule of this project is shown in the Gantt chart below Gantt Chart Table 3.1 PSM 1 Gantt chart Table 3.2 PSM 2 Gantt chart

45 27 CHAPTER IV 4 RESULT AND DISCUSSION 4.1 Introduction After the installation and configuring configuration files, the Nagios Server is ready to be tested on the real computer network environment. After all the testing and repairing the problem, Nagios Server can now be used as a network monitoring application. The testing is done by activating and deactivating the hosts and services to monitor the behaviors of the application regarding to the status of the network. In this project, Nagios is only tested on a small scale network that consists of two personal computers. If there is a future project, Nagios application can be tested on the medium or large scale network such as in the Computer System Laboratory or Faculty of Electrical Engineering network. This chapter will show all the results and screen shots of the Nagios Server monitoring system. From here, anyone who is using Nagios as network monitoring application can understand the behaviors of application when something happens at the network such as host down is up, service is ok or critical, alert etc.

46 Result User and Authentication for Nagios Web Interfaces The screen shot in Figure 4.1 show the welcoming page of Nagios at This is the home page of Nagios server. A user, who wants to access the network status regarding the hosts and services, a username and password must be entered as shown in Figure 4.2. Figure 4.1 Homepage for Nagios Server

47 29 Figure 4.2 User Authentication Adding Username and Password If there is a user to be added, htpasswd2 command can be used. The htpasswd command generates a new password file with a password for a user. Its format is relatively simple: user: 7NlyfpdI2UZEs The line above is generated in the htpasswd file in /etc/nagios directory. Each line contains a user-password pair, separated by a colon. If there is another user to be added, commands shown below must be used. linux: # cd /etc/nagios linux:/etc/nagios # htpasswd2 htpasswd another user

48 Service Details Here a user can monitor the status of the services and hosts. From this web interface as in Figure 4.3, a user can know the condition of hosts and services status. This interface also provides date and time on last services check, services uptime, attempting service checks if problem occurred and status information of services. In status information, the services information are more detail such as the percentage of free space in the hard drives, percentage of memory usage, software version etc. The information given in the web interfaces in Figure 4.4 and 4.5 are quite the same as in Figure 4.3. The first column names in the web page named the host involved. If this has a gray background, Nagios can reach the computer in principle. If the host is down, the background will turn red. For the status of service, red stands for CRITICAL and yellow is for WARNING. The second column in Figure 4.3 with the heading Service provides the service name while the third column is the Status again, in plain text. In column four with the heading Last Check, the interface specifies the time of the last service check while in column five, Duration, shows how long the duration of the current status has been going on. The sixth column with the heading Attempt reveals how often Nagios has already performed the test (unsuccessfully): 3/3 means that the error status has been confirmed for the third time in succession, but the test is only performed three times if there is an error. Finally, the last column passes on the information from the plug-ins to the administrator, to whom it describes the current status in more detail.

49 31 Figure 4.3 Service Details Hosts and Services Status When a certain host and service facing a problem, the services detail will display the status of host and service either it is up or down for host and ok, warning, critical or unknown respectively. These results are shown as in Figure 4.4 and 4.5. In figure 4.4, host down status is colored in red and green when is up. From this display, a user can make an appropriate action to solve the services problem. Usually the problem of the service and host is shown at the status information column.

50 32 Figure 4.4 Service Status Details for down Host Figure 4.5 Service Status Details for problem Service

51 Alert and Notification History If an error occurred in the services, an alert is sent and service status is shown in the web interface. This alert also will trigger a notification to the network administrator. For this project, the notification will be send via . All the alert and notification history can be access at the web browser. The alert contains show the status of the network from the program Nagios run until it is restarted by someone. The history is cumulated in days and display service details, status and types. The alert history web interface is shown as in Figure 4.6. In the contact notification history, the web interface displays contact that received an alert regarding to the network problem. Here it also displays the service and host problem; time the alert being sent and status information. The contact notification history is shown as in Figure 4.7. Figure 4.6 Alert History

52 34 Figure 4.7 Contact Notification History Examples of other Web Interfaces for Nagios There are many web interfaces for Nagios that displays the status of the hosts and services. It have more details than the service details status web page such as host group, host details, service group and tactical over view. These results are shown as in Figure 4.8, 4.9, 4.10, 4.11, 4.12 and These web interfaces will help the administrator to understand more about the network architecture because of the details information and services are shown in groups. In Figure 4.8, the tactical monitoring overview provides a wealth of information on a single web page. On the left-hand side of the page, in order of priority, first the failure of entire network ranges (Network Outages), followed by the

53 35 status of hosts and services, and at the bottom, lists whether individual monitoring features such as notifications and event handlers are active. Figure 4.8 Tactical Monitoring Overview Figure 4.9 Host Status Details for all Hosts Groups

54 36 Figure 4.10 Host State Information Figure 4.11 Status Grid for all Host Groups

55 37 Figure 4.12 Service Overview for all Service Groups Figure 4.13 Status Grid for all Service Groups

56 Nagios Alert Notifications via In chapter 4.2.5, the web interface displays the history of alerts and notifications. For Nagios to be more effective, this notification can be sent to the network administrator. There are two types of notification: i. Problem notification - This notification is sent when a problem occurs with the services ii. Recovery notification - This notification is sent when the problem services are recovered Inside the notification, there will be a number of subjects regarding the hosts and services status. There are: i. Notification Type - This will be either Problem or Recovery ii. Host or Services - Name of host or service that has pre-defined iii. State - The condition of hosts or services either up or down for hosts and ok, warning, critical or unknown for services iv. Address Internet Protocol (IP) address for hosts v. Information Additional information regarding the condition of hosts and services. vi. Time and date The time and date when the problem or recovery condition is occurred. In Figure 4.14 and 4.15 are examples of notification when a host or service is facing problems.

57 39 Figure 4.14 Alert notifications via for down Host Figure 4.15 Alert notifications via for problem Service

58 40 The examples for alert notification via for recovered services are shown as in Figure 4.16 and Here, the notification alert is for informing the network administrator that the service is recovered and up. Figure 4.16 Alert notifications for recovered Host Figure 4.17 Alert notifications for recovered Service

59 Self Generated Report for Nagios Server These results are for network administrator who wants a report on the monitoring process and all the status of the monitored network in a certain period of time. In the web interfaces, a user can selects what type of information they need and time period such as a report for seven continuous days in a week. This report is based on the Nagios archive as in the Nagios log. The examples of the web interfaces and generated reports are shown in Figure 4.18, 4.19 and Figure 4.18 Hostgroup Availability Report for 7 days

60 42 Figure 4.19 Service Availability Report for 7 days Figure 4.20 Alert Summary Report for 7 days

61 Service Configurations and History Log These results are for helping network administrator to view the configuration files for services performed by Nagios. This configuration information is for view only and cannot be modified. The web interface is shown in Figure Figure Configuration Information for Host The log files of Nagios also can be accessed via the web browser. Here the history of activities and events by Nagios is kept and rotated for a month. This result can be used for references and evaluations. The log web interface is shown in Figure 4.22.

62 44 Figure History Log Nagios Performance Information The administrator can view the performance of Nagios program via a web browser. In this web interface, the performance is shown in percentage of completed service checks in a certain time frame. This can help a user to evaluate the Nagios performance and can use it as reference. This result is shown in Figure 4.23.

63 45 Figure 4.23 Performance Information The service checks schedule is also can be accessed via a web browser. It show when the services checked will be performed. Also in this web interface, the administrator can deactivate or activate a service check. The service checks show here is in ascending order. The example of the service check schedule is shown in Figure 4.24.

64 46 Figure 4.24 Service Check Schedule When the administrator wants to perform a service on the hosts or the services in the network, he or she must tell the Nagios that a certain pre-defined hosts or services will be in down status. This action can be made using external command for scheduling a host down time. When this is performed, Nagios will ignore the down host and continue with other service checks. The administrator will define which host is involved and the time period for performing the service. The example of schedule down time is shown in Figure 4.25.

65 47 Figure 4.25 Host and Service Scheduled Downtime 4.3 Project Achievement Overall, this project meets all the objectives and scopes of work. This project includes a working Nagios server that is capable to monitor pre-defined host and services. The Nagios server is able to monitor services run on Linux and Windows NT operating system. It can monitor a number of services such as PING, HTTP web server, Central Processing Unit (CPU) load, hard drives capacity, memory usage for Windows NT, Swap space for Linux, number of users login, Secure Shell daemon status for Linux and System uptime for Windows NT.

66 Discussion Although this project meets it objectives and scopes of work, there are some difficulty faced during completing this project. The difficulties faced during the project are listed below Lack of knowledge in Linux Operating System environment Linux is one of powerful freeware applications that are available on the market. Usually a student is familiar only with Windows NT because all the tasks their received are using applications that run on a Windows NT especially in Faculty of Electrical Engineering, Universiti Teknologi Malaysia. However, there are some steps taken to introduce Linux operating system to students such as in Computer System Laboratory. Therefore, a student who never uses Linux operating system before will be facing many problems when start to use it. It will take a while to get familiar with Linux operating system. In this project, Linux Suse 10.1 is used. Linux Suse 10.1 is one of the popular Linux operating system just as Redhat Fedora. This operating system environment is quite the same as in Windows NT (in this case Windows XP). It has an excellent Graphical User Interfaces (GUI) and freeware program such as Open Office, a program that is similar to Microsoft Office. The most important thing is that Linux has its own developing tool for user ease. In the installation progress for an application in Linux, a user must use shell console to run the installation. There are two famous types of installation files in Linux, Tarball (tar.gz) and Redhat Packages Management (RPM). For a beginner running the installation is quite tricky, but after some reading from the developer sites, it can be done. The Tarball file is more complicated than RPM because there some configuration firstly must be defined rather than RPM that will automatically resolve the configuration.