Internally Ein is a stream processing engine not unlike the Brown Universities' Aurora Project or MITs' Medusa Project. Their focus is on distributed sensor systems and financial markets, while eins' focus is on construction of a network testbeds and the metricing and manipulation of those testbeds.
The best way to describe it is to take a look at some of it's Output. or a group of tests examining the performance impacts of different configuration options for snort in a passive mode stand alone 2
Ein can produce bar charts, time charts, xy plots, hypothesis testing, and more. Data sets can be gathered, then analyzed retrospectively with other data sets, or analyzed in soft real time.
To better manage the tests and insure there reproducibility, there is an associated testbed definition language, as well as an execution engine to build testbeds out of resources made available by a queuing system.
When you need it the most, is a very poor time for a monitoring system to become useless.
RAM is somewhere around $100 / GIG. Disk is somewhere around $1 / GIG depending on what sort you require. If adding 4 gigs of RAM to the machine will save a day of 'tuning and tweaking' the system... just get the RAM.
It's with the docs, because the system is only useable for reading, and it goes nicely with Slash-S.
After all the multiplication is still just one second.
Aggregation is problem in todays world, primarily because it's so easy to become lost in scale. Here is a little raft of sanity in a storm of crazy.
The script output, a table of costs and bitrates
The code is included for completeness.
It uses a velocity based measurement to alarm only when there is a volume filling quickly compared to the amount left in the partition.
It also is able to alter the users with the oldest/largest sets of files.
The goal of the project is to eventually build an active mapping tool that can figure out on it's own A) what type of device it's targeting and B) taylor it's probes to that host.
When machines don't agree on time, things can go subtly and silently wrong. Builds, especially partial builds are prone to this sort of problem.
# gulfie SunOS wynn ~/p/mon/mon.d # :) ipgen 10.1.100.0 24 | xargs mon_clockdiff siege -24 Wed Jul 18 12:58:10 2001 robin -14 Wed Jul 18 12:58:20 2001 nis3 -19 Wed Jul 18 12:58:15 2001 superman -19 Wed Jul 18 12:58:15 2001 kardon 6 Wed Jul 18 12:58:40 2001 blade -4 Wed Jul 18 12:58:30 2001 hulk -24 Wed Jul 18 12:58:10 2001 spaceghost -29 Wed Jul 18 12:58:05 2001 igoo -39 Wed Jul 18 12:57:55 2001 tundro -88 Wed Jul 18 12:57:06 2001 zandor -8 Wed Jul 18 12:58:26 2001 idiot -55 Wed Jul 18 12:57:39 2001 karma -46 Wed Jul 18 12:57:49 2001 rei -58 Wed Jul 18 12:57:37 2001 chips 500 Wed Jul 18 13:06:55 2001 ninja -3 Wed Jul 18 12:58:32 2001 tremor -25 Wed Jul 18 12:58:20 2001 cog 262 Wed Jul 18 13:03:07 2001 draco 6 Wed Jul 18 12:58:52 2001 chango 20 Wed Jul 18 12:59:06 2001 batman -21 Wed Jul 18 12:58:25 2001
If all the machines are running ntpd with the correct security settings a much better solution is just to run:
ntpdate -q -p 8 {list of ip addresses} 127.0.0.1
Wed Jul 18 13:07:39 PDT 2001
277 /usr/dt/bin/dtlogin -daemon
4141 /usr/dt/bin/dtlogin -daemon
5130 /bin/ksh /usr/dt/bin/Xsession
5179 /usr/dt/bin/sdt_shell -c unsetenv _ PWD; unsetenv DT;
5182 -csh -c unsetenv _ PWD; unsetenv DT; setenv DISP
5207 /usr/dt/bin/dtsession
5217 dtwm
3559 /usr/dt/bin/dtterm
3567 /bin/csh
3597 bash
13872 /bin/sh ./ptreemon 3597
13928 /usr/proc/bin/ptree 3597
The first argument is where you want to traceroute too.
Some due to apathy, some due to not having access to the requisite stuff.
It's good for post processing logs, and a number of other things.
# gulfie SunOS wynn ~ # :) ipgen 10.1.106.0 24 | fping | grep -v alive | hostify titan (10.1.106.4) is unreachable sap8000 (10.1.106.9) is unreachable dtran-laptop (10.1.106.11) is unreachable bdhillon-laptop (10.1.106.12) is unreachable llin-laptop (10.1.106.13) is unreachable tliou-laptop (10.1.106.15) is unreachable slim-laptop (10.1.106.16) is unreachable <..>
If you are at a site that has several hundred machines in your name service, try doing something like 'fortune | ipify', it's kinda funny even though it hurts the name servers.
Warning This is going to put a little load on the name servers.
This sort of thing really helps when you are rummaging around someone's network trying to figure out what is what.
wakamole:~/p/hostify gulfie$ arp -a ? (192.168.21.1) at 0:6:25:86:8f:d7 on en0 [ethernet] ? (192.168.21.50) at 0:4:0:43:e3:b2 on en0 [ethernet] ? (192.168.21.104) at 0:7:e9:19:e0:7b on en0 [ethernet] ? (192.168.21.255) at ff:ff:ff:ff:ff:ff on en0 [ethernet]
Becomes.
wakamole:~/p/hostify gulfie$ arp -a | ./macify ? (192.168.21.1) at 0:6:25:86:8f:d7 (The Linksys Group, Inc.) on en0 [ethernet] ? (192.168.21.50) at 0:4:0:43:e3:b2 (LEXMARK INTERNATIONAL, INC.) on en0 [ethernet] ? (192.168.21.104) at 0:7:e9:19:e0:7b (Intel Corporation) on en0 [ethernet] ? (192.168.21.255) at ff:ff:ff:ff:ff:ff (unknown vendor) on en0 [ethernet]
# gulfie SunOS wynn ~
# :) find /tmp -ls -type f | awk ' { print $7 } ' | colsum
6944428
Currently this requires ipgen, and timeout, but shouldn't. I need to fix that. It also requires fping, I'm not sure I'll fix that.
I use to use this to automatically fail over between my DSL and Cable Modem. It worked great. Eventually the Cable modem got stable enough, and the DSL flaky enough that I just stopped caring about the DSL and eventually it got shut off.
There are two variables at the top of the script, primary_gate, and secondary_gate. Set these to your primary and secondary gateway options.
# gulfie SunOS wynn ~ # :) ipgen 10.1.106.0 24 | fping | grep -v alive 10.1.106.4 is unreachable 10.1.106.9 is unreachable 10.1.106.11 is unreachable 10.1.106.12 is unreachable 10.1.106.13 is unreachable 10.1.106.15 is unreachable 10.1.106.16 is unreachable 10.1.106.17 is unreachable 10.1.106.19 is unreachable
# gulfie SunOS wynn ~
# :) pathalize `which netscape`
for the majic (/home/gulfie/ag/bin/netscape)
dr-xr-xr-x 3 root root 3 Jul 18 12:42 /home
drwxr-xr-x 78 gulfie staff 253952 Jul 18 12:34 /home/gulfie
drwxr-xr-x 23 gulfie staff 4096 Jul 12 14:15 /home/gulfie/ag
drwxr-xr-x 2 gulfie staff 12288 Jul 12 14:15 /home/gulfie/ag/bin
lrwxrwxrwx 1 gulfie staff 61 Jul 12 14:15 /home/gulfie/ag/bin/netscape -> /s/office/comm/www/netscape_communicator/v477-us/bin/netscape
drwxr-xr-x 14 gulfie other 4096 Jul 18 12:13 /s
drwxr-xr-x 13 gulfie other 4096 Mar 23 12:26 /s/office
drwxr-xr-x 4 gulfie staff 4096 Dec 27 2000 /s/office/comm
drwxr-xr-x 3 gulfie staff 4096 Dec 18 2000 /s/office/comm/www
drwxr-xr-x 6 gulfie staff 4096 Apr 5 20:31 /s/office/comm/www/netscape_communicator
drwxr-xr-x 5 gulfie staff 4096 Apr 5 20:33 /s/office/comm/www/netscape_communicator/v477-us
drwxr-xr-x 2 gulfie staff 4096 Apr 5 20:39 /s/office/comm/www/netscape_communicator/v477-us/bin
lrwxrwxrwx 1 gulfie staff 20 Apr 5 20:35 /s/office/comm/www/netscape_communicator/v477-us/bin/netscape -> ../netscape/netscape
drwxr-xr-x 9 gulfie staff 4096 Apr 5 20:33 /s/office/comm/www/netscape_communicator/v477-us/netscape
-r-xr-xr-x 1 gulfie staff 15597876 Mar 26 20:18 /s/office/comm/www/netscape_communicator/v477-us/netscape/netscape
# gulfie SunOS wynn ~
# :) pathfinder $PATH
wilbur : /home/gulfie/ag/sbin
wilbur : /home/gulfie/ag/bin
/usr/bin
/usr/sbin
hawg : /home/gulfie/atm/bin
hawg : /home/gulfie/atm/sbin
wilbur : /home/gulfie/bin
/usr/proc/bin
/usr/bin
No workie workie for the (/usr/ucb/bin)
/usr/openwin/bin
squealer : /apps/SUNWmotif/bin
wilbur : /apps/lsf40_27/bin
/usr/platform/sun4u/sbin
arnold : /opt/frame6/bin
There are lots of places that this can be used, trivial load balancers, trivial fortune implementations and the script I like to call 'lunch'. It uses rl to select a random line from a list of places to eat. It radically simplifies the standard lunch time problem of figuring out where to go.
rot13 is an example of a rather trivial class of cryptography algorithms that 2000 years ago was state of the art. rot13 can be used to trivially obscure data to make sure you don't accidentally see something you should not. An example would be something like the obscene fortune files, no one should be accidentally subjected to them, so they are protected by rot13.
It currently only runs on Solaris.
# gulfie SunOS hoss ~ # :) spankie 16908 1 1 lchen, 12.5, simv -l tester_verify.log +dump_enable 15791 1 1 lchen, 12.5, simv -l tester_verify.log +dump_enable 17604 1 1 lchen, 12.5, simv -l tester_verify.log +dump_enable
# gulfie SunOS wynn ~/bin # :) stat . file (.) File is ., size is 4096, perm 0755, mtime Wed Jul 11 16:45:57 2001, atime Wed Jul 18 13:15:52 2001, ctime Wed Jul 11 16:45:57 2001
# gulfie SunOS wynn ~ # :) who_here 1 adm 12 uucp 25 bin 27 lp 80 34855 757 root 4392 nobody4 118175 gulfie