End Device Tracking Add-On for Cacti

torstentfk · Post by **torstentfk** » Wed Nov 30, 2005 11:25 am

Hi,

I am using the plugin arch with mactrack.
Versions: RedHat, Cacti 086g, PHP V5.0.5 or PHP V4.3.2 (both installed in separat working dirs.) with snmp-support.mysql 4.1.15.

Nowthing works, no data in table; here the debug output:

Code: Select all

[root@mgt1 plugins]# sudo -u apache /local/soft/soft_php-4.4.1/bin/php /var/www/html/cacti/plugins/mac_track/poller_mactrack.php -f -d 
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=18
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=22
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=21
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=20
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=19
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=16
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=15
DEBUG: A process launch just occurred.
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=17
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=23
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=25
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=26
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=27
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=28
DEBUG: A process launch just occurred.
DEBUG: Finished associating IP addresses with MAC addresses.
DEBUG: Finished transferring scan results to main table.
DEBUG: Finished updating site table with collection statistics.
11/30/2005 05:17:03 PM - SYSTEM MACTRACK COLLECTION STATS: Time:4.1795 ConcurrentProcesses:7 Devices:13

What should I do to get this running?

Torsten
[/code]

cigamit · Post by **cigamit** » Wed Nov 30, 2005 2:51 pm

torstentfk wrote:Hi,

I am using the plugin arch with mactrack.
Versions: RedHat, Cacti 086g, PHP V5.0.5 or PHP V4.3.2 (both installed in separat working dirs.) with snmp-support.mysql 4.1.15.

Nowthing works, no data in table; here the debug output:
Code: Select all
[root@mgt1 plugins]# sudo -u apache /local/soft/soft_php-4.4.1/bin/php /var/www/html/cacti/plugins/mac_track/poller_mactrack.php -f -d 
DEBUG: CMD: /local/soft/php/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=18
What should I do to get this running?

Torsten

What output do you get if you execute

Code: Select all

sudo -u apache /local/soft/soft_php-4.4.1/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=19 -d

from the command line?

torstentfk · Post by **torstentfk** » Thu Dec 01, 2005 3:41 am

Hi cigamit,

Code: Select all

[root@mgt root]# pwd
/root
[root@mgt root]#sudo -u apache /local/soft/soft_php-4.4.1/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=19 -

Warning: chdir(): Permission denied (errno 13) in /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php on line 2

Warning: main(./include/config.php): failed to open stream: Permission denied in /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php on line 25
........

changed chdir() in mactrack_scanner.php to chdir('/var/www/html/cacti/');

so I get with your command:

Code: Select all

[root@dcimgt21 root]# sudo -u apache /local/soft/soft_php-4.4.1/bin/php -q /var/www/html/cacti/plugins/mac_track/mactrack_scanner.php -id=19 -d
 DEBUG: HOST: all46rs1 is alive, processing has begun.
12/01/2005 09:30:35 AM - POLLER: Poller[0] HOST: r1 is alive, processing has begun.
DEBUG: atifIndexes data collection complete
DEBUG: atPhysAddress data collection complete
DEBUG: atNetAddress data collection complete
DEBUG: atEntries assembly complete.
DEBUG: SQL: INSERT INTO mac_track_ips (site_id,device_id,hostname,description,port_number,mac_address,ip_address,scan_date) VALUES ('1','19','r','r1','1','NOT USER','XXX.XXX','2005-12-01 07:40:20')
DEBUG: SQL: INSERT INTO mac_track_ips (site_id,device_id,hostname,description,port_number,mac_address,ip_address,scan_date) VALUES ('1','19','r','r1','1','NOT USER','xxx.XXX','2005-12-01 07:40:20')

Next i tried to run the poller command with -f option: Now it runs.

But the router devices are in status "N/A", The active MACs are zero , total ports are filled up and cacti found some Trunk-ports.

Must I inlcude all switches in the switching-domain to get mac-track running?

Btw: The Typ Switch/Hub Switch/Router Router is a little bit confusing: A layer-3 switch is a router or switch/router?

we are catalyst4948, too. How could I expand the Device-Types?

Torsten

Post by **TheWitness** » Thu Dec 01, 2005 5:43 am

Torsten,

The Switch/Hub, Switch/Router, Router can be confusing. To help explain the confusion:

Swtich/Hub - L2 Device
Switch/Router - L2/L3 Device (Including L3 Switch)
Router - L3 Device Only (Not L3 Switch)

It sounded good at the time.

I still have some work to do on the End Device Tracking. However, I have been pre-occupied with the forthcoming release of Cacti 0.8.6h and Cactid 0.8.6g.

We will be testing the new releases this weekend. Maybe I can get some time to get the Device Type engine functional and post another version for Cigamit to package.

TheWitness

torstentfk · Post by **torstentfk** » Thu Dec 01, 2005 7:59 am

Hi,

thanks for clearyfing the wording.

I have checked the file mactrack_scanner.php and found that all device types are hard coded and not readed from the db. Bug or wanted? (seems that the function find_scanning_function() is not called)

After changing it, mactrack recognizes the cisco types, polls them.

Feature request: Device type string in the DB should not be case sensitive.

For the plugin I have found a bug:
- If I add a new device type, the vendor descriptions is not saved. Other settings are saved, but an error message is displayed saying "Error: Save Failed", but setting are applied to the db.

- Bug found with myphpadmin: in the table "mac_track_ip" column "mac_address" has wrong macs:
"35:20:20:4C:" is stored instead of ....(seems to be to short...)
could not find the place in the source code where the polled MAC is formated...
Update: Change the polling from snmpv1->v2 and the MACs are correct inserted and listed in column.
Now I tried to display this MACs in the cacti-page/pluginpage "mactrack": No display here.
Update:: At the "Mac Track Results Filtering" in sites the "All" does not work; you must select a side and then db is displayed: GREAT WORK!!!!

- At the function desc, it shows that for a router you do not have give the discover function. Is that correct?

-Router-Devices are always N/A in all columns.

Torsten...patient waiting for release 0.86x and then mactrack

night199uk · Post by **night199uk** » Fri Dec 02, 2005 6:10 am

Having some problems getting this to work with our 6509/Sup2 IOS combos. The insert for the mac_track_ips table seems to work but I believe the inner join requires that an insert also happens on mac_track_temp_ports to correlate the data, and mac_track_temp_ports doesn't seem to be being populated at the moment. I'm trying to work on what this is and debug it. It seems we register 0 active ports at the moment on a very populated switch.

I've also added a test for our Sup720 boxes to mactrack_scanner.php:
}elseif (substr_count($device["snmp_sysDescr"], "c6sup2") || (substr_count($device["snmp_sysDescr"], "s72033_rp"))) {

This doesn't do much at the moment, so I'm taking a look at that aswell.

Also, I note you remove trunk ports from the equation so it seems? The biggest application I can see for this in our network is tracking Cisco IP Phones at some remote sites where we have 6509s. All of the phone ports are trunk ports, therefore I'm not sure if this is something that could be done? I havn't thought through the logistics yet of this.

Post by **TheWitness** » Fri Dec 02, 2005 7:05 am

What is the trunk status for those 6509's. I am specifically eliminating trunk ports in that they will carry the MAC's of all downstream devices, which is not the objective. There must be another distinguishing MIB OID that will infer something like:

If Trunk Port Then
If CiscoIPPhone Port
add_port to array
Else
ignore port
Endif
Else
add_port to array
Endif

With regard to your IOS 6509's, I might have introduced a change that had a negative impact on port counts. I will check this morning.

Finally, since at our office, we do not use Cisco IP Phones, you will have to lead that investigation.

TheWitness

Post by **TheWitness** » Fri Dec 02, 2005 7:08 am

I just verified that I did in fact host the 6509 IOS algorythm. I will post a patch.

TheWitness

night199uk · Post by **night199uk** » Fri Dec 02, 2005 8:24 am

Cool on the patch, I'm most of the way there with debugging it anyway - it seems to trunk Status isn't getting pulled/checked properly. Will let you know once I've found it unless you post your patch if this fixes it.

Thinking about the trunk port algorithm, it's not only trunk ports that carry MAC addresses for downstream devices - for example in two areas of our network we have two switches linked just with a crossover in VLAN1, therefore we see MACs for all devices on both sides of the switches through the crosslink port. I think previously I have seen code that tries to do this using some kind of tree algorithm, similar to spanning tree to work out where devices are located and eliminate these crosslinked ports.

In fact, I've just thought of a possible way of doing this more effectively - you could query for the MAC address of the switch itself and if we see the MAC address of another switch through the port then ignore that port? This might work where STP/CDP and such are enabled and we would see regular STP/CDP packets from the connected switch which would keep the FDB entry alive, and allow you to use trunk links between switches/routers/phones and only eliminate the switch->switch trunks/crosslinks.

Post by **TheWitness** » Fri Dec 02, 2005 8:40 am

Here is the revised mactrack_cisco.php

TheWitness

olba · Post by **olba** » Fri Dec 02, 2005 9:08 am

hi,

let me first write: this plugin is really great!!!!!!!
But i´ve got a problem to get any information from our 6509.
I only get the number of ip´s but nothing more.

The log gives an error message:

"TYPE: Cisco Internetwork Operating System Soft, Unsupported device. "

what´s my mistake?

Thanks

torstentfk · Post by **torstentfk** » Fri Dec 02, 2005 10:13 am

Hi

in mactrack_scanner the type of cisco switch/router is hard coded; I changed the lines 150ff to

Code: Select all

                }elseif (substr_count($device["snmp_sysDescr"], "IOS")) {
                        if ((substr_count($device["snmp_sysDescr"], "C2950")) ||
                                (substr_count($device["snmp_sysDescr"], "C3750")) ||
                                (substr_count($device["snmp_sysDescr"], "s72033_rp")) ||
                                (substr_count($device["snmp_sysDescr"], "s72033_rp-PK9SV-M")) ||
                                (substr_count($device["snmp_sysDescr"], "C4500-IS-M")) ||
                                (substr_count($device["snmp_sysDescr"], "C6MSFC2-PSV-M")) ||
                                (substr_count($device["snmp_sysDescr"], "cat4000-IS-M")) ||
                                (substr_count($device["snmp_sysDescr"], "c6sup2_rp-PSV-M")) ||
                                (substr_count($device["snmp_sysDescr"], "C3550")) ||
                                (substr_count($device["snmp_sysDescr"], "C7200-JS-M")) ||
                                (substr_count($device["snmp_sysDescr"], "C5RSM-JSV-M")) ||
                                (substr_count($device["snmp_sysDescr"], "4000 L3")) ||
                                (substr_count($device["snmp_sysDescr"], "C3560"))) {
                                get_IOS_dot1dTpFdbEntry_ports($site, $device);

Now cisco 6509 are working. Perhaps in the next version reading the types from the db is supported.

Torsten

Post by **TheWitness** » Fri Dec 02, 2005 11:43 am

I hope to post today (GMT-5).

TheWitness

jarhead · Post by **jarhead** » Fri Dec 02, 2005 12:05 pm

Larry,
If you have some time this morning I can set up another online session to do some more troubleshooting.

cpdans · Post by **cpdans** » Fri Dec 02, 2005 2:53 pm

Hello all, great script but I have a problem with it. I have setup just 1 device for now and set my run time to 5 minutes in advance and let the poller run...at the end of the cacti.log file I get the following:

12/02/2005 01:40:27 PM - SYSTEM MACTRACK COLLECTION STATS: Time:2.0194 ConcurrentProcesses: Devices:1

Now, when I go back to the mactrack tab nothing shows up, nor does anything show up in the devices tab. After reading through the list I tried to run the poller manually using:

php poller_mactrack.php -f -d

When I do that I get:

ERROR: Invalid Parameter -f

Network Mac Tracker Master Process Control Version 1.0, Copyright 2005 - Larry Adams

usage: poller_mactrack.php [-sid=site_id] [-d] [-h] [--help] [-v] [--version]

-sid=site_id - the mac_track_sites site_id to scan
-d - Display verbose output during execution
-v --version - Display this help message
-h --help - display this help message

Not sure what I am doing wrong but I would love any input anyone has. Thanks again for all the hard work with this.

Dan

End Device Tracking Add-On for Cacti

Who is online