Big Brother: Network Monitoring Software. Kevin Orlowski. System Administration

Transcription

1 Big Brother 1 Big Brother: Network Monitoring Software Kevin Orlowski System Administration

2 Big Brother 2 Abstract Big Brother is a system and network monitor distributed by Quest Software. It displays network and system status via the web, which is unique among network monitoring software. The software is open source and highly customizable to a company s or individual s specific needs. Some people who have used the software, including myself, believe that it is lacking in documentation and its configuration can be confusing. However, if a user has a good understanding of Unix, Big Brother can be configured to be a powerful tool for monitoring a network for high security and optimal performance.

3 Big Brother 3 Big Brother: Network Monitoring Software Big Brother is a web-based network monitoring application offered by Quest Software. It is the first web-based application of its kind and was originally designed in The functionality of Big Brother is fairly simple; network statistics are displayed as web pages that can be viewed from any browser from any location. Due to the fact that it is open source, it is quite flexible and can be modified for many different tasks. Since its inception it has grown in popularity and it is currently being used in industry by such companies as: Hewlett Packard, ING Direct, and Sprint. Purpose of the Report The purpose of this report is to research and implement the Big Brother software package on a Unix based system. The report will outline goals, possible policies for users, a project timeline, details on the merit of the software, difficulties in implementation and finally conclusions. Using this report the reader should be able to decide if implementing the Big Brother software package is right for them. Project Goals The goals of this project are to successfully implement the Big Brother software and use it to monitor network devices and services on the campus network of Plymouth State University. During this implementation the software will be analyzed to determine both strengths and weaknesses. By the conclusion of the project I hope to have a comprehensive understanding of the Big Brother software.

4 Big Brother 4 User Policy There must be a fairly strict user policy in place when implementing the Big Brother software. Having the ability to monitor network devices and services could be very advantageous to someone trying to gain access to a network without authorization. In addition it is not necessary for everyone on a network to be able to monitor services, only a few privileged users should have that ability. It is recommended that only the network administrator, system administrator and related network staff have access to the Big Brother software. The network administrator should be the only user that can make changes to the reporting aspect of the software mainly due to the fact that the network administrator is responsible for the network devices and services working properly and will most likely be the person notified when they are not working. The URL where Big Brother is posting the network status should also be protected from unwanted users. If a prospective intruder can find out what is being monitored on a network they will in turn know what is not being monitored and may be able to find a way into the system without being noticed. The URL should be located on a secure web server and should require a login to view the network status.

5 Big Brother 5 Project Timeline Oct 28th Nov 1st Nov 3rd Nov 5th Nov 20th Dec 2nd Dec 4th Chose 'Big Brother-Network Monitoring Software' for Project Downloaded Software onto Syslab06 Machine Research Big Brother Installation and Configuration Type up Report Report is Due Give Presentation Positive Characteristics of the Big Brother Software The Big Brother software package has many positive characteristics that would help a network administrator easily monitor his/her network. Over the eight years since its inception there have been improvements made based on suggestions from users and updates by the developers. One of its more unique features is the ability to display network status and statistics as a web page that can be viewed from any machine by simply entering the proper URL. Most network monitoring packages require that the network status can only be viewed at the machine

6 Big Brother 6 where the software is installed which limits a network administrator. Using Big Brother, if a problem arises and the network administrator is not in their office he/she could view the status of the network from any machine they had access to and assess the problem without having to travel to a specific machine and lose valuable time. In addition to reporting network status and statistics, Big Brother can also report on a single machines performance and status. By installing a BBClient on a local machine Big Brother can monitor CPU usage, disk space, and other attributes that may be very useful in researching problems on the network and problems on that specific machine. Big Brother is capable of running multiple instances on a single network all running in parallel. If the machine that is running as the monitoring system goes down or is compromised it would be very difficult if not impossible to monitor further activity during an incident. With Big Brother multiple machines can be set up as the monitoring system and they can report to multiple URL s making the monitoring very redundant and robust. This way if one of the monitoring systems is down or compromised the network is still being monitored and the network administrator is not left in the dark. Big Brother also has a designated port, 1984, assigned by the IANA (Internet Assigned Numbers Authority) that it uses to send status reports from client to server (IANA 2003). This makes it easier to notice while reviewing network logs when your status reports are being sent. And because Big Brother uses its own port you will not be forced to keep another port open that you may want to close because it is being used for status reports from your network monitoring software. Big Brother has one of the most detailed and comprehensive notification processes of any network monitoring software on the market today. There is an extensive ruleset that a network

7 Big Brother 7 administrator can customize to make the software report in any manner that they find appropriate. Big Brother can notify based on a time if day, a specific machine, or if a certain test fails. There is also an available initial-delay for notification to cut down on late night false alarms. Big Brother supports paging over a standard phone line and paging, it can page a group or just one person. On the Unix/Linux platform there is even an option to set up a completely custom notification procedure. Once a network administrator has experienced a problem it is very advantageous to store information about that problem and how the problem was resolved. This is one of the most useful tools available to a network administrator. Big Brother allows for each status report to be stored for use at a later date. Historical reports can give information about past performance and whether, over time, performance has increased or decreased and it can offer insight into when and where problems have occurred in the past. The Big Brother software is completely open source, which makes it very flexible and easily customizable. It supports plug-ins, which also promotes customization. There is an extensive user community that shares solutions, plug-ins and source code. This ability makes it possible for network administrators across the world to collaborate and solve network problems together and make the software itself stronger. Problems Encountered During Implementation I did encounter some problems while implementing the Big Brother software. The most frustrating of which was incomplete documentation. I was not familiar with the software at all before attempting to install it so I was forced to rely completely on the documentation that came

8 Big Brother 8 with the software. As is the case with many software packages trying to follow installation readme files and other documentation can get confusing. It is difficult for a programmer to be able to anticipate everything that a user may know before installation. Some users may need more guidance than others and in this case I think that if the programmers had included a little more information in a more organized manner users would benefit. During my research I found other reviewers that agree with my viewpoint. Oliver Kaven, a reviewer with PC Magazine states that documentation on BB is sparse and the product itself is mostly written with shell scripts if you can decode what little documentation there is and read the shell scripts, the system can be made to do just about anything you might want. (Kaven 2001). He went on to add that overall it is a good product, but not for the beginner administrator with little Unix knowledge. (Kaven 2001). Another problem I ran into during installation was getting the Big Brother software to interact correctly with my web server. One of the main advantages of the Big Brother software is the fact that it can publish network statistics and availability directly to the web, to do this however, it needs a web server. During the installation process of the Big Brother software the user must configure the software to interact with a specific web server and name the location of certain specific files that are associated with the web server in order for it to work correctly. At first I did not know the location of these files and I had to go back later to modify things, which was difficult. I think that if the Big Brother software came with its own web server that was already configured setup would be much easier because it would be one less thing for the user to worry about. Due to time constraints I was never really able to customize Big Brother for the Plymouth State University network. I was able to get the software running with the default settings of the

9 Big Brother 9 Quest Software network but when I tried to modify the software to monitor services and machines on the Plymouth network I ran into errors. I was unable to determine if this was because of my web server or if it was a problem with the way I had configured the software itself. I think that this problem has more to do with user error than software design and I think that if I had a little more time to play with the software that I could have solved this problem and configured the software properly. Conclusions After spending a month researching and implementing the Big Brother software package I have found that it is a very advantageous tool for any network administrator. Keeping track of network status and statistics is a must for any size network for security and performance reasons. In my opinion Big Brother makes this easier and more custom to your specific needs than any other network monitoring software available. I am confident that any network administrator would find this software well equipped to keep them informed of their network status now and into the future by adding plug-ins and modifying the source code themselves if need be. I would recommend Big Brother to any network administrator or individual looking to monitor a home network or simply monitor the performance of their personal machine.

10 Big Brother 10 References Big Brother System and Network Monitor. Quest Software. 1 st November Deadcat. Quest Software. 8 th November Internet Assigned Numbers Authority. 8 th November Kaven, Oliver. Big Brother. PC Magazine th October Mortazavi, Shad. Enterprise Level Network Monitoring. News Views. June 2003.

11 APPENDIX A Big Brother 11

12 Big Brother 12 How-To - Download the.tar file from to the desired directory - Extract the contents of the file - You should set up a BBuser Unix account - Change directories to the one created (i.e. bb*.*) where *.* is the version - Once in this directory do cd./install followed by./bbconfig -./bbconfig will start the configuration process be prepared to answer some questions about your system. (make sure you know the answers because modifying later can be difficult) o Whether or not you want to keep the old-style directory structure o Do you intend to use Fully Qualified Domain Names o Which host(s) is(are) the BBDISPLAY(s) o Which host(s) is(are) the BBPAGER(s) o Is the current host a BBDISPLAY / BBPAGER o Default recipient for notification o URL you intend to view BB with o URL of the BB CGI scripts o The User ID of your web server - Once that has finished do cd../src do a make and then a make install - cd../etc you can now edit the bb-hosts file and enter the names of your hosts - You can also edit the bbdef.sh file to set alarm levels - There are two scripts that come with the software that will check the configuration files for errors run them once you have finished editing the files. They are./bbchkcfg.sh and./bbchkhosts.sh - Change the ownership of the BB files to the BBuser account you set up earlier chown R BBuser bbvar - Create the symbolic link ln s /full path_to_your_bb_directory/www /WWW/bb (where WWW is the document root of your web server - Run the runbb.sh script - About two minutes after startup the web pages should be available