Big Sister



  (See also the HTML version in the doc subdirectory)

Version



  This is Big Sister Version 0.97. It has been tested on
  Solaris >2.5, Linux, Windows NT 4.0 and Windows 2k with
  perl 5.003 through 5.6. It is reported to run on various 
  other Unix flavours though.


The name



  Yes, it is called nearly like Sean MacGuire's Big Brother and
  it works nearly like it ... Actually it is even compatible
  with it.


Why was it written then



  ... because I liked the idea behind Big Brother but did not like
      the limitations (mainly performance!) in using shell scripts ...
  ... and also because I needed a few more monitors such as sar, 
      rpc and snmp ...
  ... a history would also be fine ...
  ... some way to reduce the number of alarms (e.g. when a router is
      going down I don't want to get 20 alarms stating that all the
      machines behind this router are unreachable) ...
  ... I also wanted to be able to do a more decent grouping on the
      display server ...
  ... and thought about porting BB to other platforms - such as win95
      or NT
  ... and thought about integrating it into the HP Openview/SNMP NMS running
      at our site
  So I started to rewrite BB in Perl step by step.

  In the meantime you will find that Big Sister and Big Brother still
  share some compatible concepts (e.g. the client/server protocol and 
  part of the log file format) but do not have too much in common any
  more.



Get Help / Sending Comments / Author(s) / Contributions



  The preferred way of asking for support / reporting bugs is now
  via the Support / Bug manager at 
	
	http://sourceforge.net/projects/bigsister/

  This makes tracking bugs and support requests much more easy.

  Big Sister was originally written by:

	Thomas Aeby, Switzerland
	aeby@graeff.com

  In the meantime

	Joseph Gooch
	Mike Lowe

  joined in. Many contributions have been made from interested
  people out there. Please see the CREDITS section and copyright/
  author notices in the sources.

  Feel free to sent comments or ask for help ...

  You may find the page

	http://bigsister.graeff.com/

  helpful.




Installation



  Please download and read the Big Sister Installation and Configuration
  Manual from http://bigsister.graeff.com (choose "Docu"). It is still
  incomplete but will probably answer many of your questions.

  You need perl 5.002 or later. If you intend to use any of the snmp
  functionality then you need the snmp modules from Simon Leimen
  available from 

         http://www.switch.ch/misc/leinen/snmp/perl/index.html

  If you would like to use graphical status displays (%image statement)
  you need the GD perl module available from any CPAN site.

  If you would like your monitoring server to collect performance
  data and create trend graphs (e.g. for viewing disk usage trends)
  you need Tobias Oetiker's RRDTool available from

	http://ee-staff.ethz.ch/~oetiker/webtools/rrdtool/

  - you should create a user called "bs" (Big Sister)
    It's a good idea to set the user's home directory to the location
    where you install Big Sister (/usr/local/lib/bs by default)
  - "make install-server" will install the server (display/status collector/
    alarm generator) part of Big Sister
  - "make install-client" will install the agent (monitor) part of Big Sister
  - alter config files (see below)
    at least edit adm/uxmon-net and replace the server near 'bsdisplay'
    by the name of your Big Sister server
  - place symbolic links into your cgi directory pointing to bin/bshistory,
    bin/bswebalarm, bin/bswebadmin and bin/bsgraph

  If your Big Sister user is not called 'bs' then e.g.

	make install USER=...

  If perl is installed in an exotic place at your site (or want to force
  make to use a special path) then

	make install PERL=...

  If you want to install Big Sister in another directory than
  /usr/local/lib/bs then do a

	make install DEST=...

  If your install directory differs from the directory where Big Sister
  is actually located when executed

	make install EXEC=...

  If your cgi-path is not "/cgi", then 

	make install CGIPATH=...

  If your Big Sister web pages' http path are not /bs (e.g. http://myhost/bs)
  then use

	make install WEBROOT=...


Directory structure



  By default Big Sister installs in /usr/local/lib/bs (but should run
  anywhere else). Below its root directory it installs:

	- bin	the binaries
	- adm	the place where configuration files local to the machine
		should go
	- uxmon	the client software of Big Sister (Unix Monitor)
	- etc	various configuration files (not very populated yet)
	- www	the directory where Big Sister generates its HTML files
	- www/logs	the directory where the client status files 
			end up
	- www/logs/history	the directory where the history goes to
	- var	the location where Big Sister stores any file (except
		for the WWW files) it writes to

  Some people might want to move www to /var and place a link into
  /usr/local/lib/bs. "www" is only used on the Status Collector machine.


What config files do you want to edit



  adm/bb-display.cfg	Tells bbdisp.pm what Web pages it should create and which
			tables they should contain.
			NOTE: Any host will only appear on your status web
			      page when it is
				- listed in bb-display.cfg
				- or uses dynamic grouping

  adm/hosts.allow	OBSOLETE (but still active)

  adm/permissions	tell bbd which agents are allowed to connect and
			what they are allowed to send

  adm/grouping		Grouping information for dynamic join/leave of
			host groups (when using the generic uxmon-rules.pl)

  adm/uxmon-net		The agent configuration file 
  			Do not forget to at least edit this file after
			a new installation

  etc/syslog		If you are checking system log files ("syslog" check)

  etc/mibs.txt		If you are using snmp monitor this file is used for
			mapping text to oids

  etc/OV		configuration file for HP Openview uxmon Monitor (only
			if you are using the "OV" check)

  adm/bb_event_generator.cfg	The configuration file for the alarm generator

  adm/notify.cfg	If you use bb_event_generator with notify this is
			the notify configuration file

  {adm,etc}/graphtemplates
			The definitions in this file are used as a template
			for creating performance data history databases

  etc/bsmon.cfg,	configures the various Big Sister server modules
  adm/bsmon_site.cfg

  see the file CONFIG for a description of these files


How to start it



  A shell script named 'bb_start' is supplied. This should go into /etc/rc2.d
  (or /sbin/rc2.d or wherever your startup scripts usually go) so that Big Sister 
  is started during system reboot.

  Of course you can use bb_start manually:

	bin/bb_start start		start Big Sister
	bin/bb_start stop		stop Big Sister
	bin/bb_start restart		stop/restart Big Sister



Overall function



  Big Sister comes in two parts: The "Status Collector" (bbd & bsmon) 
  and the "Agent" (uxmon). Uxmon is meant to run on one or more machines. It's 
  purpose is to check the local status on the machine (e.g. CPU load, disk usage, 
  ...) it is running and the network status of neighbouring machines (e.g. ping, 
  RPC, telnet to specific ports, etc.). It reports the status periodically to
  the "Status Collector". The "Status Collector" saves the reported stati,
  creates Web pages showing them, generates alarm messages on pre-configured
  status changes, collects, stores and displays trend data and so forth.



Currently implemented monitors



  - oracle: Oracle database check
  - tripwire: Tripwire system consistency check
  - bbscript: for re-using Big Brother monitoring scripts
  - statusfile: as a simple interface to simple monitors
  - cpuload: CPU load as reported by uptime
  - eventlog: monitoring NT EventLog
  - logfile: generic log file monitor
  - procs: checking running processes
  - ping: checking reachability of a host
  - fs: checking file system usage
  - rpc_ping: checking RPC responses
  - tcp: generic TCP monitor
  - sar: checks sar output against limits
  - snmp: does snmp polling 
  - dumpdates: check for last dump/ufsdump backup
  - syslog: check system log files
  - OV: HP Openview trap monitor
  - metastat: check Solstice DiskSuite RAID-Systems
  - dns: check DNS servers
  - radius: Radius
  - http/realhttp: Web Server
  - ... many more (see CONFIG)


Contributions





CREDITS



	Sean McGuire		author of Big Brother

	Sylvio Svensson		he suggested the name Big Sister and is THE
				HP Openview crack

	Bernhard Stalder	for always being there when I needed an
				experienced system administrator to talk to

	Peter Stevens		for some suggestions, e.g. dynamic grouping

	Russell Mosemann	from whom I have borrowed parts of Monitor::ping.pm

	Philip Nyffenegger	for his support
		
	Rudolf Meyer		for sharing his NT know how
				and offering connectivity for the
				Big Sister web server

	(just some person)	who unfortunately did not want me to quit the 
				project :-)

	Andreas Disteli		for finding more bugs than I ever wrote :-)

	Peter Sorensen		for many good suggestions

	Roland Roberts		for his contributions

	Torben Sorensen		for his contributions

	Joseph Gooch		for many contributions

	Pius Sabathy		for his support and willingness to
				test new patches/releases

	Kevin O'Donnell		for his contributions

	Tim Powell		for his contributions

	Markus Boss		for his work on the prototype RRDTool support

	Tobi Oetiker		for RRDTool

	Philip Markwalder	for his contributions

	Boris Bellorini		for his contributions

	Eduardo Tarasiuk	for his contributions and support

	Steve Chan		for his contributions

	Manuel de Vega Barreiro	for his contributions