Big Sister



  (See also the HTML version in the doc subdirectory)

Version



  This is Big Sister Version 0.38. It has been tested on
  Solaris 2.5*, Linux, Windows NT 4.0 and HP/UX together
  with perl 5.002 through 5.005


The name



  Yes, it is called nearly like Sean MacGuire's Big Brother and
  it works nearly like it ... Actually it is even compatible
  with it.


Why was it written then



  ... because I liked the idea behind Big Brother but did not like
      the limitations (mainly performance!) in using shell scripts ...
  ... and also because I needed a few more monitors such as sar, 
      rpc and snmp ...
  ... a history would also be fine ...
  ... some way to reduce the number of alarms (e.g. when a router is
      going down I don't want to get 20 alarms stating that all the
      machines behind this router are unreachable) ...
  ... I also wanted to be able to do a more decent grouping on the
      display server ...
  ... and thought about porting BB to other platforms - such as win95
      or NT - actually perl is available on this platforms and some first
      tests of uxmon were quite promising 
  ... and thought about integrating it into the HP Openview/SNMP NMS running
      at our site
  So I started to rewrite BB in Perl step by step.

  In the meantime you will find that Big Sister and Big Brother still
  some compatible concepts (e.g. the client/server protocol and part
  of the log file format) but do not have too much in common any more.



Get Help / Sending Comments



  Big Sister was written by:

	Thomas Aeby, Switzerland
	aeby@graeff.com

  Feel free to sent comments or ask for help ...

  You may find the page

	http://bigsister.graeff.com/

  helpful.



To Ascom staff



  No, you are *not* right ... I am not developing things like Big
  Sister during my days at Ascom. Big Sister definitely is "homework".



Installation



  You need perl 5.002 or later. If you intend to use any of the snmp
  functionality then you need the snmp modules from Simon Leimen
  available from 

         http://www.switch.ch/misc/leinen/snmp/perl/index.html

  If you would like to use graphical status displays (%image statement)
  you need the GD perl module available from any CPAN site.

  - you should create a user called "bs" (Big Sister)
    It's a good idea to set the user's home directory to the location
    where you install Big Sister (/usr/local/lib/bs by default)
    NOTE: if not running as a dedicated user the bb_start script
	  will do really nasty things when used as "bb_start stop"
	  or "bb_start restart"!
  - "make install-server" will install the server (display/status collector/
    alarm generator) part of Big Sister
  - "make install-client" will install the agent (monitor) part of Big Sister
  - alter config files (see below)
  - place symbolic links into your cgi directory pointing to bin/bshistory
    and bin/bswebalarm

  If your Big Sister user is not called 'bs' then e.g.

	make install USER=...

  If perl is installed in an exotic place at your site (or want to force
  make to use a special path) then

	make install PERL=...

  If you want to install Big Sister in another directory than
  /usr/local/lib/bs then do a

	make install DEST=...

  If your install directory differs from the directory where Big Sister
  is actually located when executed

	make install EXEC=...

  If your cgi-path is not "/cgi", then 

	make install CGI=...

  If your Big Sister web pages' http path are not /bs (e.g. http://myhost/bs)
  then use

	make install WEBROOT=...


Directory structure



  By default Big Sister installs in /usr/local/lib/bs (but should run
  anywhere else). Below its root directory it installs:

	- bin	the binaries
	- adm	the place where configuration files local to the machine
		should go
	- uxmon	the client software of Big Sister (Unix Monitor)
	- etc	various configuration files (not very populated yet)
	- www	the directory where Big Sister generates its HTML files
	- www/logs	the directory where the client status files 
			end up
	- www/logs/history	the directory where the history goes to

  Some people might want to move www to /var and place a link into
  /usr/local/lib/bs. "www" is only used on the Status Collector machine.


What config files do you want to edit



  uxmon/uxmon-rules.pl	OBSOLETE

  adm/rules.pl		OBSOLETE

  adm/bb-display.cfg	Tells bbdisp.pm what Web pages it should create and which
			tables they should contain.
			NOTE: Any host will only appear on your status web
			      page when it is
				- listed in bb-display.cfg
				- or uses dynamic grouping

  adm/hosts.allow	tells bbd from which hosts agents are allowed to
			interact with bbd

  adm/grouping		Grouping information for dynamic join/leave of
			host groups (when using the generic uxmon-rules.pl)

  adm/uxmon-net		The agent configuration file when using the generic
			uxmon-rules.pl

  etc/syslog		If you are checking system log files ("syslog" check)

  etc/mibs.txt		If you are using snmp monitor this file is used for
			mapping text to oids

  etc/OV		configuration file for HP Openview uxmon Monitor (only
			if you are using the "OV" check)

  adm/bb_event_generator.cfg	The configuration file for the alarm generator

  adm/notify.cfg	If you use bb_event_generator with notify this is
			the notify configuration file

  see the file CONFIG for a description of these files


How to start it



  A shell script named 'bb_start' is supplied. This should go into /etc/rc2.d
  (or /sbin/rc2.d or wherever your startup scripts usually go) so that Big Sister 
  is started during system reboot.

  Of course you can use bb_start manually:

	bin/bb_start start		start Big Sister
	bin/bb_start stop		stop Big Sister



Overall function



  Big Sister comes in two parts: The "Status Collector" (bbd & bb_event_generator) 
  and the "Agent" (uxmon). Uxmon is meant to run on one or more machines. It's 
  purpose is to check the local status on the machine (e.g. CPU load, disk usage, 
  ...) it is running and the network status of neighbouring machines (e.g. ping, 
  RPC, telnet to specific ports, etc.). It reports the status every 5 minutes to
  the "Status Collector". The "Status Collector" saves the reported stati,
  creates Web pages showing them and uses bb_event_generator to generate alarm
  messages on pre-configured status changes.



Currently implemented monitors



  - bbscript: for re-using Big Brother monitoring scripts
  - statusfile: as a simple interface to simple monitors
  - cpuload: CPU load as reported by uptime
  - eventlog: monitoring NT EventLog
  - logfile: generic log file monitor
  - procs: checking running processes
  - ping: checking reachability of a host
  - fs: checking file system usage
  - rpc_ping: checking RPC responses
  - tcp: generic TCP monitor
  - sar: checks sar output against limits
  - snmp: does snmp polling 
  - dumpdates: check for last dump/ufsdump backup
  - syslog: check system log files
  - OV: HP Openview trap monitor
  - metastat: check Solstice DiskSuite RAID-Systems
  - dns: check DNS servers
  - ... many more (see CONFIG)



CREDITS



	Sean McGuire		author of Big Brother

	Sylvio Svensson		he suggested the name Big Sister and is THE
				HP Openview crack

	Bernhard Stalder	for always being there when I needed an
				experienced system administrator to talk to

	Peter Stevens		for some suggestions, e.g. dynamic grouping

	Russell Mosemann	from whom I have borrowed parts of Monitor::ping.pm

	Philip Nyffenegger	for his support
		
	Rudolf Meyer		for sharing his NT know how
				and offering connectivity for the
				Big Sister web server

	(just some person)	who unfortunately did not want me to quit the 
				project :-)

	Andreas Disteli		for finding more bugs than I ever wrote :-)

	Peter Sorensen		for many good suggestions

	Roland Roberts		for his contributions

	Torben Sorensen		for his contributions

	Joseph Gooch		for many contributions

	Pius Sabathy		for his support