netflow and cacti

[cigamit]

flowview - again thanks, it works a treat however I was wondering. I work for a international law firm with 12 offices and a fair amount of windows based server. The netflow data is being collected from routers mostly across 2Mb leased lines and a lot of data is hitting CactiEZ flow-tools hence my reason to move Cacti on to one box and move flow-tools off my main cacti server onto its own. Personally I use flowviewer as a web page on a CactiEZ box and link to it from my main Cacti server (windows 2003 Srv, Apache).

The flowview plugin works a treat on the CactiEZ box but would be nice if I could achieve the same from your plugin.

Is it acheivable to have the Flow Tools Binary Path, Flow Tools Work Directory etc. on a remote host.

Hum... I need to make sure that I am understanding you correctly.
Server #1 - has flowtools plugin
Server #2 - has flowtools data and binaries

You want for the plugin on Server #1 to query the data on the Server #2. The simplest way would be to have Cacti (with the plugin) on Server #2 also (Cacti doesn't have to poll anything, just be there) and just remove the "authorization" on the viewer and have it load in an Iframe on #1. Not very secure, but easily workable.

Otherwise, I would have to write separate viewer and "server" modules, and have the client send the form info to the server, parse the info, and then send it all back to the client for viewing. Not extremely hard, just will take a bit of work to also make it secure enough that only authorized users could query it.

[insaneman]

Hy,
I have a fprobe runnning linux that exports the flows twards another machine that runs flow-capture and outputs the files into a directory. My stupid question is ..how can i decode the flow files just 2 be sure that they contain information because flow-viewer is not working properly for me . I added the bin path, and the path that points 2 the directory and when i click flow viewer i dont even get and interface to query (so i think that it is not reading the files )

Thank you.

[CaM]

Hum... I need to make sure that I am understanding you correctly.
Server #1 - has flowtools plugin
Server #2 - has flowtools data and binaries

You want for the plugin on Server #1 to query the data on the Server #2. The simplest way would be to have Cacti (with the plugin) on Server #2 also (Cacti doesn't have to poll anything, just be there) and just remove the "authorization" on the viewer and have it load in an Iframe on #1. Not very secure, but easily workable.

Otherwise, I would have to write separate viewer and "server" modules, and have the client send the form info to the server, parse the info, and then send it all back to the client for viewing. Not extremely hard, just will take a bit of work to also make it secure enough that only authorized users could query it.

Bang on cigamit! Thats the type of setup that would best suit my environment, saves having to let my techies fiddle with my cacti setup.

Thinking about it though your current plugin method is best suited for the masses!

[CaM]

Oops sorry! obviously cant use phpBB ver well!

[gandalf]

Just deleted the redundant posts
Reinhard

[CaM]

thanks lvm!

insaneman: Have you tried flow-print tool that comes with flow-tools ?

As long as flow-print is in your path navigate to your flow files and type:

flow-print < flowfilename

man ages can be found at:
http://www.splintered.net/sw/flow-tools ... print.html

Should spit out out the raw flow data to screen.

Can you confirm which flow-viewer your on about? cigamits plugin or the perl based one listed earlier in the post ?

[cigamit]

Minor update, and a little idea of what I have in store.

Late last night I added support for "relative" times. This allows you to put for instance "NOW" for the End Time (date must be blank) and something like "-2 HOURS" (or minutes or days) in the start time. This way you don't have to keep changing the times to run the report again.

This ofcourse is leading in a very particular direction for a reason. Now that the times can be relative, you will eventually be able to "Save" those "Reports" and re-run them over and over. This will lead to my next feature to implement. Scheduling and emailing the reports. Which seems like it would fairly handy to me.

Most of this is fairly simple, and shouldn't take too long to get going.

[CaM]

Hi cigamit,

This maybe a daft question but how do I remove the "authorization" on the viewer ?

[cigamit]

Hi cigamit,
This maybe a daft question but how do I remove the "authorization" on the viewer ?

I assume you want anyone on your network to be able to view it? Not wise in alot of setups, but if you really want, just remove this from line 4 of flowview.php

Code: Select all

include_once("./include/auth.php");

[CaM]

Hum! Would agree with you!

Thanks for the info though! much appreciated!

[woodgdo1]

Does anyone know if it is possible to url-encode variables to the flowview.php script to automate the output generation? I would like to make a couple of quick links to output for certain network segments to place in my weathermap so I can see who is talking.

Thanks,
Doug

[cigamit]

Does anyone know if it is possible to url-encode variables to the flowview.php script to automate the output generation? I would like to make a couple of quick links to output for certain network segments to place in my weathermap so I can see who is talking.

Thanks,
Doug

Not possible, as it expects a POST form, and not the GET method. This ofcourse is something is that is in the works. You will be able to "save" a search, and rerun it over with a simple link like flowview.php?report=1 and ofcourse you will then be able to set those reports to run automatically and email you the results.

[cromac]

Hi all,

is saving of queries working for you? I am unable to save the query... If I add line into table plugin_flowview_queries manually I am able to update the saved query then.

Any help will be highly appereciated.

Cheers

Cromac

[cigamit]

What browser are you using?

[cromac]

Hi,

I tried this with IE 7 and Firefow 3.0.1. Results were same.

Cromac