Barracuda Spam Firewall Templates

[cypherx]

I can't find this anywhere, but we have a Barracuda Web Filter - NOT a Spam firewall. Will this work with the Web filter? I want to monitor bandwidth passing through the web filter and cannot find what the SNMP OID is for this data.

I've imported this template and have CPU and Memory usage showin, however the Interface - Traffic (bits/sec) will not create a graph (broken image icon). Here is an output from the RRDTool command:
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-60 \
--title="Barracuda Web Filter - Traffic" \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bits per second" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/barracuda_web_filter_traffic_in_1042.rrd":traffic_in:AVERAGE \
DEF:b="/var/www/cacti/rra/barracuda_web_filter_traffic_in_1042.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdeff=b,8,* \
AREA:cdefa#00CF00FF:"Inbound" \
AREA:cdefa#96E78A99:"" \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:cdeff#002A97FF:"Outbound" \
GPRINT:cdeff:LAST:"Current\:%8.2lf %s" \
AREA:cdeff#4444FF33:"" \
GPRINT:cdeff:AVERAGE:" Average\:%8.2lf %s" \
GPRINT:cdeff:MAX:"Maximum\:%8.2lf %s"
RRDTool Says:
ERROR: opening '/var/www/cacti/rra/barracuda_web_filter_traffic_in_1042.rrd': No such file or directory

Thank you for your assistance!

[cynicismic]

I can't find this anywhere, but we have a Barracuda Web Filter - NOT a Spam firewall. Will this work with the Web filter? I want to monitor bandwidth passing through the web filter and cannot find what the SNMP OID is for this data.

AFAIK, statistics for CPU/memory/interfaces should all be standard linux ones under the UCD/NET MIB.

[ubik]

I added a graphtemplate for blocked and allowed(Total Counter) emails.
For Blocked i only used Blocked Inbound Total as we dont use the barracudas for outbound scanning.
If you want to see in and outbound blocked you have to add another oid data template with the right OIDs.

greez ubik

[prospero63]

I added a graphtemplate for blocked and allowed(Total Counter) emails.
For Blocked i only used Blocked Inbound Total as we dont use the barracudas for outbound scanning.
If you want to see in and outbound blocked you have to add another oid data template with the right OIDs.

greez ubik

I imported this and it's reporting the following:

12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[107] SNMP: v2: hostname, dsname: blocked_total, oid: 1.3.6.1.4.1.20632.2.20, output: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[107] WARNING: Result from SNMP not valid. Partial Result: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[106] SNMP: v2: hostname, dsname: allowed_total, oid: 1.3.6.1.4.1.20632.2.35, output: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[106] WARNING: Result from SNMP not valid. Partial Result: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[105] SNMP: v2: hostname, dsname: traffic_out, oid: .1.3.6.1.2.1.31.1.1.1.10.2, output: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[105] WARNING: Result from SNMP not valid. Partial Result: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[105] SNMP: v2: hostname, dsname: traffic_in, oid: .1.3.6.1.2.1.31.1.1.1.6.2, output: U
12/12/2012 01:10:17 PM - CMDPHP: Poller[0] Host[6] DS[105] WARNING: Result from SNMP not valid. Partial Result: U

Any idea what the issue is?

[prospero63]

Any idea what the issue is?

I believe I figured this out. It looks like the blocked email OIDs, etc. are only supported on the 5.1 firmware, of which I'm not currently running.

5.1 SNMP Support:
https://www.barracudanetworks.com/docs/ ... mp_5.1.pdf

4.x-5.0 SNMP Support (much fewer OIDs):
https://www.barracudanetworks.com/docs/ ... mp_4_5.pdf

[neodawg]

Does anyone know how to fix this issue? The In/Out queues graph 'resets' back to 0 every time it hits 255 messages in the queue. the first spike on the left is accurate after that you need to add them, so the 2nd spike means there is 510 in the queue.

Thanks for any help or suggestions.

[prospero63]

On the surface that strikes me as a bit count issue (32bit vs. 64bit counters, etc.).

[neodawg]

I was thinking something the same but could not find where to change this to a 64bit counter. Any suggestions?

[prospero63]

Alas in that regard I'm about as worthless as teats on a bull. I'm with you on the logic, but don't have the slightest idea where to look to make the change (or whether it's a bug with barracuda and they need to fix their MIB).

[neodawg]

I think your right, it is a bug with Barracuda, I never really tried to fix this till today. The attached image and the value that is in there should be about 7000 not 27.
that was doing a snmp walk for:

Code: Select all

.1.3.6.1.4.1.2021.8.1.100

EDIT:
I think I found the correct OID for it, after doing a walk and using the GUI value on the interface to find it in the walk I think I have pinned it down, see attached graphic.
I am going to change my DS template and see what happens.

4-10-2013 4-51-18 PM.png (11.06 KiB) Viewed 3033 times

[monloi]

Hi, has anyone tried creating a template for Barracuda load balancers?