Use mrtg to indentify bandwidth hogs

mrtg

Can I use my mrtg setup to somehow identify which IPs are eating all my bandwidth? Or is there another tool that I can use to do this against my Cisco PIX?

Thanks!

Best Answer

MRTG is great for pulling counters from network interfaces (and temperatures, and CPU usage, and other things, too). If a device doesn't provide an SNMP-accessible counter for what you want to measure, though, MRTG won't be a lot of help.

In the case of a Cisco PIX, no SNMP counters are provided in its MIB for "sessions". The PIX is capable of reporting the setup and take-down of NAT table entries (including the number of bytes moved in the "conversation") via SYSLOG.

A tool that I have no personal experience with, but that looks interesting, is FirePlotter.

I do have some experience with the PIX Logging Architecture open source project, which gets its data from SYSLOG output from PIX / ASA firewalls. Its database schema doesn't capture the bytes transferred from the log entries, though, so you can't do any reporting on bandwidth usage. (It would probably be fairly easy to add, but their database choice, MySQL, turned me off to the idea of helping out with their project...)

Related Solutions

“Unable to open MRTG log file” error with nagios and mrtg

I solved problem configuring command like this:

define command{

        command_name check_local_mrtgtraf
        command_line $USER1$/check_mrtgtraf $ARG1$ 10 AVG $ARG2$ $ARG3$ $ARG4$ 

}

and defining service like this:

define service {
        use ...
        host_name ....
        ...
        check_command        check_local_mrtgtraf!path_to_logfile!30,40!100,200!10
}

Linux – MRTG Configured; Need to monitor 1-2 Interfaces; Not All

It should be as simple as taking the unwanted interfaces out of your mrtg.cfg file. Each interface should have its own set of lines with a unique identifier, so remove the lines you don't want.

If you're using some kind of script to generate the mrtg.cfg file, then you'll have to look to that. If you're using the stock cfgmaker script, you can apply an interface filter with the --if-filter= command; the filter is a perl-regex that defines the interfaces you want to include.

Best Answer

Related Solutions

“Unable to open MRTG log file” error with nagios and mrtg

Linux – MRTG Configured; Need to monitor 1-2 Interfaces; Not All

Related Topic