Most monitoring services, and for that matter most monitoring software, will let you choose how you receive messages about devices having problems.

For instance, at microNOC we offer the option of monitoring by text message (or SMS as it’s more correctly known) or email. (And we are looking at other systems, such as Yammer or Twitter as well.)

So which should you choose?

Email messaging is great, if you make sure that whatever email address that we send the alert to is one that isn’t associated with the device that might have the problem. For instance, if we’re monitoring your mail server, you probably don’t want to have alerts sent to an account on that mail server. Common sense really. And if getting notified immediately of the problem is something that is important (which is probably why you are monitoring in the first place….) then you need to make sure that the email we are sending the message to is one that gets to you immediately during the periods that you want to be notified. For instance, if you want to make sure that you get alerts on your phone in the middle of the night, you need to make sure that your email address goes directly to your phone, using a push technology.

A better method for most people is to send alerts to your phone via SMS or text message. This system sends a brief (about 140 character) message to your phone directly from our monitoring servers. It’s really only dependent on the phone network being online. Overall it’s a great method if you want to get your alerts via your phone, no matter where in the world you are located.

One big benefit of getting alerts via SMS is that your phone actually will make a noise to alert you. I know that some phones do with incoming email, but I know that I turn that off right away - too many emails - and only leave alert sounds on for SMS messages.

No a problem with both of these methods is that they are best effort methods for messaging. There is no guarantee for the amount of time that a message takes to get to you, for either email or SMS. But in general SMS is a quicker method and isn’t dependent on your phone and mail service supporting push communications.

We actually recommend getting messages sent via both methods, so that you can see via email (especially useful sitting at your desk) or SMS (when on the road or not at your computer) that there is a problem.

Which ever method that you choose to use (or don’t choose, use both), the most important thing is that you are monitoring the systems that you and your business depend on.

That was a long time off from updating the blog, but it’s been an extremely busy month or two. Lots of travel time going up and down the coast, lots of work fixing and updating systems for a client, lots of time with the family too. All of which add up to very little time to sit and write.

But I have been doing some writing. I’ve got a few posts almost ready to go, and will be uploading them as soon as they are done. Expect to see them shortly.

Even with the upcoming travel that I’m seeing creep onto my calendar right now, I’ll be keeping this site updated, as regularly as possible.

It’s good to be back.

As a network designer, one of the components of network design that we are very concerned with is the amount of bandwidth that each known application on the network will generate, and when we can expect that traffic. We are also concerned with possible applications that may reside on the network at some point in the future.

For a simple network, one that only has desktop computers and servers, it’s fairly simple in most cases to determine what the traffic is, where on the network we need to be concerned and when we can expect to see maximum traffic. For the most part we concentrate on things like network backup of various servers - usually you see spikes in traffic in the datacenter or server portion of the network during backup periods. For the most part that is the big traffic challenge on a simple network.

Beyond on the simple network, you start seeing networks that ramp up in what they have on them - usually it moves from very simple to having some phone traffic. Then video conferencing. Then CCTV. Then security system. And on and on it goes.

Designing networks that can expand easily to cover the possible traffic on the network is something of an art form. The existing requirements are easy to design for, but seriously, 5 years ago (not an unusual amount of time for an enterprise network to be in use) who would have thought that CCTV camera systems would be run over the data network almost exclusively, and be running upwards of 5 megapixel streams of video? Or how many people designed networks knowing that video over IP would be all the rage, with 1080p channels being streamed multicast over standard data network infrastructure?

I’d like to say that I did, but even though I was building networks for IP based CCTV back then, I really wasn’t thinking about such high resolution CCTV streams or HiDef Television programming.

But over the past year I’ve been designing some very large scale networks that have been designed to handle all those kinds of traffic and more, all on standard networking technologies. At very high uptime requirements. And believe me - at this point it’s all about network bandwidth management at this point.

Now, with that said, one of the smaller amounts of traffic on these large networks is monitoring traffic. The pings, SNMP gets and netflow streams that we use to monitor all the components of very large scale networks is generally among the smallest amount of traffic by volume on the network.

But even with the amount of traffic being relatively small, it’s still something to take into account. And if you are running an older network, it can be a significant part of the traffic that you have on the network. And that is where you really need to control what you are monitoring and how.

For instance, if you are running a fairly small WAN, say 3 T1 lines from your central office to smaller offices, and are using IP phones and IP conferencing, you really want to keep the amount of traffic on the WAN links as small as possible to allow your business applications to be able to fully utilize the bandwidth you are paying for. But you need to monitor what’s going on in those remote offices still, so how do you do it?

In that example, I would recommended that your base monitoring is a 5 minute ping, with SNMP gets (from MRTG or Cacti) to the WAN and Ethernet interfaces of your router. Then PING your switches every 5 minutes, along with any other critical devices, just to make sure they are up and responding.

Then move any traffic analysis off the remote office routers, and onto your central office WAN router. That would be monitoring applications like Netflow or something similar. That way you still have the neflow data coming into your sensor, but it’s not crossing the expensive WAN connections. And by cleaning up your SNMP gets to only grab two interfaces, you are further reducing your monitoring traffic, while still allowing you a good view of what’s going on remotely.

If you have very expensive, small WAN connections between larger offices, another choice is to place a monitoring server in the remote office, just passing the results back to your central server. Nagios allows you to do this, as do several commercial products. Setting up your monitoring to use remote servers reporting back to a central server is great for bandwidth, but be forewarned that it’s not that simple to setup. In fact it can be a real pain in the ass. But it is worth is if the situation is the right one for that type of setup.

Overall I recommend being aware of your monitoring traffic, and being especially aware of it if you are running any kind of monitoring over WAN links. You can still monitor your systems very effectively, even over high cost lines, with just a small amount of planning and a dose of common sense.

Now I’ve done work for them before, remotely, on network issues, but I’m actually onsite and doing far more this week.

One of the issues that I’ve got is that there isn’t any real network map or diagram. There are a few around  here and there, but for the most part they are out of date. Especially given that the company is consolidating servers from one data center to another right now.

Part of the work that I’m doing while I’m here, other than just support, is getting a network map together that is accurate. While that doesn’t sound that hard, given the fairly flexible nature of the network, the fact that they are always expanding and contracting space and are currently in a fairly major server move, just doing a network diagram in Visio isn’t really going to help anyone tomorrow when the network changes again.

Part of the issue that I’m having is that it’s pretty difficult to do network discovery here with the seemingly random security that’s in place on the network devices. SSH to one, telnet to another, CDP enabled or disabled on various systems, SNMP access not always configured. All things that add up to making it a pain in ass to do enough discovery to create a diagram in the first place.

So what’s the solution?

Well, there are several solutions available, but what we are going to try first is one that anyone is free to try out: Nedi (actually Nedio44 - a bootable install version).

I’m not going to get into Nedi installation, configuration and use here (though I will soon, I promise), but it is a great opensource tool for network management.

Other than a tool, the biggest issue that I need resolve to make any solution work is to clean up the security and running services on the devices. While there are lots of ways of doing that, I’m going with the manual method of logging into each device that will be involved in this discovery and making the needed changes manually. While I’d normally script something to do that, because this is a network that I’m not familiar with I’m leery of making automated changes. And it actually helps in understanding the topology of the network.

So I’m back to making those changes and waiting on the server team to get my Nedi server over to me to configure. I’ll do an update later letting everyone know how it’s going.

For those of you who don’t know, SEO stands for Search Engine Optimization, which is an art and science of getting a web page ranked extremely high, number one or number two, in organic (non-paid) search results.

How do they do that? Well, there are a number of things, like making sure that the title of your web pages contains the keywords that you think people will be searching for to find you, that those keywords are at certain locations within the pages of your site, and any number of other things that can really help bring your website up to the top of search rankings. Does it work? Sure - it can work very well. By using some very basic SEO techniques we’ve driven our sites up to the top of search results. Granted, sometimes the keywords used are sort of funny (try googling for “determining differentiators” - the result of that is based on correct SEO techniques applied to a site, but honestly I was surprised that happened for that posting).

What does that have to do with website monitoring?

A couple of things actually. SEO companies recommend monitoring your website in order to make sure that the work done to improve its ranking in search results is actually working. But they aren’t talking about the kind of monitoring that we do here at microNOC.

Rather, they are talking about monitoring the hits on your site, where they came from, what pages they looked at and what path visitors take through your site. What that is really called is website analytics.

They are absolutely right that you should be monitoring analytics. It really helps you to know that your site is doing what you want it to do, or (and this is sometimes more important) that it’s not doing what you want it to do.

There are some very good, free, Analytics applications out there. The most commonly used by far is Google Analytics (http://www.google.com/analytics) which only requires the addition of a small bit of code that they supply located somewhere on each webpage. Once you have that in place, you can login to the Google Analytics site, and check up on various things like how your visitors got to your site (direct, referred from another site, search results, etc), how long they were on the site, what pages they looked at, and a ton of other features that include adwords and sales tracking. Overall it’s a great free service.

But it’s not website monitoring the way that we define it. Any SEO worth their salt will also recommend that you have a service in place to make sure that your website is up and running. Because if it’s not, then there was no point in getting your site up high in search ranking if people try to get to it only to find they can’t.

Hope everyone stays up and running today.

Configuring netflow on a Cisco router.

I was asked about setting up netflow exports on a Cisco router.

I have to be honest, setting up netflow can vary wildly, depending on what you want to do, but here is a very very simply example. In this case, the router traffic that I want to keep track of is entering the router through Interface Ethernet 0/0, and I want the netflow data to go to a collector on the server at 172.17.60.29, port 9990.

Once you are in config mode, here is what you would need to enter:

ip flow-export version 5
ip flow-export destination 172.17.60.29 9990

int e0/0
ip flow ingress

See, very simple. That is from a Cisco 3845 router, and off the top of my head I can’t remember the IOS version, but it is still pretty simple and straightforward. Hasn’t changed in years as far as I can tell.

Netflow Collectors

Next, I did get a question or two about collectors and viewing the netflow data. So here goes:

Netflow collectors are applications or services running on a computer that take the information passed to them from the routers exporting the data, and store it in some sort of database or file system.

There are several collectors on the market, both commercial and free (including one that was left in the comments yesterday - Scrutinizer - (that I haven’t used before but will give a try soon) that offer both paid and free options. Some of the opensource (ie - free) include NEye and flowd. There are many others on the market. I know that there are a couple out there for the Windows platform too, just Google for them.

Now, not all of the collectors include the ability to view the data, as they are simply collectors. This is especially true in the Unix world, where the concept of having a separate, reusable piece of code for each function that you might need was born. This makes for great flexibility in viewing the data, so it’s not a bad thing at all.

Netflow viewers or report tools vary greatly also. Some are predominately text / table reporting tools, like the Flow Viewer app (watch for info on this to come soon as I start discussing the CactiEZ project), which generates text based reports on traffic that has been collected. And some are very visual which is great for impressing management, and can actually be very useful for a quick glance approach to finding issues.

Here is a sample graph created by FlowScan (an opensource package):

As you can see, it shows you at a glance how much traffic there is on the router interface that you are exporting from, and it separates out the different amounts of traffic by applications or protocols. Granted, this is a very old map (take note of the Napster traffic), but it gives you a good idea of the kinds of data and details that you can pick out by using a graphic based tool to report on your Netflow data.

I hope that gives you a better idea of what you can expect from Netflow. If you’d like to get Netflow up and running, with pretty pictures and good solid information, we’ll plug our sister company - Voodoo Networks as they have many years of experience with large networks and getting simple tools in place to monitor them.

Hope everyone stays up and running.

Updated:
Nathan pointed out that I left out the ip flow-export version 5 line from the sample Cisco configuration. Thanks Nathan!

Netflow really isn’t a tool - it’s a protocol that has a series of tools associated with it. But those tools place a lot of power in your hands as a network administrator.

Netflow isn’t something for everyone. Be warned now, if you aren’t an IT person than I might be going over your head with this one. Anyway, Netflow is something that exists in higher end routers and some switches, such as Cisco and Juniper. Their smaller models frequently have Netflow as an option but not always. And many smaller routers don’t support Netflow at all. Same goes for smaller managed switches. And I guarantee that unmanaged switches don’t support it either.

With that out of the way, why should you want to use Netflow?

Well, the best explanation is that it allows you to see what people are doing on your network. Not in the same way as a product like Websense that shows you what websites people are using, but more along the lines of what kind of traffic your network is being used for.

Here is a quick example.

You are running a network with several smaller offices scattered around, connected to your main office with an MPLS network. You are monitoring the load on your network links with MRTG/RRDTool, like all good and handy network admins. You have noticed however that you are getting a large amount of traffic that is spiking your network and causing issues a couple of times a day.

Now, having MRTG/RRDTool that is properly configured allows you to see that you have a spike, and where the spike is, but it doesn’t give you much more information than that.

That is where having Netflow running on your network can help. If you have the same routers that are feeding bandwidth usage to MRTG/RRDTool running as Netflow exporters, then those routers will be sending a stream of data to a specific server configured as a Netflow collector that includes flow information. Flow information, as included in Netflow, is a stream of info about each network connection that is being made through that router. The actual data in the connection isn’t included in Netflow, but you do get the IP addresses for the computers at each end of the flow, the ports, protocols and amount of data in the flow.

This flow information, when gathered by the Netflow connector and interpreted by something like FlowCU or Flow Viewer, allows you to see beyond the data that MRTG/RRDTool collects and helps you identify exactly what the spike in traffic is. For instance, it could be a specific computer on the network that is downloading updates every couple hours, or someone using Skype, or Bit Torrent. Or a video conference that you didn’t know about.

Netflow isn’t a panacea for all your network troubleshooting, but it does really help you focus on the systems that are causing your spike in bandwidth, which in turn can really help you figure out how to resolve the issue and improve your network performance.

In an upcoming post I’ll go over a simple configuration of Netflow using Flow Viewer and the CactiEZ platform.

Until then, I hope your systems are all up and running.

Well, to us it means that you never have to learn anything new to use our monitoring service. No need to keep track of another login, have another interface to learn, more tech lingo to figure out and more minute details to try to remember.

To us simple website monitoring is just that…simple. You see, when you sign up with microNOC you don’t have to do any of the setup work. You simply tell us what you want to monitor, in the simplest terms, and our technicians setup your monitoring for you. Because it is simple for them. It’s what they do.

Why did we setup our service this way? Because of that word - Service. We don’t think that you should be doing all the work. While other services require you to do everything to setup service with them, from defining servers, response times, DNS servers, services running on them and content words, we do all that work for you. In other words we don’t charge you for the work that you do.

And why do we think that simple is so important?

Because we know that technology is frequently something that overwhelms people. And for most people it’s important, but secondary to their actual business. And your time is most likely better spent working on your business, and letting use worry about making sure that everything you need to make sure that your website is working is taken care of.

Simple Website Monitoring. It’s just that. Simple.

Many website monitoring companies, including microNOC, offer the ability to test the actual content that your website is serving to visitors, instead of just checking that the server is up and running, which can give a false sense of security.

An example of the false sense of security that can come from just monitoring the server and not the content is if your home page for some reason isn’t served correctly, which could be caused by a file being missing (like header.php or footer.php in wordpress) or by a database error (in the case of database driven websites). Either of those problems will still result in a page being served, but the content will either not be there, or be useless, even if the server itself is responding to the website monitoring query that everything is ok.

By checking actual content on the site, a website monitoring service will verify that a word or group of words, are actually being served up by the webserver. If they don’t show up during checks, then there is something wrong and an alert will be sent out.

There are many different varieties of website content checking that can be used, but the one that we offer even with our Free Website Monitoring accounts is to check for an image and a link. For our free accounts, we will check to make sure that a link from our Link To Us page is on your server, and is correctly served to clients from your server. If there is a problem and we don’t see that link when we are testing your server, we conclude that your content isn’t being served and we notify you. Our recommendation is that the link be placed in the footer of the page, or be served out of a database so that you can verify that the database link is working as well.

And if you are using our free service, don’t forget that having a link to us on your home page that we are monitoring qualifies you for our free iPod Shuffle monthly giveaway.

Hope you have a great day, with no outages.

Here is the search results page:

And here is the cache of the site:

If this is marketing, it’s brilliant. If not, you have to wonder how the heck they manage to get anyone’s business, or keep it.

Think I should offer them some free monitoring?