| 0,0 → 1,322 |
|---|
| #!/usr/bin/perl |
| # |
| # Copyright (c) 2004, SWITCH - Teleinformatikdienste fuer Lehre und Forschung |
| # All rights reserved. |
| # |
| # Redistribution and use in source and binary forms, with or without |
| # modification, are permitted provided that the following conditions are met: |
| # |
| # * Redistributions of source code must retain the above copyright notice, |
| # this list of conditions and the following disclaimer. |
| # * Redistributions in binary form must reproduce the above copyright notice, |
| # this list of conditions and the following disclaimer in the documentation |
| # and/or other materials provided with the distribution. |
| # * Neither the name of SWITCH nor the names of its contributors may be |
| # used to endorse or promote products derived from this software without |
| # specific prior written permission. |
| # |
| # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
| # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE |
| # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
| # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
| # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
| # POSSIBILITY OF SUCH DAMAGE. |
| # |
| # $Author: peter $ |
| # |
| # $Id: PortTracker.pm 27 2011-12-29 12:53:29Z peter $ |
| # |
| # $LastChangedRevision: 27 $ |
| |
| # Demo plugin for NfSen |
| # |
| # This plugin demonstrates the use of plugins |
| |
| package PortTracker; |
| |
| use strict; |
| use NfSen; |
| use NfConf; |
| |
| # |
| # The plugin may send any messages to syslog |
| # Do not initialize syslog, as this is done by |
| # the main process nfsen-run |
| use Sys::Syslog; |
| |
| our $VERSION = 130; |
| |
| our %cmd_lookup = ( |
| 'get-portgraph' => \&GetPortGraph, |
| 'get-topN' => \&GetTopN, |
| ); |
| |
| my ( $nftrack, $PROFILEDATADIR ); |
| |
| my $PORTSDBDIR = "/var/log/netflow/porttracker"; |
| |
| my $EODATA = ".\n"; |
| |
| # colours used in graphs |
| # if more than 12 graphs are drawn ( does this really make sense ? ) |
| # the same colours are used again |
| my @colour = ( |
| '#ff0000', '#ff8000', '#ffff00', '#80ff00', '#00ff00', |
| '#00ff80', '#00ffff', '#0080ff', '#0000ff', '#8000ff', |
| '#ff00ff', '#ff0080' |
| ); |
| |
| |
| sub GetTopN { |
| my $socket = shift; |
| my $opts = shift; |
| |
| my $interval; |
| if ( !exists $$opts{'interval'} ) { |
| $interval = 1; |
| } else { |
| $interval = $$opts{'interval'}; |
| } |
| print $socket ".Get topN ports\n"; |
| |
| my $statfile = $interval == 24 ? 'portstat24.txt' : 'portstat.txt'; |
| print $socket ".topN ports $PORTSDBDIR/$statfile\n"; |
| if ( !open STAT, "$PORTSDBDIR/$statfile" ) { |
| print $socket $EODATA; |
| print $socket "ERR Open statfile '$PORTSDBDIR/$statfile': $!\n"; |
| return; |
| } |
| |
| print $socket ".topN read ports\n"; |
| while ( <STAT> ) { |
| chomp; |
| print $socket "_topN=$_\n"; |
| } |
| print $socket $EODATA; |
| print $socket "OK Command completed\n", |
| |
| } # End of GetPortGraph |
| |
| sub GetPortGraph { |
| my $socket = shift; |
| my $opts = shift; |
| |
| # get all arguments: |
| # Example: |
| # proto typw logscale light tstart tend topN track_list |
| # tcp flows 0 0 1116495000 1116581400 '22 445 135 1433' '80 143' |
| if ( !exists $$opts{'arg'} ) { |
| print $socket $EODATA; |
| print $socket "ERR Missing Arguments.\n"; |
| } |
| my $ARGS = $$opts{'arg'}; |
| my $proto = shift @$ARGS; # 'tcp' or 'udp' |
| my $type = shift @$ARGS; # 'flows', 'packets' or 'bytes' |
| my $logscale = shift @$ARGS; # 0 or 1 |
| my $stacked = shift @$ARGS; # 0 or 1 |
| my $light = shift @$ARGS; # 0 or 1 |
| my $tstart = shift @$ARGS; # start time - UNIX format |
| my $tend = shift @$ARGS; # end time - UNIX format |
| my $topN = shift @$ARGS; # TopN port list: string: ' ' separated port list |
| my $track_list = shift @$ARGS; # Static track port list: string: ' ' separated port list |
| my $skip_list = shift @$ARGS; # Static skip port list: string: ' ' separated port list |
| |
| if ( !defined $proto || !defined $type || !defined $logscale || !defined $stacked || |
| !defined $light || !defined $tstart || !defined $tend || !defined $topN || |
| !defined $track_list || !defined $skip_list ) { |
| print $socket $EODATA; |
| print $socket "ERR Argument Error.\n"; |
| return; |
| } |
| my @skipPorts = split '-', $skip_list; |
| |
| my @topN = split '-', $topN; |
| my @track_list = split '-', $track_list; |
| |
| # remove the common ports in both lists from the dynamic topN list |
| my %_tmp; |
| @_tmp{@track_list} = @track_list; |
| delete @_tmp{@topN}; |
| @track_list = sort keys %_tmp; |
| |
| # %_tmp = (); |
| # @_tmp{@topN} = @topN; |
| # delete @_tmp{@skipPorts}; |
| # @topN = keys %_tmp; |
| |
| %_tmp = (); |
| my @_tmp; |
| @_tmp{@skipPorts} = @skipPorts; |
| foreach my $port ( @topN ) { |
| push @_tmp, $port unless exists $_tmp{$port}; |
| } |
| @topN = @_tmp; |
| |
| my $datestr = scalar localtime($tstart) . " - " . scalar localtime($tend); |
| my $title = uc($proto) . " " . ucfirst($type); |
| |
| my @DEFS = (); |
| |
| # Compile rrd args |
| my @rrdargs = (); |
| push @rrdargs, "-"; # output graphics to stdout |
| |
| foreach my $port ( @topN, @track_list ) { |
| # assemble filename |
| my $fileident = $port >> 10; |
| my $rrdfile = "$PORTSDBDIR/${proto}-${type}-$fileident.rrd"; |
| # which ident in this rrd file |
| my $ident = $port & 1023; # 0x0000001111111111 mask |
| push @rrdargs, "DEF:Port${port}=$rrdfile:p${ident}:AVERAGE"; |
| } |
| |
| push @rrdargs, "--start", "$tstart"; |
| push @rrdargs, "--end", "$tend"; |
| push @rrdargs, "--title", "$datestr - $title" unless $light; |
| push @rrdargs, "--vertical-label", "$title" unless $light; |
| |
| # lin or log graph? |
| push @rrdargs, "--logarithmic" if $logscale; |
| |
| if ( $light ) { |
| push @rrdargs, "-w"; |
| push @rrdargs, "288"; |
| push @rrdargs, "-h"; |
| push @rrdargs, "150"; |
| push @rrdargs, "--no-legend"; # no legend in small pictures |
| } else { |
| push @rrdargs, "-w"; |
| push @rrdargs, "576"; |
| push @rrdargs, "-h"; |
| push @rrdargs, "300"; |
| } |
| |
| |
| my $i=0; |
| my $area_set = 0; |
| my $n = scalar @topN; |
| push @rrdargs, "COMMENT:Top $n Ports\\n"; |
| if ( $stacked && scalar @topN ) { |
| my $port = shift @topN; |
| push @rrdargs, "AREA:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| $area_set = 1; |
| foreach my $port ( @topN ) { |
| push @rrdargs, "STACK:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| } |
| |
| } else { |
| foreach my $port ( @topN ) { |
| push @rrdargs, "LINE1:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| } |
| } |
| |
| if ( scalar @track_list) { |
| push @rrdargs, "COMMENT:\\n"; |
| push @rrdargs, "COMMENT:\\n"; |
| push @rrdargs, "COMMENT:Tracked Ports\\n"; |
| } |
| if ( $stacked && scalar @track_list) { |
| if ( !$area_set ) { |
| my $port = shift @track_list; |
| push @rrdargs, "AREA:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| } |
| foreach my $port ( @track_list ) { |
| push @rrdargs, "STACK:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| } |
| |
| } else { |
| foreach my $port ( @track_list ) { |
| push @rrdargs, "LINE2:Port${port}$colour[$i]:Port ${port}"; |
| $i++; |
| } |
| } |
| if ( scalar @skipPorts) { |
| push @rrdargs, "COMMENT:\\n"; |
| push @rrdargs, "COMMENT:\\n"; |
| my $portlist = join ',', @skipPorts; |
| push @rrdargs, "COMMENT:Skipped Ports $portlist\\n"; |
| } |
| my ($averages,$xsize,$ysize) = RRDs::graph( @rrdargs ); |
| |
| if (my $ERROR = RRDs::error) { |
| print "ERROR: $ERROR\n"; |
| } |
| |
| } # End of GenPortGraph |
| |
| |
| sub nftrack_execute { |
| my $command = shift; |
| |
| syslog('debug', $command); |
| |
| my $ret = system($command); |
| if ( $ret == - 1 ) { |
| syslog('err', "Failed to execute nftrack: $!\n"); |
| } elsif ($ret & 127) { |
| syslog('err', "nftrack died with signal %d, %s coredump\n", ($ret & 127), ($ret & 128) ? 'with' : 'without'); |
| } else { |
| syslog('debug', "nftrack exited with value %d\n", $ret >> 8); |
| } |
| |
| } # End of nftrack_execute |
| |
| # |
| # Periodic function |
| # input: hash reference including the items: |
| # 'profile' profile name |
| # 'profilegroup' profile group |
| # 'timeslot' time of slot to process: Format yyyymmddHHMM e.g. 200503031200 |
| sub run { |
| my $argref = shift; |
| |
| my $profile = $$argref{'profile'}; |
| my $profilegroup = $$argref{'profilegroup'}; |
| my $timeslot = $$argref{'timeslot'}; |
| |
| syslog('debug', "PortTracker run: Profile: $profile, Time: $timeslot"); |
| |
| my %profileinfo = NfProfile::ReadProfile($profile); |
| my $netflow_sources = "$PROFILEDATADIR/$profile/$profileinfo{'sourcelist'}"; |
| |
| # |
| # process all sources of this profile at once |
| my $command = "$nftrack -L $NfConf::syslog_facility -M $netflow_sources -r nfcapd.$timeslot -d $PORTSDBDIR -A -t $timeslot -s -p -w $PORTSDBDIR/portstat.txt"; |
| nftrack_execute($command); |
| |
| $command = "$nftrack -d $PORTSDBDIR -S -p -w $PORTSDBDIR/portstat24.txt"; |
| nftrack_execute($command); |
| |
| # |
| # Process the output and notify the duty team |
| |
| syslog('debug', "PortTracker run: Done."); |
| |
| } # End of run |
| |
| sub Init { |
| syslog("info", "PortTracker: Init"); |
| |
| # Init some vars |
| $nftrack = "$NfConf::PREFIX/nftrack"; |
| $PROFILEDATADIR = "$NfConf::PROFILEDATADIR"; |
| |
| return 1; |
| } |
| |
| sub Cleanup { |
| syslog("info", "PortTracker Cleanup"); |
| # not used here |
| } |
| |
| 1; |