Network monitoring - ideas? Theory....
Posted on 2013-12-20
I am trying to setup a monitoring system using various components. What I am looking to gather data on is Syslog, SNMP (bandwidth usage) and NetFlow for about 50 Cisco ASAs. I know I could go with one of the big providers like SolarWinds or Plixer but they are pricy. At this point we really can't afford to drop the cash on a big product just yet, but I'm sure we will once we get some results... Anyway... Here are my thoughts, please let me know where any of this makes sense or give advice as to what best to do.
I've been playing with Ntop, Splunk, Kiwi, Cacti, and NetCrunch. We currently use NetCrunch for server monitoring. I want something more geared toward network monitoring. Since we are trying to save cash out of the gate, I am trying to use open source stuff where possible. Cacti is alright and gets the job done. It's a bit limited but works for now. I use it for bandwidth monitoring only now. What I would like to do is gather all the data in one point and parse it out to applications as necessary. We don't always need to be monitoring a specific node all of the time. Would it make sense to pull all of the SNMP and Syslog data into say.. Kiwi, then forward it along with some rules applied to Cacti for bandwidth... then some of the Syslog data that matches a filter to Splunk? Then there is Netflow. I would love to get this working. A client may want us to monitor a system for a month and give them a report that says in detail what kind of traffic they are using. I know with NetFlow that is a whole lot of data and most of the free licenses will not allow us to use all of it (Splunk with it's 500MB/Day quota).
If you can gather what it is that I'm trying to do, what advice would you give me?
I hope this isn't too scattered but I'm new to this and learning a lot.