Barracuda Spam Firewall Templates

[ceyounger]

I figured it's time for me to give back to the community that has given me so much.

I took the OP's Barracuda (SNMP) templates and souped them up a bit. I attached what I hope is the full xml with dependancies. Since this is the first time I'm submitting anything to the forum, let me know if I need to export all data templates and graphs templates separately.

Anyway, if you have a Barracuda 400 or higher, these should work!

My memory graph sucks and I know it. I got lazy trying to figure out how Barracuda manages memory so I gave up and I left it as is.

CPU--well...either mine is not busy or I picked the wrong OIDs...

[eschoeller]

These are great. We have a bunch of these devices ... Any idea how I could graph them all on the same chart?

Thanks,

[ceyounger]

These are great. We have a bunch of these devices ... Any idea how I could graph them all on the same chart?

Thanks,

Interesting issue. I have 2 Barracudas and I didn't think about aggregating them. However you can install the Plugin Architecture and the Aggregate plugin. Once you have those two mods, you should be able to mash the graphs of your multiple Barracudas together for RRD graphing goodness. The Aggregate Plugin takes some practice (hint: keep your graph elements to a minimum at first) but it saves alot of work!

If you're no fan of Plugins, then you'll have to build a multiple data source graph manually. My explanation of doing it is not that good--but search the forums if you'd like to go that route. You'll learn alot about Cacti if you!

I tend to be a sadist and build the multi data source graphs manually (I prayed for a simple way to aggregate before!) but I also have alot of time on my hands and little life aside from work.

Good luck!

[eschoeller]

Before you even mentioned it, I stumbled upon the aggregate plugin and went to work.

I must say I'm quite pleased. I now have aggregate graphs of Inbound message queue sizes and 1 minute load averages for all six of our inbound barracuda devices.

Very impressive considering that only 3 hours ago I had no apache, mysql, php, or cacti at all. I pay many thanks to the debian developers for creating a kick a$$ distro.

After madly clicking around for about 30 minutes (This is how I get along with cacti!) I figured out how to get the barracuda template and aggregate plugin meshing the way I wanted. Choosing the colors for the six lines ended up being the hardest part in the end

If anyone needs help or suggestions on how to do this, feel free to ask!

[ceyounger]

Yeah, that aggregate plugin would've saved me about a weeks worth of work earlier this year! Just imagine aggregating 100 webserver clusters into total inbound/outbound network traffic (remind me to kill the developers of M$ WLBS)...but I digress.

Glad you got it working. I may have to do that too.

[eschoeller]

How would you go about graphing daily queue totals ? I'd like to see total number of messages processed in a single day, graphed out. I'm almost thinking i'd have to write a custom CDEF but I'm not sure ...

[ceyounger]

Hmm, I don't know how you'd do that accurately. I just have the boxes email me the reports.

You could try putting a summary as the last element in aggregate graphs that totals all data sources. Try playing with it by adding a comment like this:

Code: Select all

|sum:auto:current:0:auto|

Make sure your CDEF function is Total All Data Sources.

Play with it a little, but that' how I'd start.

[rmrf]

Here are some Barracuda Spam Firewall templates that we have been using. I have these running against 4 of these appliances on 2 different Cacti servers.

Hi all,

I've installed this package but I cant get the Total Performance and others to graph. I get "nan" but the Mail Queues is graphing.

I'm using Version 0.8.7b of Cacti and Firmware v3.5.10.019 for my 'cuda's.

any help is appreciated as this is the last piece for completing my Cacti SNMP collection.

Thanks
-C

[rmrf]

so looking at the graphs, I changed the port number from 8000 to 80 but still the same results.

it runs from the commandline with no issues
[cactiuser@frogger scripts]$ whoami
cactiuser
[root@frogger scripts]$ php barracuda_total.php mx1
allowed:3228531 blocked:34459173 quarantined:6507 tagged:361107 viruses:74416

File Permissions
-rwxr--r-- 1 cactiuser cactiuser 795 Mar 3 10:23 barracuda_perf.php
-rwxr--r-- 1 cactiuser cactiuser 464 Mar 3 10:23 barracuda_temp.php
-rwxr--r-- 1 cactiuser cactiuser 1934 Mar 3 10:22 barracuda_total.php

Graph debug mode has no errors
RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="Barracuda - Total Performance" \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="# of Mails" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":viruses:AVERAGE \
DEF:b="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":viruses:MAX \
DEF:c="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":quarantined:AVERAGE \
DEF:d="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":quarantined:MAX \
DEF:e="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":allowed:AVERAGE \
DEF:f="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":allowed:MAX \
DEF:g="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":blocked:AVERAGE \
DEF:h="/var/www/html/cacti/rra/gap-mx1_allowed_358.rrd":blocked:MAX \
CDEF:cdefa=a,60,* \
CDEF:cdefb=a,300,* \
CDEF:cdefd=b,300,* \
CDEF:cdefe=c,60,* \
CDEF:cdeff=c,300,* \
CDEF:cdefh=d,300,* \
CDEF:cdefi=a,60,* \
CDEF:cdefj=a,300,* \
CDEF:cdefbc=e,60,* \
CDEF:cdefbd=e,300,* \
CDEF:cdefbf=f,300,* \
CDEF:cdefbg=g,60,* \
CDEF:cdefbh=g,300,* \
CDEF:cdefbj=h,300,* \
AREA:cdefa#FF7D00FF:"Viruses" \
GPRINT:cdefb:LAST:" Current\:%8.00lf %s" \
GPRINT:cdefb:AVERAGE:"Average\:%8.00lf %s" \
GPRINT:cdefd:MAX:"Maximum\:%8.00lf %s\n" \
AREA:cdefe#862F2FFF:"Quarantined":STACK \
GPRINT:cdeff:LAST:"Current\:%8.0lf %s" \
GPRINT:cdeff:AVERAGE:"Average\:%8.0lf %s" \
GPRINT:cdefh:MAX:"Maximum\:%8.0lf %s\n" \
AREA:cdefi#00A348FF:"Tagged":STACK \
GPRINT:cdefj:LAST:" Current\:%8.0lf %s" \
GPRINT:cdefj:AVERAGE:"Average\:%8.0lf %s" \
GPRINT:cdefj:MAX:"Maximum\:%8.0lf %s\n" \
AREA:cdefbc#00FF00FF:"Allowed":STACK \
GPRINT:cdefbd:LAST:" Current\:%8.0lf %s" \
GPRINT:cdefbd:AVERAGE:"Average\:%8.0lf %s" \
GPRINT:cdefbf:MAX:"Maximum\:%8.0lf %s\n" \
AREA:cdefbg#6DC8FEFF:"Blocked":STACK \
GPRINT:cdefbh:LAST:" Current\:%8.0lf %s" \
GPRINT:cdefbh:AVERAGE:"Average\:%8.0lf %s" \
GPRINT:cdefbj:MAX:"Maximum\:%8.0lf %s\n"

RRDTool Says:

OK

[ceyounger]

I'm curious to see if SNMP from your Cacti box to the Barracuda is working. Also, remember to set your device entry to SNMP version 1 as the 'cuda doesn't appear to be SNMP v2 (or V3) compliant.

You should run a command like so (from your Cacti box):

Code: Select all

[root@cactibox ~]# snmpwalk -v 1 -c public cuda.test.com
SNMPv2-MIB::sysDescr.0 = STRING: Barracuda Spam Firewall
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (42205593) 4 days, 21:14:15.93
SNMPv2-MIB::sysContact.0 = STRING: <support@barracudanetworks.com>
SNMPv2-MIB::sysName.0 = STRING: Barracuda
...
...
...

You will note I left the community string public in there because the 'cuda also only understands "public" as their community string! Thank God for firewalls!

Remember to add the IP your Cacti box uses to talk to the 'cuda in Allowed SNMP/API section of the administration page.

Good luck!

[rmrf]

Hi Ceyounger,

snmpwalk does return data

[root@frogger crosa]# snmpwalk -v 1 -c public cuda
SNMPv2-MIB::sysDescr.0 = STRING: Barracuda Spam Firewall
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (34713160) 4 days, 0:25:31.60
SNMPv2-MIB::sysContact.0 = STRING: <support@barracudanetworks.com>
SNMPv2-MIB::sysName.0 = STRING: Barracuda
SNMPv2-MIB::sysLocation.0 = STRING: unknown
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
SNMPv2-MIB::sysORID.1 = OID: IF-MIB::ifMIB
SNMPv2-MIB::sysORID.2 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.3 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.4 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.5 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.6 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORDescr.1 = STRING: The MIB module to describe generic objects for network interface sub-layers
SNMPv2-MIB::sysORDescr.2 = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr.3 = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr.6 = STRING: View-based Access Control Model for SNMP.

...and so on

I did modify the php scripts for port 80 and the graphs to use the IP.

[rmrf]

***** Now Working **********

I got another pair of eyes to look at my dirty work...

running the scripts from the command line

[root@frogger scripts]# /usr/bin/php /var/www/html/cacti/scripts/barracuda_perf.php mx1
fw_storage_used:46 mail_storage_used:43

output from cacti.log



03/04/2008 01:22:33 PM - CMDPHP: Poller[0] Host[30] RECACHE: Processing 1 items in the
auto reindex cache for '172.16.68.163'.
03/04/2008 01:22:33 PM - CMDPHP: Poller[0] DEBUG: SQL Exec: "update poller_reindex set
assert_value='35947987' where host_id='30' and data_query_id='1' and arg1='.1.3.6.1.2
.1.1.3.0'"
03/04/2008 01:22:33 PM - CMDPHP: Poller[0] Host[30] DS[417] CMD: /usr/bin/php /var/www
/html/cacti/scripts/barracuda_temp.php 172.16.68.163, output: temp:
03/04/2008 01:22:33 PM - CMDPHP: Poller[0] DEBUG: SQL Exec: "insert into poller_output
(local_data_id, rrd_name, time, output) values (417, 'sys_temperature', '2008-03-04 1
3:22:33', 'temp:')"
03/04/2008 01:22:33 PM - CMDPHP: Poller[0] Host[30] DS[414] SNMP: v1: 172.16.68.163, d
sname: traffic_out, oid: .1.3.6.1.2.1.2.2.1.16.2, output: 1411566403

[edb]

This is working fine for me other than the "mail queues" graph.

It gets no data for the graph. Any ideas would be appreciated.

Thanks

edb

[edb]

Never mind ... I guess you need to have something in the queue before it will graph anything. Duh!!

It's all good now

edb

[zeki]

Dumb question but how do I enable SNMP on my Barracuda? I've looked and can't seem to find it.

Go to Basic>Administration>Allowed SNMP and API IP/Range