1. MONITORING THE CONNECTICUT EDUCATION NETWORK Aliza Bailey 10/20/2010

2. The Connecticut Education Network  Scott Taylor  Nick Burr  Ray Carcano  Aliza Bailey  Wendy Rego John Vittner (DOIT) Jack Babbit (Uconn)

3. The Connecticut Education Network Over 300 Devices Statewide K-12 Sites Libraries Higher Education Colocations Sponsored Participants Filtering appliances, Servers, etc Multiple Carrier Mediums Fiber Optics DSL Frame Relay/ATM GigE

4. The Connecticut Education Network  CEN provides 24X7 technical support to all our Higher Ed and paying members  Weekly rotating on-call schedules  Off hours monitoring by Indiana University’s GRNOC, who also monitor Internet2  DOIT operations have a dedicated CEN device monitor (WhatsUp)  K12 and Libraries receive technical support during business hours

5. The Connecticut Education Network  Device, Interface, and Link states  Ingress/Egress Traffic  CPU  Memory  Disk Space  Alerts to multiple recipients (pager, email, etc)  Visualization of activity Tandem monitoring solutions are required to fulfill all our needs as redundancy and reliability are our #1 concern

6. The Open Road: Cacti Monitoring CEN

7. Cacti  Free!  A front end tool for collecting and graphing data sources (SNMP)  Supports numerous plugins  Runs on Windows, Linux, or live DVD (CactiEZ)  Requires MySQL, PHP, and IIS or Apache

8. Cacti & CEN  Two servers running Cacti  Dell 6850 Quad Xeon  5x146G RAID  30G RAM  1Gb Ethernet connection  Monitor2  Member site monitoring  GPS Map  Monitor  Core devices, Servers, UPS  Syslog  Nagios  Weathermap & other plugins

9. Cacti & CEN  “SuperLinks”  Turned Monitor into our “portal” with tabs for other services  Weathermap  Color coded map with traffic density and direction  Nagios  Another open source monitoring suite we have combined with Cacti  Syslog  Houses our Syslog service

10. Cacti & CEN  Cacti sends emails to our internal group email address with device state changes  Most effective during business hours  Nagios emails our internal group email as well as our on call Blackberry for defined events  Link state changes, thresholds, service issues  Our “backup” to WhatsUp for alerts  Daily Email and SMS test sent to the on call Blackberry

11. Licensed to Watch: WhatsUp Monitoring CEN

12. WhatsUp  Commercial network discovery and monitoring package  Real-time customizable alerts  Reports  Windows based  User friendly installation

13. WhatsUp & CEN  Currently Dell 2950  2 Xeon  3 x 146G RAID  8G RAM  1G Ethernet  Migrating to VMWare  Dell 6850 Quad Xeon  5 x 73G RAID  32G RAM  Will share resources with our Backup and File Server

14. WhatsUp & CEN  Home Workspace gives a snapshot of the state of the network  Device or Map View  Map View links connected sites with a line  Monitors and Alerts on  Interface state changes  Ping (device availability)  Web filtering  DNS

15. WhatsUp &CEN  WhatsUp allows for creation of actions and action policies for notification of network events  Emails both the group’s internal monitoring email address as well as the on call pager  DOIT’s Operations has a screen dedicated to our WhatsUp server for off hours monitoring

16. Cacti vs. WhatsUp Monitoring CEN

17. The Good News  Cacti  User roles & authentication  Depth of monitoring  Plugins  Linux or Windows  Open source  WhatsUp  Better “dashboard”  Map links  Easier initial setup  Product support

18. The Bad News  Cacti  Requires advanced knowledge of Linux  Greater time investment upfront for templates  Community support by forums  WhatsUp  “Busy” interface at times  Map can get congested with devices  Windows only  License causes failover issues

19. CEN’s Integration  Cacti and WhatsUp provide CEN with required redundancy of alerts  Services reside on separate servers with core connections through separate switches  WhatsUp is mostly focused on monitoring interface state changes  Cacti & Nagios focus more on services and system health, while providing a backup to WhatsUp  Double alerts can be received for one event