Monitoring Windows Server 2008 R2 with SNMP and Cacti - part2

(Page 2)
Configure Cacti Server
Now we need to configure our Cacti server.  Type http://YourCactiServer/cacti/ into your web browser and login.

On the left side under the Management section click Devices.

Monitoring Windows Server 2008 R2 with SNMP and Cacti - part1

So you have a new Windows Server 2008 R2 installed and now you’d like to start gathering statistics about how it’s performing.  The SNMP protocol is a great way to get started.  In this tutorial I will install the SNMP agent service on a Windows server and configure it to allow queries from a SNMP based management server.  On the management server I will use a tool named Cacti that can collect this SNMP information and generate graphs from it in a fairly easy way.  I will assume that you have a server with Cacti already set up.  If not, details on how to set up an instance of Cacti on a CentOS Linux server can be found

Set Up Rsyslog and LogAnalyzer on CentOS Linux 5.5 for Centralized Logging - part3

(Page 3)
Configuring Rsyslog for Remote Logging
Now we’ll configure our rsyslog server to allow acceptance of syslog messages from other network devices.  First we need to configure the firewall to allow inbound traffic on port 514.  In this example I will add two rules to allow traffic via TCP and UDP.  Syslog by default only allows for message transmission through UDP but rsyslog adds TCP for more reliable message transmission.  Add these rules to “/etc/sysconfig/iptables”:

-A RH-Firewall-1-INPUT -p udp -m udp --dport 514 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 514 -j ACCEPT
Now restart the iptables firewall:

# service iptables restart
We need to add code to allow rsyslog to accept messages from remote syslog hosts.  Basically we’ll specify to accept messages via TCP and UDP from the localhost and hosts on the 192.168.1.0 subnet.  Add these lines near the top of the “/etc/rsyslog.conf” file above the code that we added previously related to MySQL.

$AllowedSender UDP, 127.0.0.1, 192.168.1.0/24
$AllowedSender TCP, 127.0.0.1, 192.168.1.0/24
At one point there was a bug in rsyslog which prevented the above lines from working and syslog messages were accepted from all senders.  This appears to be corrected now.  Another possibility to limit accepted senders is to place limits through the port 514 rule sets that we defined earlier in the iptables firewall configuration file.

Set Up Rsyslog and LogAnalyzer on CentOS Linux 5.5 for Centralized Logging - part2

(Page 2)
Now some additional configuration of LogAnalyzer is required in the web browser.  Point your browser out to your server and the LogAnalyzer subdirectory, in my case it is http://web1/loganalyzer.

In the middle under Critical Error click “here” in the “Click here to Install” line.

Set Up Rsyslog and LogAnalyzer on CentOS Linux 5.5 for Centralized Logging - part1

LogAnalyzer is a web based program that allows you to view event messages from a syslog source within your web browser.  Rsyslog is a drop in replacement for the syslog daemon that among other things allows syslog messages to be saved in a MySQL database.  Combining these two great programs and directing other network devices to forward syslog messages to a central server allows for a very powerful solution for searching and archiving event messages that occur throughout your network environment.  In this example I will install rsyslog on a CentOS Linux 5.5 server to aggregate and collect syslog messages and configure LogAnalyzer on the same server to allow for a user friendly interface for viewing and searching through these messages.