Go to most recent revision | Blame | Last modification | View Log
#!/usr/bin/perl
#
# Copyright (c) 2004, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
# * Neither the name of SWITCH nor the names of its contributors may be
# used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# $Author: peter $
#
# $Id: PortTracker.pm 27 2011-12-29 12:53:29Z peter $
#
# $LastChangedRevision: 27 $
# Demo plugin for NfSen
#
# This plugin demonstrates the use of plugins
package PortTracker;
use strict;
use NfSen;
use NfConf;
#
# The plugin may send any messages to syslog
# Do not initialize syslog, as this is done by
# the main process nfsen-run
use Sys::Syslog;
our $VERSION = 130;
our %cmd_lookup = (
'get-portgraph' => \&GetPortGraph,
'get-topN' => \&GetTopN,
);
my ( $nftrack, $PROFILEDATADIR );
my $PORTSDBDIR = "/var/log/netflow/porttracker";
my $EODATA = ".\n";
# colours used in graphs
# if more than 12 graphs are drawn ( does this really make sense ? )
# the same colours are used again
my @colour = (
'#ff0000', '#ff8000', '#ffff00', '#80ff00', '#00ff00',
'#00ff80', '#00ffff', '#0080ff', '#0000ff', '#8000ff',
'#ff00ff', '#ff0080'
);
sub GetTopN {
my $socket = shift;
my $opts = shift;
my $interval;
if ( !exists $$opts{'interval'} ) {
$interval = 1;
} else {
$interval = $$opts{'interval'};
}
print $socket ".Get topN ports\n";
my $statfile = $interval == 24 ? 'portstat24.txt' : 'portstat.txt';
print $socket ".topN ports $PORTSDBDIR/$statfile\n";
if ( !open STAT, "$PORTSDBDIR/$statfile" ) {
print $socket $EODATA;
print $socket "ERR Open statfile '$PORTSDBDIR/$statfile': $!\n";
return;
}
print $socket ".topN read ports\n";
while ( <STAT> ) {
chomp;
print $socket "_topN=$_\n";
}
print $socket $EODATA;
print $socket "OK Command completed\n",
} # End of GetPortGraph
sub GetPortGraph {
my $socket = shift;
my $opts = shift;
# get all arguments:
# Example:
# proto typw logscale light tstart tend topN track_list
# tcp flows 0 0 1116495000 1116581400 '22 445 135 1433' '80 143'
if ( !exists $$opts{'arg'} ) {
print $socket $EODATA;
print $socket "ERR Missing Arguments.\n";
}
my $ARGS = $$opts{'arg'};
my $proto = shift @$ARGS; # 'tcp' or 'udp'
my $type = shift @$ARGS; # 'flows', 'packets' or 'bytes'
my $logscale = shift @$ARGS; # 0 or 1
my $stacked = shift @$ARGS; # 0 or 1
my $light = shift @$ARGS; # 0 or 1
my $tstart = shift @$ARGS; # start time - UNIX format
my $tend = shift @$ARGS; # end time - UNIX format
my $topN = shift @$ARGS; # TopN port list: string: ' ' separated port list
my $track_list = shift @$ARGS; # Static track port list: string: ' ' separated port list
my $skip_list = shift @$ARGS; # Static skip port list: string: ' ' separated port list
if ( !defined $proto || !defined $type || !defined $logscale || !defined $stacked ||
!defined $light || !defined $tstart || !defined $tend || !defined $topN ||
!defined $track_list || !defined $skip_list ) {
print $socket $EODATA;
print $socket "ERR Argument Error.\n";
return;
}
my @skipPorts = split '-', $skip_list;
my @topN = split '-', $topN;
my @track_list = split '-', $track_list;
# remove the common ports in both lists from the dynamic topN list
my %_tmp;
@_tmp{@track_list} = @track_list;
delete @_tmp{@topN};
@track_list = sort keys %_tmp;
# %_tmp = ();
# @_tmp{@topN} = @topN;
# delete @_tmp{@skipPorts};
# @topN = keys %_tmp;
%_tmp = ();
my @_tmp;
@_tmp{@skipPorts} = @skipPorts;
foreach my $port ( @topN ) {
push @_tmp, $port unless exists $_tmp{$port};
}
@topN = @_tmp;
my $datestr = scalar localtime($tstart) . " - " . scalar localtime($tend);
my $title = uc($proto) . " " . ucfirst($type);
my @DEFS = ();
# Compile rrd args
my @rrdargs = ();
push @rrdargs, "-"; # output graphics to stdout
foreach my $port ( @topN, @track_list ) {
# assemble filename
my $fileident = $port >> 10;
my $rrdfile = "$PORTSDBDIR/${proto}-${type}-$fileident.rrd";
# which ident in this rrd file
my $ident = $port & 1023; # 0x0000001111111111 mask
push @rrdargs, "DEF:Port${port}=$rrdfile:p${ident}:AVERAGE";
}
push @rrdargs, "--start", "$tstart";
push @rrdargs, "--end", "$tend";
push @rrdargs, "--title", "$datestr - $title" unless $light;
push @rrdargs, "--vertical-label", "$title" unless $light;
# lin or log graph?
push @rrdargs, "--logarithmic" if $logscale;
if ( $light ) {
push @rrdargs, "-w";
push @rrdargs, "288";
push @rrdargs, "-h";
push @rrdargs, "150";
push @rrdargs, "--no-legend"; # no legend in small pictures
} else {
push @rrdargs, "-w";
push @rrdargs, "576";
push @rrdargs, "-h";
push @rrdargs, "300";
}
my $i=0;
my $area_set = 0;
my $n = scalar @topN;
push @rrdargs, "COMMENT:Top $n Ports\\n";
if ( $stacked && scalar @topN ) {
my $port = shift @topN;
push @rrdargs, "AREA:Port${port}$colour[$i]:Port ${port}";
$i++;
$area_set = 1;
foreach my $port ( @topN ) {
push @rrdargs, "STACK:Port${port}$colour[$i]:Port ${port}";
$i++;
}
} else {
foreach my $port ( @topN ) {
push @rrdargs, "LINE1:Port${port}$colour[$i]:Port ${port}";
$i++;
}
}
if ( scalar @track_list) {
push @rrdargs, "COMMENT:\\n";
push @rrdargs, "COMMENT:\\n";
push @rrdargs, "COMMENT:Tracked Ports\\n";
}
if ( $stacked && scalar @track_list) {
if ( !$area_set ) {
my $port = shift @track_list;
push @rrdargs, "AREA:Port${port}$colour[$i]:Port ${port}";
$i++;
}
foreach my $port ( @track_list ) {
push @rrdargs, "STACK:Port${port}$colour[$i]:Port ${port}";
$i++;
}
} else {
foreach my $port ( @track_list ) {
push @rrdargs, "LINE2:Port${port}$colour[$i]:Port ${port}";
$i++;
}
}
if ( scalar @skipPorts) {
push @rrdargs, "COMMENT:\\n";
push @rrdargs, "COMMENT:\\n";
my $portlist = join ',', @skipPorts;
push @rrdargs, "COMMENT:Skipped Ports $portlist\\n";
}
my ($averages,$xsize,$ysize) = RRDs::graph( @rrdargs );
if (my $ERROR = RRDs::error) {
print "ERROR: $ERROR\n";
}
} # End of GenPortGraph
sub nftrack_execute {
my $command = shift;
syslog('debug', $command);
my $ret = system($command);
if ( $ret == - 1 ) {
syslog('err', "Failed to execute nftrack: $!\n");
} elsif ($ret & 127) {
syslog('err', "nftrack died with signal %d, %s coredump\n", ($ret & 127), ($ret & 128) ? 'with' : 'without');
} else {
syslog('debug', "nftrack exited with value %d\n", $ret >> 8);
}
} # End of nftrack_execute
#
# Periodic function
# input: hash reference including the items:
# 'profile' profile name
# 'profilegroup' profile group
# 'timeslot' time of slot to process: Format yyyymmddHHMM e.g. 200503031200
sub run {
my $argref = shift;
my $profile = $$argref{'profile'};
my $profilegroup = $$argref{'profilegroup'};
my $timeslot = $$argref{'timeslot'};
syslog('debug', "PortTracker run: Profile: $profile, Time: $timeslot");
my %profileinfo = NfProfile::ReadProfile($profile);
my $netflow_sources = "$PROFILEDATADIR/$profile/$profileinfo{'sourcelist'}";
#
# process all sources of this profile at once
my $command = "$nftrack -L $NfConf::syslog_facility -M $netflow_sources -r nfcapd.$timeslot -d $PORTSDBDIR -A -t $timeslot -s -p -w $PORTSDBDIR/portstat.txt";
nftrack_execute($command);
$command = "$nftrack -d $PORTSDBDIR -S -p -w $PORTSDBDIR/portstat24.txt";
nftrack_execute($command);
#
# Process the output and notify the duty team
syslog('debug', "PortTracker run: Done.");
} # End of run
sub Init {
syslog("info", "PortTracker: Init");
# Init some vars
$nftrack = "$NfConf::PREFIX/nftrack";
$PROFILEDATADIR = "$NfConf::PROFILEDATADIR";
return 1;
}
sub Cleanup {
syslog("info", "PortTracker Cleanup");
# not used here
}
1;