Using Nagios XI to monitor bandwidth - Help

[tgelzaines]

I've recently been tasked with configuring Nagios XI to monitor ingress & egress traffic at my new job, ideally to show a graph or simply an alert to tell us when we've reached our threshold. I have no prior knowledge of Nagios and have spent the last 2 weeks trying to learn it from various tutorials and videos but am still struggling with it. I am in need of some direction as I'm unsure how to get this configured properly. I'd appreciate any input from you all. Thank you!

[tmcdonald]

Two solutions that come to mind both involve using SNMP (Simple Network Management Protocol) which can be rather tricky:

1.) Within Nagios, poll your router/target device via SNMP to get the current bandwidth usage. Your device will need to support this and it probably won't follow trends very well (so a sudden spike in traffic might set off an alarm for a little while). You also run into the issue of missing those spikes if you aren't checking frequently enough. A couple links to get you started:

http://exchange.nagios.org/directory/Ad ... rd/details
http://exchange.nagios.org/directory/Pl ... th/details

2.) We have another product called Nagios Network Analyzer (NNA) that will show you much more data (who is talking with whom, the protocol used, etc) using NetFlow and similar data. Might be a little overkill for what you need, but it is easier to set up and allows you to get that extra data later on if you need to.

http://assets.nagios.com/downloads/nagi ... alyzer.pdf

[tgelzaines]

I downloaded and installed the Switch/Router monitor and enabled SNMP access on one of our switches, Nagios is now monitoring the specified ports as I have configured. Thank you for the help!

Is there way to take this any further? Such as aggregating all ports on the switch and outputting the total in/out traffic for the entire switch rather than on a per port basis. As well as taking that information and putting it into a graph?

We have a machine dedicated to displaying NagiosXI information on a mounted LCD TV. It cycles through specified views so we can immediately see what is happening on our network. Because of the way our internet billing works I would like to create a view that displays our up to date bandwidth information and an alert if we go over our allotted amount (we get charged significantly if our bandwidth usage exceeds the given limit and does not subside within 24 hours of the occurrence).

[sreinhardt]

I don't happen to know of a way to do this via mrtg, however you might be able to modify the check_mrtraff plugin to accept multiple rrd files and combine into one. Otherwise you might be more interested in another product(I know, sorry ) called Nagios Network Analyzer that would accept flow data from your devices. Not only does it integrate with XI for check results, but it would allow you to see total traffic and get more detailed information on what types of traffic and where its going. Just an additional thought if you're interested.

[tgelzaines]

Could I instead use SNMP checks or a plug-in to monitor our Cisco ASA? All traffic on our network first passes through the firewall.

[slansing]

The switch/router monitoring wizard is checking over SNMP already, from the sounds of it you may want to take a look at the Network Analyzer. The NNA has a 60-day trial and you could take a look and see if it will do what you are looking to accomplish:

http://www.nagios.com/products/nagios-network-analyzer

[tgelzaines]

I will definitely look into the Network Analyzer. We currently have PRTG running on our network. Is there any way to integrate NagiosXI with PRTG?

[tmcdonald]

I checked on Google and our Nagios Exchange where we host our plugins, and I haven't seen anything. My guess is probably not.

[tgelzaines]

One last question then,

I am going to attempt to use the SNMP Monitoring wizard with our Cisco ASA. However, I'm unsure as to what OID's to use to relay traffic information on the ASA, or if this is even possible. Can anyone send me in the direction for a list of OID's and how to properly use them?

Thanks again for all of the responses! I really appreciate the input.

[sreinhardt]

We don't really have a list of oids that you would want to monitor. It often depends on the modules installed, licensing, and version of IOS. I would highly suggest looking at the cisco support site, from personal experience they have most anything listed that you could want. Also, wanting to monitor different items is highly subjective to the environment so it's pretty tough to say.