a free alternative to wireshark's pilot

So I have been put in charge of using the wireshark program called pilot in order to mimic results of a network test that we did. But alas! pilot wasn't working on me, and while waiting for tech support to get back to me; I figured I would take matters into my own hands and come up with a free-ware alternative.

I am using the tcptrace program to read the log files from wireshark, and Ploticus to pipe the data to a graph. tcptrace can create graphs, but not of tcp ports/percentages. So Im in the process of whipping up a bash/awk script that takes the output from tcptrace's port information dump, cleans up and drops it into a file that ploticus can read, in megabytes.

The really quick and dirty way to get the top 10 TCP port usage in bytes is as follows:

tcptrace -xtraffic <.cap file>
#this outputs a file called traffic_byport.dat)

sort -nr -k 4 traffic_byport.dat | awk 'NR==2,NR==11' > TCPtop10
#this numerically & reverse sorts column 4 of traffic_byport.dat (the bytes data),
# then it prints out lines 2-11 (line 1 has title data, don't need it for the script)
# after awking, it prints out the top 10 TCP port usage, in bytes.

I have also spit out a very rough and dirty way to transform the bytes to megabytes with a .00 decimal place in order to graph the data properly. But Im going to look into a better way to merge columns in awk before I post anything.

Debugging a shell script

I have been scripting various 'programs' in bash for nearly 10 years now, so there is not much that I don't know when it comes to bash shell programming. But alas! while looking for some code snippits on how to use calc to add a decimal point to a number, I came across a very nifty tidbit on shell debugging.

sh -x script.sh

the -x switch echo's everything in the script line by line until there is an error in the script. the errors are printed out next to the line that errored out. VERY VERY useful! Instead of writing 50+ lines of scripts and spending all day debugging it, the -x does all my work for me. i have used strace to debug various applications, but I couldnt' find anything for actual shell scripts. Freaking AWESOME!

Print queue check script

So on Thursday I was manually cleaning out the print queue on a CUPS print server, 40+ jobs one at a time, and it came to me! Just whip up a quick sys-admin script that polls, the data from a column and just deletes it from there. What I didn't think to do, was READ the manpage on lprm. Had I read the man page instead of re-creating the wheel, I would have realized that in order to remove all print jobs from a CUPS queue for a specific printer, just add a - to the commandline for the printer.



Needless to say, I wrote the script anyway. Im sure I can pilfer bits and pieces of it for another quick script later.



#!/bin/bash
### Removes Print jobs from the print queue
### Command:

#Query printer for print queue, then drop data to jobid file
lpq -P $1 awk '{print $3}' > jobid

# remove all print jobs from specified printer
cat jobid xargs lprm

# Query printer queue again and let admin know that the jobs have been removed
lpq -P $1
echo 'Print jobs removed'

# remove temp file
rm -rf jobid

nagiosgraph & windows clients

About 6 months ago I started using Nagios to monitor 26 servers (mixed OS) with 144 Services. I must say, nagios has saved my butt many times over. Not only do I have it setup for email, but it will also SMS staff if the central network goes down. Well, the other day I came across nagiosgraph (http://sourceforge.net/projects/nagiosgraph/). Nagiosgraph will take the perf-data from Nagios and put it into a graph with rrdtool. Setting up graphs for pings, and linux-unix servers were pretty straightfoward, and already added to the map file on nagiosgraph. The problem that I had was that I use nsclient++ to monitor the windows servers, and even though I could get perf-data from the windows servers, there was no way to get graph data.

So, 3 days into searching just about everything on the web for nagiosgrapher and windows server map files, I finally found a website that guided me in the right direction.

http://nerhood.wordpress.com/2004/09/22/nagiosgraph-with-windows-support/

As you can see, the article is over 4 years old, but yet I couldn't find anything else on the web with nagiosgrapher and nsclient++. So, just in case I will post parts of my nagiosgraph/maps file in case someone else comes across this blog looking for nagiosgraphing and nsclient++ integration.

By the way, it's AWESOME! Nagiosgrapher has already caught a few problems that we had suspected, and provides a visual tool for sys admins looking back at historical data.

/nagiosgraph/map

# Service type: memory

# check command: check_nt -H Address -v MEMUSE -w 50 -c 90

#output: Memory usage: tootal:2467.75 Mb - used: 510.38 Mb (21%) - free: 1957.37 Mb (79%)

/perfdata:Memory usage=([.0-9])+Mb;([.0-9+);([.0-9+);([.0-9+);([.0-9]+)/

and push @s, [ntmem,

[memused, GAUGE, $1*1024**2 ]

];

# Service type: ntload

# Check command: check_nt -H Address -v CPULOAD -l1,70,90,5,70,90,30,70,90

# output: CPU Load 9% (5 min average) 11% (30 min average)

#perfdata: '5 min avg Load'=9%;70;80;0;100 '30 min avg Load'=11%;70;90;0;100

/output:.*?(\d+)% .*?(\d+)% /

and push @s, [ ntload,

[ avg05min, GAUGE, $1 ],

[avg30min, GAUGE, $2 ] ];

# Service type: ntdisk

# check command: check_nt -H Address -v USEDDISKSPACE -lc -w 75 -c 90

# output: c:\ - total: 25.87 Gb - used: 4.10 Gb (16%) - free 21.77 Gb (84%)

# perfdata: c:\ Used Space=4.10Gb;19.40;23.28;0.00;25.87

/perfdata:.*Space=([.0-9]+)Gb;([.0-9]+);([.0-9]+);([.0-9]+);([.0-9]+)/

and push @s, [ ntdisk,

[ diskused, GAUGE, $1*1024**3 ],

[ diskwarn, GAUGE, $2*1024**3 ],

[ diskcrit, GAUGE, $3*1024**3 ],

[ diskmaxi, GAUGE, $5*1024**3 ] ];

Alas! Blogger seems to put a .5 space between the code, o'well, at least one can tell where the code begins and ends. So once the map file has been populated, you can check your syntax with:

perl -c map

output should be: map syntax OK. From there, .rrd files should start generating in the hosts file under /rrd (or wherever one has setup their /rrd directory).

First Post - Intro & Linux Memory tips

Ah ha! So after many many (10+ years) of relying on other websites, blogs, etc for gathering needed information on day-to-day linux systems administration tasks, scripts, how-to's and all that other fancy stuff; I finally decided to create my own blog to share my experiences, sys admin scripts, and little pointers in the Linux Systems Administration world.

As stated earlier, I have been a linux systems admin off-and-on since 1997, both as a Sys Admin, Linux Sys Admin Instructor for a computer consulting company, and even a Sun Solaris Systems Engineer for a large web tool development company. Currently I am the Linux Systems Administrator for a company out in the midwest.

So, from time to time I will be posting various sys-admin scripts that I have written during the week, tips and tricks on how to get things functional in a Mixed OS environment (such as Samba w/ Active Directory Sync, SQUID & Active Directory, etc).

These posts follow what pit-falls that I ran into for the day, and how I solved each one with whatever script, how-to, etc.

So, today is nice and quick (slow day at work).

I was asked by one of the developers how to check swap space in linux:

free -t -m (shows total memory and in megabytes)

also:

vmstat (reports virtual memory statistics, -s for counter & mem stats, -s m for summary in megabytes)