Defcon-1-Logo

           [Home]    [FBSD Articles]    [Scripts Corner]    [Contribute]    [Search]    [FBSD Links]    [Files]

About Us

FreeBSD Articles
  *Hardware
  *Networking
  *Security
  *Software
  *X Windows


Files / Scripts
Newbies Corner
Tech. Talk
Tips and Tricks


FreeBSD Links

Articles in other
Languages :
  *French Articles
  *Spanish Articles

Want to Help ?
 
   Click Here

Email Users5

Search:
 

 


FreeBSD Search:


 

 

Powered-By-Apache-Logo

Big Brother - System Monitoring How-To

 Many admins are responsible for the availability of server, routers, and such. To help this task there are many system monitoring software packages available for FreeBSD and other network cards. Some just monitor the processes on a machine while others monitor the network also. Big Brother is one package that does both and allows you to show the system status in a web page. Big Brother can interface with Kermit to dial a pager, send SMS messages, or e-mail a report of the problem. For this example we will just be doing the e-mail notification, though I have setup Kermit and a 2400 bps modem to contact my numeric pager. Now I have a e-mail address for my cell phone, so I just use it. I created an alias on a server that is easier to remember and tell ppl if they need to e-mail me a pager, and pointed that alias to my cell phone Address.

You can find the latest version of Big Brother at http://www.bb4.com/

The latest version as of this writing is 1.6a :

      (Update: Newest version is 1.7a)
       
changes: http://www.bb4.com/README.CHANGES

 There is a port of Big Brother in the FreeBSD ports collection, but I prefer to roll mine by hand. Two reasons for this, I like to keep all the files for Big Brother in the $HOME dir of the user I want to run Big Brother as, and also I like to use the latest version even if the port isn't the latest.

 First off we need a user to run Big Brother as. Create a user called bb. This user needs no special access, so it is not need to be part of the wheel group. Do not run Big Brother as root. There are not any exploits for current versions of Big Brother
( < 1.12 did have some if I recall correctly ), but if it is run as a non-priviledged account there is less threat to damage if there is a exploit found later on down the road. 

 You need to have decided how you want your Big Brother network setup. It can be as small as just one machine, or you can have many machines, each with certain functions. The two main parts of the system are your BBDISPLAY, which is the web server that shows the status of what is being monitored, and the BBPAGER which sends out notifications. Again, both of these can be on the same machine, but when you have it spread out among multiple machines, you need to also have Big Brother running on all the machines that are doing monitoring. The machines that I am checking do not run Big Brother in my current setup, as I am just needing to make sure specified services are running. 

Do all the following as the user bb

gunzip the bb-1.6a.tar.gz in /usr/home/bb
un-tar the resulting tarball
read the README.FIRST
untar bb16a.tar
cd bb16a

read the README.INSTALL

cd ./install

./bbconfig freebsd

  While this runs you will be asked some questions, such as:

  Prevent execution of as root, which I answer yes to.

  What user ID will be running BB, which I answer bb to.

  Use old style dirs, which should be no.

  Use Full Qualified Domain Names ( such as www.domain.com instead of just www) , this one is up to you.

  Name of BBDISPLAY, which is the web server you will be using to show system status on. I once setup a Big Brother system with no web server, as I was just after the pager notification. The web server that you are using as your BBDISPLAYm also needs to be running Big Brother.

  Name of BBPAGER, which is the machine that will do notification for you. It isn't a big deal when just using e-mail notification, but when using kermit, this needs to be set to the machine with the modem and kermit installed.

  Is current host a BBDISPLAY: answer according to your setup.

  Default recipient, enter the default e-mail address that you want notifications sent to. You can tweak this later after the install is done.

Once that is done, you need to do the following:

 cd ../src
 make
 make install
 cd ../..
 chown -R bb bbvar bb16a

 Now that big Brother is installed you need to setup what hosts you want monitored and what services on those hosts you want monitored. This is controlled by /usr/home/bb/bb16a/etc/bb-hosts. The format of the file is pretty self-explantitory. You can monitor http, ssh, telnet, nntp, ftp, smtp, pop, imap, and connectivity ( ping ) with Big Brother out of the box. You can tell it to make sure a service isn't running by putting a ! in front of it when listed in the bb-hosts file. Tweaking of the notification system is done in /usr/home/bb/bb16a/etc/bbarnsetup.cfg and bbwarnrules.cfg. The bbwarnsetup tends to be service level while bbwarnrules is machine based. You can adjust how you are notified by times and other conditions in the bbwarnrules.cfg, which is what I modded to meet my needs. The file is well documented with examples.

 To run Big Brother you just need to execute /usr/home/bb/bb16a/runbb.sh, but if the machine goes down Big Brother will not automatically fire up when the machine comes back up, which makes monitoring useless if it isn't running after there is a problem. To file up Big Brother when the machine is rebooted, you need to create a file in /usr/local/etc/rc.d called bb.sh. The following lines should get Big Brother fired up when you machine boots. A little tweaking may be needed for your particular system.

#!/bin/sh

/usr/bin/su bb /usr/home/bb/bb16a/runbb.sh

The web pages generated by big Brother can be found in /usr/home/bb/bb16a/www. You can tweak the layout of the web pages in bb-hosts file. I created a symbolic link to the /usr/home/bb/b16a/www dir from the DocumentRoot of the webserver. to do this, you just need to type:

ln -s /usr/home/bb/bb16a/www bb

That command needs to be issued in the parent dir of where you want to access the bb dir. Such as www.domain.com/bb would work if the aboce was issued in the DocumentRoot for www.domain.com.

  Technoid

Email Us

ghostrdr@defcon1.org

This site cannot be duplicated without permission

© 1998 - 2010 Defcon1, www.defcon1.org. Copyrights for all materials on this web site are held by the individual authors, artists, photographers or creators. Materials may not be reproduced or otherwise distributed without permission of www.defcon1.org and the content's original author.