Subversion Repositories ALCASAR

Rev

Rev 1159 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log

Rev Author Line No. Line
1159 crox53 1
##############################
2
#
3
# NfSen master config file
4
#
5
# $Id: nfsen-dist.conf 22 2007-11-20 12:27:38Z phaag $
6
#
7
# Configuration of NfSen:
8
# Set all the values to fit your NfSen setup and run the 'install.pl'
9
# script from the nfsen distribution directory.
10
#
11
# The syntax must conform to Perl syntax.
12
#
13
##############################
14
#
15
# NfSen default layout: 
16
# Any scripts, modules or profiles are installed by default under $BASEDIR. 
17
# However, you may change any of these settings to fit your requested layout.
18
 
19
#
20
# Required for default layout
21
$BASEDIR = "/usr";
22
 
23
#
24
# Where to install the NfSen binaries
25
$BINDIR="${BASEDIR}/bin";
26
 
27
#
28
# Where to install the NfSen Perl modules
29
$LIBEXECDIR="${BASEDIR}/libexec";
30
 
31
#
32
# Where to install the config files
33
$CONFDIR="${BASEDIR}/etc";
34
 
35
#
36
# NfSen html pages directory:
37
# All php scripts will be installed here.
38
# URL: Entry point for nfsen: http://<webserver>/nfsen/nfsen.php
39
$HTMLDIR    = "/var/www/nfsen";
40
 
41
#
42
# Where to install the docs
43
$DOCDIR="${HTMLDIR}/doc";
44
 
45
#
46
# Var space for NfSen
1223 crox53 47
$VARDIR="/var";
1159 crox53 48
 
49
# directory for all pid files
50
$PIDDIR="$VARDIR/run";
51
#
52
# Filter directory
53
$FILTERDIR="$VARDIR/filters";
54
#
55
 
56
# FORMATDIR for custom printing formats
57
$FORMATDIR="$VARDIR/fmt";
58
#
59
 
60
#
61
# The Profiles stat directory, where all profile information
62
# RRD DBs and png pictures of the profile are stored
63
$PROFILESTATDIR="$VARDIR/log/nfsen/profiles-stat";
64
 
65
#
66
# The Profiles directory, where all netflow data is stored
67
$PROFILEDATADIR="$VARDIR/log/nfsen/profiles-data";
68
 
69
#
70
# Where go all the backend plugins
71
$BACKEND_PLUGINDIR="${BASEDIR}/share/nfsen/plugins";
72
 
73
#
74
# Where go all the frontend plugins
75
$FRONTEND_PLUGINDIR="${HTMLDIR}/plugins";
76
 
77
#
78
# nfdump tools path
79
$PREFIX  = '/usr/bin';
80
 
81
#
82
# nfsend communication socket
83
# $COMMSOCKET = "$PIDDIR/nfsen.comm";
84
 
85
# BASEDIR unrelated vars:
86
#
87
# Run nfcapd as this user
88
# This may be a different or the same uid than your web server.
89
# Note: This user must be in group $WWWGROUP, otherwise nfcapd
90
#       is not able to write data files!
91
$USER    = "apache";
92
 
93
# user and group of the web server process
94
# All netflow processing will be done with this user
95
$WWWUSER  = "apache";
96
$WWWGROUP = "apache";
97
 
98
# Receive buffer size for nfcapd - see man page nfcapd(1)
99
$BUFFLEN = 200000;
100
 
101
# list of extensions for each collector. See argument -T 
102
# for nfcapd(1) for more detailes.
103
# defaults to empty -> compatible to nfdump-1.5.8
104
# $EXTENSIONS = '';
105
# Example:
106
# $EXTENSIONS = 'all';
107
# $EXTENSIONS = '+3,+4';
108
#
109
# Directory sub hierarchy layout:
110
# Possible layouts:
111
#
112
# 0 default     no hierachy levels - flat layout - compatible with pre NfSen versions
113
# 1 %Y/%m/%d    year/month/day
114
# 2 %Y/%m/%d/%H year/month/day/hour
115
# 3 %Y/%W/%u    year/week_of_year/day_of_week
116
# 4 %Y/%W/%u/%H year/week_of_year/day_of_week/hour
117
# 5 %Y/%j       year/day-of-year
118
# 6 %Y/%j/%H    year/day-of-year/hour
119
# 7 %Y-%m-%d    year-month-day
120
# 8 %Y-%m-%d/%H year-month-day/hour
121
$SUBDIRLAYOUT = 7;
122
 
123
# Compress flows while collecting 0 or 1
124
$ZIPcollected	 = 1;
125
 
126
# Compress flows in profiles 0 or 1
127
$ZIPprofiles	 = 1;
128
 
129
# Interrupt expire -- not yet enabled as not yet fully tested
130
#$InterruptExpire = 0;
131
 
132
# number of nfprofile processes to spawn during the profiling phase
133
# depends on how busy your system is and how many CPUs you have
134
# on very busy systems increase it to a higher value
135
$PROFILERS = 2;
136
 
137
# if the PROFILEDATADIR is filled up to this percentage, a warning message will be printed.
138
# set to 0 to disable the test
139
$DISKLIMIT = 98;
140
 
141
# number of nfprofile processes to spawn during the profiling phase
142
$PROFILERS = 6;
143
 
144
# Netflow sources
145
# Define an ident string, port and colour per netflow source
146
#
147
# Required parameters:
148
#    ident   identifies this netflow source. e.g. the router name, 
149
#            Upstream provider name etc.
150
#    port    nfcapd listens on this port for netflow data for this source
151
#			 set port to '0' if you do not want a collector to be started
152
#    col     colour in nfsen graphs for this source
153
#
154
# Optional parameters
155
#    type    Collector type needed for this source. Can be 'netflow' or 'sflow'. Default is netflow
156
#	 optarg	 Optional args to the collector at startup
157
#
158
# Syntax: 
159
#         'ident' => { 'port' => '<portnum>', 'col' => '<colour>', 'type' => '<type>' }
160
# Ident strings must be 1 to 19 characters long only, containing characters [a-zA-Z0-9_].
161
 
162
%sources = (
163
    'ipt_netflow'    => { 'port' => '2055', 'col' => '#0000ff', 'type' => 'netflow' },
164
);
165
 
166
#
167
# Low water mark: When expiring files, delete files until
168
# size = $low_water % of max_size
169
# typically 90 
170
$low_water = 90;
171
 
172
#
173
# syslog facility for periodic jobs
174
# nfsen uses level 'debug', 'info', 'warning' and 'err'
175
# Note: nfsen is very chatty for level 'debug' and 'info'
176
# For normal operation, you may set the logging level in syslog.conf
177
# to warning or error unless you want to debug NfSen
178
$syslog_facility = 'local3';
179
 
180
#
181
# SYSLOG mess 
182
# Log socket type: Most *NIX such as LINUX and *BSD are fine with 'unix'
183
# which is the default. You need to change that to 'stream' or 'inet' for 
184
# some Solaris version 8/9, AIX and others ..
185
# You may set it to undef to prevent calling Sys::Syslog::setlogsock at all
186
# ( works for Solaris 10 and newer Sys::Syslog module
187
#
188
# If not defined at all, 'unix' is assumed unless for Solaris, which defaults to 'stream'
189
# $LogSocket = 'unix';
190
 
191
#
192
# Plugins
193
# Plugins extend NfSen for the purpose of: 
194
# Periodic data processing, alerting-condition and alerting-action
195
# For data processing a plugin may run for any profile or for a specific profile only.
196
#     Syntax: [ 'profile list', 'module' ]
197
#            profile list:  ',' separated list of profiles ( 'profilegroup/profilename' ), 
198
#                           or '*' for any profile, '!' for no profile
199
#            module:        Perl Module name, equal to plugin name 
200
# The profile list '!' make sense for plugins, which only provide alerting functions
201
#
202
# The module follows the standard Perl module conventions, with at least one
203
# function: Init(). See demoplugin.pm for a simple template.
204
#
205
# A file with the same name in the FRONTEND_PLUGINDIR and .php extension is automatically
206
# recongized as frontend plugin.
207
#
208
# Plugins are installed under 
209
# $BACKEND_PLUGINDIR and $FRONTEND_PLUGINDIR
210
 
211
@plugins = (
212
    # profile    # module
213
     [ 'live','PortTracker' ],
214
);
215
 
216
%PluginConf = (
217
	# For plugin demoplugin
218
	demoplugin => {
219
		# scalar
220
		param2 => 42,
221
		# hash
222
		param1 => { 'key' => 'value' },
223
	},
224
	# for plugin otherplugin
225
	otherplugin => [ 
226
		# array
227
		'mary had a little lamb' 
228
	],
229
);
230
 
231
#
232
# Alert module: email alerting:
233
# Use this from address 
234
$MAIL_FROM   = 'your@from.example.net';
235
 
236
# Use this SMTP server
237
$SMTP_SERVER = 'localhost';
238
 
239
# Use this email body:
240
# You may have multiple lines of text.
241
# Var substitution:
242
# @alert@ 		replaced by alert name
243
# @timeslot@	replaced by timeslot alert triggered
244
$MAIL_BODY	 = q{ 
245
Alert '@alert@' triggered at timeslot @timeslot@
246
};
247
 
248
######################################################
249
#
250
# For the NfSen simulator include the section below.
251
#
252
######################################################
253
#
254
# Nfsen Simulator
255
# The simulator requires, that you have already installed
256
# and configured NfSen. The simulation is based on already
257
# pre-colleted data, which you may get from another live 
258
# NfSen system.
259
# 
260
# Steps to setup the NfSen simulator:
261
# 1. Configure the sources of the live profile with the 
262
#    same names of the NfSen system, you take netflow data
263
#    for the simulation. Set the port for each netflow source
264
#    to 0 to prevent a collector to be started.
265
#    Install NfSen with this config in a seperate directory
266
# 2. Copy the pre-collected data into the appropriate 
267
#    netflow directory of the live profile.
268
# 3. Configure the simulator using the parameters below
269
#    Enable Simulation mode => $SIMmode = 1
270
#    Configure the time window of the pre-collected data.
271
#      tstart    => Start of time window. yyyymmddhhmm
272
#      tbegin    => Optional parameter. Start of simulation 
273
#                   profile exists already between tstart - tbegin
274
#      tend      => End of time window. yyyymmddhhmm
275
#      cycletime => simulation time in seconds of a 5min slot
276
#    Setting cycletime = 0 processes the cycles as fast as
277
#    possible. Please note, if you test plugings, your 
278
#    cycletime needs to be at least the time required to 
279
#    process all plugins.
280
# 4. Start nfsen: ../nfsen start
281
#    Simulation starts
282
#
283
# The simulator runs from tstart to tend and stops when tend
284
# is reached. You may stop the simulation at any given time
285
# using ./nfsen stop. To continue the simulation start NfSen
286
# again: ./nfsen start. You may reset the simulator at any
287
# given time using ./nfsen abort-reset. This stops the sumulation
288
# and rolls back to tstart. All profiles/alerts are deleted,
289
# so you may start from scratch again.
290
#
291
# Configure simulator parameters
292
#
293
# $SIMmode = 1;
294
# %sim = (
295
#    'tstart'     => '200707100000',	# Simulation data available from July 10th 2007 00:00
296
#    'tbegin'     => '200707110000',	# Simulation begins at July 11th 2007 00:00
297
#    'tend'       => '200707112355',	# Simulation ends at July 11th 2007 23:55
298
#    'cycletime'  => '30',				# 30s per 5min slot
299
# );
300