IronPort C10 Mail & Spam Appliance

[aleu]

I've got a set of templates that polls the ESA for ~25 more data points and graphs them. I'm making sure I've got authorization to release the poller script (hits the status xml page instead of the snmp daemon), and then I'll post it all.

IF I don't get authorization, I'll still release the template and just tell you what the script does, it's pretty simple.

Great. We are waiting for the templates.

[aleu]

I've got a set of templates that polls the ESA for ~25 more data points and graphs them. I'm making sure I've got authorization to release the poller script (hits the status xml page instead of the snmp daemon), and then I'll post it all.

IF I don't get authorization, I'll still release the template and just tell you what the script does, it's pretty simple.

Any update on this? Will you be able to share the templates?

[gninja]

Looks like I'll be able to share everything, but I've got to wait for one of our law-people to get back from xmas vacation so he can tell me if I need to make sure the company name is up near the top of the poller script, in bold letters. Or if I need to make sure the company name isn't associated with it at all.

Sorry about the delay.

[gninja]

Here you go, gents.

XML template is built off of superdave913's original template, but there's a lot more information here. Shiny shiny information.

Device is polled both through snmp and through the web ui. Polling appears to introduce minimal to no load to the box, though that may change if you disable http and force https polling.

You'll need to update the data input method to reflect your esa admin password.

EDIT: updated to v1.1 of the poller script to automatically handle http and https. http is tried first, if it fails, https is tried. If that fails, then it exits.

[apperrault]

Gninja,
I would love new scripts for my IronPort devices. One question, your script is a python script, i assume that i need to install Python on my cacti server?

Do you have pictures of the graphs produced?

thanks

app

[gninja]

Yes, you would need to install python to run the script.

You could also look through it and rewrite it in php or perl if that is better for you. It's not a very complex poller script.

List of graphs in the host template:

Traffic (displays average and peak)
Hard Bounce - 5xx
Hard Bounce - DNS
Hard Bounce - Expired
Hard Bounce - Filter
Soft Bounce - Events
Connections In/Out
CPU Usage
Disk IO
Dns Requests - Outstanding/Pending
Gen Bounce Recipients
Global Unsub Hits
Mail Transfer Threads
Memory Usage
Messages Dropped
Messages in Work Queue
Messages Injected
Open Files/Sockets
Queue Utilization
Recipients Completed
Recipients Deleted
Recipients Injected
Recipients Other - Hard bounce
Recipients Rejected
Ping Latency

I'll see what I can do about posting images later.

[aleu]

List of graphs in the host template:

gninja, first of all thank you for sharing this template (nice work). However, it seems to me that it does not work if https is enabled instead of http. I get the following error when try to use your script with https:

Traceback (most recent call last):
File "./cacti_check_esa.py", line 52, in ?
client = urllib2.urlopen(url)
File "/usr/lib/python2.4/urllib2.py", line 130, in urlopen
return _opener.open(url, data)
File "/usr/lib/python2.4/urllib2.py", line 358, in open
response = self._open(req, data)
File "/usr/lib/python2.4/urllib2.py", line 376, in _open
'_open', req)
File "/usr/lib/python2.4/urllib2.py", line 337, in _call_chain
result = func(*args)
File "/usr/lib/python2.4/urllib2.py", line 1021, in http_open
return self.do_open(httplib.HTTPConnection, req)
File "/usr/lib/python2.4/urllib2.py", line 996, in do_open
raise URLError(err)
urllib2.URLError: <urlopen error (111, 'Connection refused')>

The same executed with http enabled on the interface works fine.

You have mentioned that the admin password is hardcoded in the Data Input method. What do you advise to do when using 9 IronPort appliances and almost every unit has its own admin password?

Thanks,
AL

[gninja]

List of graphs in the host template:

gninja, first of all thank you for sharing this template (nice work). However, it seems to me that it does not work if https is enabled instead of http. I get the following error when try to use your script with https:

Try editing line 45 of the script, changing http to https. If that doesn't work, I'll see what needs to be changed, tomorrow, as well as getting it updated to handle both.

You have mentioned that the admin password is hardcoded in the Data Input method. What do you advise to do when using 9 IronPort appliances and almost every unit has its own admin password?

Hrm, I'll update the template to have that set at the data source level, tomorrow.

[aleu]

Try editing line 45 of the script, changing http to https. If that doesn't work, I'll see what needs to be changed, tomorrow, as well as getting it updated to handle both.

Hmm, lame me Correcting this entry worked of course. I should have noticed that.

Hrm, I'll update the template to have that set at the data source level, tomorrow.

Great. Thanks again.

[apperrault]

GNinja,
These look great. I am having a problem though with some of the graphs, most of them actually. I am getting the following in the error log:

Code: Select all

 01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8231] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8230] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8219] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8224] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8234] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8222] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8240] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8239] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8245] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8244] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8243] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8242] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8241] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8236] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:26 AM - CMDPHP: Poller[0] Host[278] DS[8217] WARNING: Result from SNMP not valid. Partial Result:
01/11/2008 07:15:25 AM - CMDPHP: Poller[0] Host[278] DS[8218] WARNING: Result from SNMP not valid. Partial Result:
01/11/2008 07:15:25 AM - CMDPHP: Poller[0] Host[278] DS[8221] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:25 AM - CMDPHP: Poller[0] Host[278] DS[8220] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:25 AM - CMDPHP: Poller[0] Host[278] DS[8223] WARNING: Result from CMD not valid. Partial Result:
01/11/2008 07:15:25 AM - CMDPHP: Poller[0] Host[278] DS[8225] WARNING: Result from SNMP not valid. Partial Result:

The one for DS8225, i know why i am getting that error message, it is because the C30s that we have no longer have the Temperature sensors, so i need to disable that check. The other ones, i don't understand what is going on. When i try and run the script manually:

Code: Select all

e:\python25\python.exe cacti_check_esa.py -p XXXXXX 10.4.200.20

i get the following results:

Code: Select all

inj_msgs:18216117 inj_recips:20781516 gen_bounce_recips:4465172 rejected_recips:1336329 dropped_msgs:503936 soft_bounced_evts:3755723 completed_recips:20213813hard_bounced_recips:7342624 dns_hard_bounced_recips:157890 5xx_hard_bounced_recips:2402225 filter_hard_bounced_recips:4166702 expired_hard_bounced_recips:615807 other_hard_bounced_recips:0 delivered_recips:12870849 deleted_recips:340 global_unsub_hits:0 conn_in:2 conn_out:0

so it appears that the data is able to be gathered, but for some reason, it is not getting passed to the proper items.

Can you offer any assistance with this? Should i post a full debug log of a poller pass?

let me know

thanks

app

[spoonman]

Has anyone dealt with an IronPort S650 WebSecurity appliance...We just got one and would like to get some info stats from it??

[gninja]

Can you offer any assistance with this? Should i post a full debug log of a poller pass?

Sorry I missed it when you posted this originally. If you're still having problems, let me know and I'll see what I can figure out.

[gninja]

Has anyone dealt with an IronPort S650 WebSecurity appliance...We just got one and would like to get some info stats from it??

The poller script should work just fine on the S650 WSA. Try it out, if it doesn't work, I'll track one down and figure out what the problem is.

[spoonman]

I could not get SNMP interface stats to work...although i can walk the box with certain OIDs....most of the graphs in your script i believe would not work either since its a web security box rather than mail appliance.....see what you can digg up? that would be awesome.

[gninja]

Might take me a couple days, but I've got one in my network now, that I need to graph anyway.