Index: ossp-pkg/flow2rrd/flow2rrd.pl RCS File: /v/ossp/cvs/ossp-pkg/flow2rrd/flow2rrd.pl,v rcsdiff -q -kk '-r1.4' '-r1.5' -u '/v/ossp/cvs/ossp-pkg/flow2rrd/flow2rrd.pl,v' 2>/dev/null --- flow2rrd.pl 2004/12/23 21:37:19 1.4 +++ flow2rrd.pl 2004/12/26 12:32:38 1.5 @@ -1,6 +1,6 @@ #!/usr/opkg/bin/perl ## -## OSSP flow2rrd -- Store NetFlow Data in Round-Robin Database (RRD) +## OSSP flow2rrd -- NetFlow to Round-Robin Database (RRD) ## Copyright (c) 2004 Ralf S. Engelschall ## Copyright (c) 2004 The OSSP Project ## @@ -60,7 +60,6 @@ my $opt = { -help => 0, -version => 0, - -verbose => 0, -config => 'flow2rrd.cfg', -store => 0, -graph => 0, @@ -71,8 +70,7 @@ Getopt::Long::Configure("bundling"); my %getopt_spec = ( 'h|help' => \$opt->{-help}, - 'V|version' => \$opt->{-version}, - 'v|verbose' => \$opt->{-verbose}, + 'v|version' => \$opt->{-version}, 'c|config=s' => \$opt->{-config}, 's|store' => \$opt->{-store}, 'g|graph' => \$opt->{-graph}, @@ -84,8 +82,7 @@ print "usage: $my->{-progname} [] \n" . "available options are:\n" . " -h,--help print out this usage page\n" . - " -v,--verbose enable verbose run-time mode\n" . - " -V,--version print program version\n" . + " -v,--version print program version\n" . " -c,--config FILE read this configuration file only\n" . " -s,--store store NetFlow values into RRD\n" . " -g,--graph produce RRD graphs\n" . @@ -233,7 +230,7 @@ my $ctx = &data_init($cfg); # scan flow-tools stream on STDIN for NetFlow records - Cflow::verbose(1); + Cflow::verbose(0); Cflow::find(sub { &foreach_record($cfg, $ctx) }, "-"); sub foreach_record { my ($cfg, $ctx) = @_; Index: ossp-pkg/flow2rrd/flow2rrd.pod RCS File: /v/ossp/cvs/ossp-pkg/flow2rrd/flow2rrd.pod,v rcsdiff -q -kk '-r1.1' '-r1.2' -u '/v/ossp/cvs/ossp-pkg/flow2rrd/flow2rrd.pod,v' 2>/dev/null --- flow2rrd.pod 2004/12/23 21:37:19 1.1 +++ flow2rrd.pod 2004/12/26 12:32:38 1.2 @@ -1,5 +1,5 @@ ## -## OSSP flow2rrd -- Store NetFlow Data in Round-Robin Database (RRD) +## OSSP flow2rrd -- NetFlow to Round-Robin Database (RRD) ## Copyright (c) 2004 Ralf S. Engelschall ## Copyright (c) 2004 The OSSP Project ## @@ -28,15 +28,197 @@ =head1 NAME -B - Store NetFlow Data in Round-Robin Database (RRD) +B - NetFlow to Round-Robin Database (RRD) =head1 SYNOPSIS +B +[B<--config=>I] +B<--store> + +B +[B<--config=>I] +B<--graph> +I[C<:>I]C<@>IC<:>IC<:>IC<:>IC<:>IC<:>IC<:>I ... + +B +[B<--config=>I] +B<--cgi> + +B +B<--version> + +B +B<--help> + =head1 DESCRIPTION +B is a companion tool to the B toolkit for +storing I network traffic data in an accumulating fixed-size +B I (RRD) for visualization purposes. + +The B' B command is a I data +collector which stores received network I data. B +reads these I data and stores it into a backend RRD according to +pre-configured hosts, targets and services. + +B can then generate host/target and target/service graphs +from the accumulated network traffic data. To support easy on-demand +graph generation and displaying, B can be also called +from a Web server through CGI to render a small two-layer Web user +interface showing graphs of all stored data and allowing a single +graph to be displayed with arbitrary size, time-range and data-range +adjustments. + +=head1 OPTIONS + +=over 4 + +=item B<-c>|B<--config> I + +Specifies the path to the F configuration file. +See B section below for details on the +content of the configuration file. + +=item B<-s>|B<--store> + +Enable the I. The B' I data is +expected on F with time-ordered records and with the time of the +first record to be higher than the time of the last record from last +B<--store> operation was. This is a constraint from the backend RRD. + +=item B<-g>|B<--graph> + +Enable the I. On the +command line one or more arguments of the form +I[C<:>I]C<@>IC<:>IC<:>IC<:>IC< +:>IC<:>IC<:>I are expected, each specifying the +content and output format for a particular graph. Actually, this +operation is intended to be used implicitly under the I +(see below), but for debugging and manual post-processing reasons (for +instance to generate graphs for importing into B or similar RRD +based tools) is can be used from the command line, too. + +The I and I syntax parts have to be strings directly +corresponding to the B and B directives in the +configuration file. Specifying just I renders a host/target graph, +specifying I and I renders a target/service graph. + +The I syntax part is just the filename where the graph image +is written to. If it ends with the extension "C<.png>", the image is +generated in PNG format. Else, a GIF format image is generated. + +The I and I syntax parts are the X and Y sizes of the +graph canvas in the generated image. It is I the size of the image +as a whole because of surrounding titles, annotations, etc. Reasonable +specifications are "C<400:100>" or "C<800:200>". + +The I and I syntax parts are the start and end times +(X axis) of the graph. The values effectively are in seconds +since Unix epoch (01-01-1970), but can be also specified as +abbreviated [-+]I[C] (e.g. "C<48h>") or as absolute +I
-I-I (e.g. "C<24-Dec-2004>") times. Additionally, the +time can be relative to each others and to the current time. Finally, +"C" specifies the current time. Reasonable specification is +"C<-48h:now>". + +The I and I syntax parts are the upper and lower (Y +axis) limits of the graph. The values effectively are in Bit/s, but can +be also specified as abbreviated [-+]I[C]. Keep in mind +that usually the upper limit has to be positive and the lower limit +negative. Specifying a limit as "C<0>" means auto-scaling. Reasonable +specifications are "C<0:0>" and "C<2M:-500K>". + +=item B<-c>|B<--cgi> + +Enable the I. This usually has to be used by a CGI +wrapper script placed somewhere in the Web server F directory: + + #!/bin/sh + # I'm /path/to/cgi/flow2rrd.cgi + /path/to/bin/flow2rrd --cgi + +=item B<-v>|B<--version> + +Print the B program version. + +=item B<-h>|B<--help> + +Print a short command line usage. + +=back + +=head1 CONFIGURATION + +B is configured with a configuration file +F (see also option B<--config> above) +with a syntax generated by the following grammar: + + ::= + ::= ( | + | + | + | + )+ + ::= "Database" ";" + ::= "Protocol" ";" + ::= "Service" (.":".(|"*"))+ ";" + ::= "Host" "{" "}" ";" + ::= "Colors" + ";" + ::= + + ::= "Target" "{" "}" ";" + ::= ( | )+ + ::= "Network" + ";" + ::= "Service" + ";" + ::= /(/?[^/]+|/[^/]*)+/ + ::= /[a-zA-Z][a-zA-Z0-9_]*/ + ::= /[0-9]+/ + ::= /[^.]+(\.[^.]+)*/ + ::= /^\d+\.\d+\.\d+\.\d+(/\d+)?$/ + +An example configuration can be seen below under section B: + +=head1 EXAMPLE + + # Round-Robin Database + Database /var/tmp/flow2rrd.rrd; + + # Protocol Definitions + Protocol icmp 1; + Protocol tcp 6; + Protocol udp 17; + Protocol vrrp 112; + + # Service Definitions + Service icmp icmp:*; + Service vrrp vrrp:*; + Service ftp tcp:20 tcp:21; + Service ssh tcp:22; + Service smtp tcp:25; + Service dns udp:53 tcp:53; + Service ntp udp:123 tcp:123; + Service radius udp:1645 udp:1646 udp:1812 udp:1813; + + # Host Definitions + Host host.example.com { + Target host.example.com { + Network 192.168.0.1/32; + Service icmp vrrp dns ntp ssh smtp; + }; + Target service1.engelschall.com { + Network 192.168.0.2/32 192.168.0.3/32; + Service dns smtp; + }; + Target service1.engelschall.com { + Network 192.168.0.2/32 192.168.0.3/32; + Service ftp radius; + }; + }; + =head1 SEE ALSO -flow-capture(1), rrdtool(1). +B Ehttp://www.splintered.net/sw/flow-tools/E, +flow-capture(1), B Ehttp://www.rrdtool.org/E, rrdtool(1). =head1 HISTORY