(See also the HTML version in the doc subdirectory)
This is Big Sister Version 0.38. It has been tested on Solaris 2.5*, Linux, Windows NT 4.0 and HP/UX together with perl 5.002 through 5.005
Yes, it is called nearly like Sean MacGuire's Big Brother and it works nearly like it ... Actually it is even compatible with it.
... because I liked the idea behind Big Brother but did not like the limitations (mainly performance!) in using shell scripts ... ... and also because I needed a few more monitors such as sar, rpc and snmp ... ... a history would also be fine ... ... some way to reduce the number of alarms (e.g. when a router is going down I don't want to get 20 alarms stating that all the machines behind this router are unreachable) ... ... I also wanted to be able to do a more decent grouping on the display server ... ... and thought about porting BB to other platforms - such as win95 or NT - actually perl is available on this platforms and some first tests of uxmon were quite promising ... and thought about integrating it into the HP Openview/SNMP NMS running at our site So I started to rewrite BB in Perl step by step. In the meantime you will find that Big Sister and Big Brother still some compatible concepts (e.g. the client/server protocol and part of the log file format) but do not have too much in common any more.
Big Sister was written by: Thomas Aeby, Switzerland aeby@graeff.com Feel free to sent comments or ask for help ... You may find the page http://bigsister.graeff.com/ helpful.
No, you are *not* right ... I am not developing things like Big Sister during my days at Ascom. Big Sister definitely is "homework".
You need perl 5.002 or later. If you intend to use any of the snmp functionality then you need the snmp modules from Simon Leimen available from http://www.switch.ch/misc/leinen/snmp/perl/index.html If you would like to use graphical status displays (%image statement) you need the GD perl module available from any CPAN site. - you should create a user called "bs" (Big Sister) It's a good idea to set the user's home directory to the location where you install Big Sister (/usr/local/lib/bs by default) NOTE: if not running as a dedicated user the bb_start script will do really nasty things when used as "bb_start stop" or "bb_start restart"! - "make install-server" will install the server (display/status collector/ alarm generator) part of Big Sister - "make install-client" will install the agent (monitor) part of Big Sister - alter config files (see below) - place symbolic links into your cgi directory pointing to bin/bshistory and bin/bswebalarm If your Big Sister user is not called 'bs' then e.g. make install USER=... If perl is installed in an exotic place at your site (or want to force make to use a special path) then make install PERL=... If you want to install Big Sister in another directory than /usr/local/lib/bs then do a make install DEST=... If your install directory differs from the directory where Big Sister is actually located when executed make install EXEC=... If your cgi-path is not "/cgi", then make install CGI=... If your Big Sister web pages' http path are not /bs (e.g. http://myhost/bs) then use make install WEBROOT=...
By default Big Sister installs in /usr/local/lib/bs (but should run anywhere else). Below its root directory it installs: - bin the binaries - adm the place where configuration files local to the machine should go - uxmon the client software of Big Sister (Unix Monitor) - etc various configuration files (not very populated yet) - www the directory where Big Sister generates its HTML files - www/logs the directory where the client status files end up - www/logs/history the directory where the history goes to Some people might want to move www to /var and place a link into /usr/local/lib/bs. "www" is only used on the Status Collector machine.
uxmon/uxmon-rules.pl OBSOLETE adm/rules.pl OBSOLETE adm/bb-display.cfg Tells bbdisp.pm what Web pages it should create and which tables they should contain. NOTE: Any host will only appear on your status web page when it is - listed in bb-display.cfg - or uses dynamic grouping adm/hosts.allow tells bbd from which hosts agents are allowed to interact with bbd adm/grouping Grouping information for dynamic join/leave of host groups (when using the generic uxmon-rules.pl) adm/uxmon-net The agent configuration file when using the generic uxmon-rules.pl etc/syslog If you are checking system log files ("syslog" check) etc/mibs.txt If you are using snmp monitor this file is used for mapping text to oids etc/OV configuration file for HP Openview uxmon Monitor (only if you are using the "OV" check) adm/bb_event_generator.cfg The configuration file for the alarm generator adm/notify.cfg If you use bb_event_generator with notify this is the notify configuration file see the file CONFIG for a description of these files
A shell script named 'bb_start' is supplied. This should go into /etc/rc2.d (or /sbin/rc2.d or wherever your startup scripts usually go) so that Big Sister is started during system reboot. Of course you can use bb_start manually: bin/bb_start start start Big Sister bin/bb_start stop stop Big Sister
Big Sister comes in two parts: The "Status Collector" (bbd & bb_event_generator) and the "Agent" (uxmon). Uxmon is meant to run on one or more machines. It's purpose is to check the local status on the machine (e.g. CPU load, disk usage, ...) it is running and the network status of neighbouring machines (e.g. ping, RPC, telnet to specific ports, etc.). It reports the status every 5 minutes to the "Status Collector". The "Status Collector" saves the reported stati, creates Web pages showing them and uses bb_event_generator to generate alarm messages on pre-configured status changes.
- bbscript: for re-using Big Brother monitoring scripts - statusfile: as a simple interface to simple monitors - cpuload: CPU load as reported by uptime - eventlog: monitoring NT EventLog - logfile: generic log file monitor - procs: checking running processes - ping: checking reachability of a host - fs: checking file system usage - rpc_ping: checking RPC responses - tcp: generic TCP monitor - sar: checks sar output against limits - snmp: does snmp polling - dumpdates: check for last dump/ufsdump backup - syslog: check system log files - OV: HP Openview trap monitor - metastat: check Solstice DiskSuite RAID-Systems - dns: check DNS servers - ... many more (see CONFIG)
Sean McGuire author of Big Brother Sylvio Svensson he suggested the name Big Sister and is THE HP Openview crack Bernhard Stalder for always being there when I needed an experienced system administrator to talk to Peter Stevens for some suggestions, e.g. dynamic grouping Russell Mosemann from whom I have borrowed parts of Monitor::ping.pm Philip Nyffenegger for his support Rudolf Meyer for sharing his NT know how and offering connectivity for the Big Sister web server (just some person) who unfortunately did not want me to quit the project :-) Andreas Disteli for finding more bugs than I ever wrote :-) Peter Sorensen for many good suggestions Roland Roberts for his contributions Torben Sorensen for his contributions Joseph Gooch for many contributions Pius Sabathy for his support