myNMS

Organisation

Major extensions/enhancements

• Status monitoring

  myNMS already has some idea of the status of the switches and routers it polls regularly, and logs additions and changes. This could quite easily be extended to keep track of the state of such devices and to report automatically when any disappears from the network. Compared to systems such as NOCOL and Big Brother this would have the advantage of automatically tracking the installation of new devices on the network instead of having to manually configure new devices into the monitoring application.

  myNMS could/should report when a switch port serving a shared segment (determined by seeing multiple host MAC addresses on it) or an inter-switch link goes down. It could also have a configurable (according to site policy/practice) option to report on, say, router ports which are administratively up but operatinally down.

  However NOCOL, Big Brother etc can also check other services on other devices (e.g. disk space on hosts) so if these functions are required a decision would have to be made whether to integrate such checking functions into myNMS (maybe using monitors from NOCOL/BB etc) or to make myNMS look like another monitor reporting into NOCOL/BB etc.

• Traffic monitoring

  Further from monitoring up/down status of the network devices myNMS knows about would be to gather traffic/performance stats from their interfaces. Here it would probably be worth merging with MRTG for the Round-Robin Data storage system and graphing, but using NET-SNMP (which is part of myNMS anyway) for the data collection.

• Integration with manual records / cable management system

  myNMS could (probably quite easily) be extended to either link to flat files or carry extra SQL tables of manually-maintained data carrying extra information on devices and their interfaces (e.g. patch panel/circuit ID to which each interface of a switch is physically connected).

  It might be possible to link into an existing cable-management system: at the author's site we were looking at the Caplum c-m system with an eye to this possibility.

• Host security/service checking

  myNMS could easily be extended to check for SNMP write communities with 'public', 'private' and well-known names. When new hosts are discovered (or periodically) myNMS could also check other services e.g. www, either explicitly (e.g. by http request) or using nmap or similar tools to map open ports.

Minor upgrades/bug-fixes

• collect info from DHCP server:

  dhcpd.hosts table showing which host MACs are allowed to use DHCP and what hostnames (and therefore IP addresses) they map into

  dhcpd log file, from which we can extract which MACs are requesting addresses via DHCP on which subnets

• Add to table SNMP_ifTable a time column LastUpTime, in SNMP_info set this to LastChangeAt time for which if went from OperStatus = down to up and in Query dot1d display filter on macs seen > LastUpTime

• Move email address and alias fields from passwd table to new table (indexed on username) and change MAP_info and Query to maintain/retrieve from this new structure

• in Query
  • Query_Hosts
    generally this whole code is a mess: should re-write to obtain data from DB in fewer queries, getting IPadd, MAC, Vendor code and connected deviceID/Name and ifIndex/Name in one query (using LEFT JOIN)

    check counting of hosts in pre-cooked hosts queries: numbers don't look right

    flagging of status and counting of 'active' 'recent' 'unreg' etc needs to be improved - make status flags orthogonal i.e. can be 'unreg' AND 'recent' (or not so)

    add count of nMACs (or colour text) to Switch:Port field

    show last username + no of users as per dot1d listing

    use HTML::Table throughout for table generation

  • Merge MACs_Query with Host_Query, get list of all MACs and lookup Switch_Port_by_MACs and report in MACs report as well as hosts
  • improve code for labelling subnets so that ranges not in our list get split up instead of being merged with the last labelled list. Perhaps we sould generate new entries in subnets table (when we get this into DB) as we find them? (Could/should perhaos be done in MAP_info not query)
  • Add specific MAC query to search form and hyperlinked from MAC addresses in other reports, to show e.g. where a MAC has been associated with different IP addresses. This will be particularly useful in conjunction with DHCP hosts.
  • could do with a standard data structure to carry around info derived from database for SNMP system, SNMP interfaces, SNMP ipAddrTable, IP and MAC address, User info etc. This, and functions to populate data structure (getting all OO here :-) can then be used by all functions that display various bits of this info - perhaps the structure currently used in IPadd display could be a starting point
  • Query_User can use select passwd.uid, passwd.username, quotas.bhard, quotas.mtime from passwd LEFT JOIN quotas ON passwd.uid=quotas.uid

• in SNMP_info:
  • fix error: 'update_device_snmp called without IPadd at SNMP_info line 500.'
  • check whether SNMP_ipAddrTable is getting set when a device is first discovered
  • device interface 'Name' is derived from either the ifName or ifDescr, depending on what makes better sense in a particular manufacturere's implementation for a particular type of device: make this mechanism more general, configurable from the My_Config.cf file, and possibly intelligent (try to determine what looks like a meaningful description?)
  • is there any way to determine ethernet interfaces duplex status (either generally or for specific devices or families of devices)?
  • SNMP_info --arp logs occasionally:

    SNMP_info (VER 14.0) at 2001/01/24 18:52:06: get_update_arp_table(947172760)
    usage: /usr/sbin/ping host [timeout]
    usage: /usr/sbin/ping -s[drvRlLn] [-I interval] [-t ttl] [-i interface] host [data size] [npackets]
    

  • SNMP_info --arp seems to be very slow updating IP_MAC table - can we speed it up?
• In DB_maint
  • write consistency checker for SNMP tables (ensure devices exist in each table)
  • rewrite undup code to do SQL "delete .... limit 1" to remove duplicate records, instead of present convoluted way of deleting both/all and then re-inserting a record (is there an SQL construct to delete all but one?)
• purge ancient records from IP_MAC_user table (can do with DB_maint.pl --showtime function)
• change MACs in uppercase to lowercase in IP_MAC_user old records (if any left after purging old ones?)
• MAP_info: quotas: deal with uids in quotas file but not in passwd - maybe read passwd into hash table first and drop records from quotas which don't have passwd entry?
  Update DB for partitions with unreadable quotas files
  *** deal with uids which disappear from passwd whilst remaining in quotas DB
  *** deal with uids with quotas on wrong partitions!

  change DB structure to store netgroups in same way as in NIS maps, but still sanity check them as at present.

  get other NIS tables - - services, group

• LOG_proc: investigate why IP_MAC_user table seems to accumulate duplicates instead of merging older records into later seen ones