OURMON Installation and Configuration on FreeBSD 7 with Multi-threading Support
OURMON is popular known as open source Network Monitoring and Anomaly Detection System. It’s very useful for a web hosting provider or Internet Service Provider to study their network behavior and detection for any network attack such as DoS or DDoS.
Beside study your network behavior, it also can analyze your network protocols activities, tcp w0rm activity, p2p activity and etc.
Here is the step by step OURMON installation and configuration on FreeBSD with multi-threading support.
OUR source package can be downloaded on official sourceforget download page. I strongly suggest that do not install OURMON from port (due to the update on the package is quite slow), but before proceed on OURMON source install, there are several dependencies need to be installed;
cd /usr/ports/devel/pcre && make install clean distclean
cd /usr/ports/net/libpcap && make install clean distclean
cd /usr/ports/databases/rrdtool && make install clean distclean
Apache Web Server
cd /usr/ports/www/apache20 && make install clean distclean
OURMON Installation and Configuration
After above dependencies has been installed, now we proceed with OURMON installation and configuration;
untar yor ourmon package and your will see a folder name mrourmon. Copy the folder to /usr/local;
cp -rf mrourmon /usr/local/
In order to enable multi-threading support, there are some changes need to be made on your OURMON’s Makefile.
On line 27 and 30, uncomment the line which look like below;
CFLAGS=-O4 -DBSD -DTHREAD
LFLAGS=-O4 -static -DTHREAD
Also on line 18, change the BINDDIR to the directory that we are going to install ourmon;
After that, save the file and we are ready to roll, go to OURMON root directory and run configure.pl for installation;
Follow the on screen guide to go through the installation, after ourmon is install, we are ready to fire it up… But there are minor changes need to be made in order to support multi-threading. Open up ourmon start up file and make the below changes;
On line 11, add extra argument (-T 2 ) into OURMON launch command and it will look like this;
/usr/local/mrourmon/bin/ourmon -T 2 -a 30 -s 256 -f /usr/local/mrourmon/etc/ourmon.conf -i bce1 -D /usr/local/mrourmon/tmp &
the argument -T 2 is to spawn 2 ourmon processes, if you have more processor on your server, you might want to add more; after that monitor on your server load, see whether it will crash your server or not 😉
Run top command and monitor on your server load.
By default, OURMON web html files are located at /usr/local/www/data/ourmon, we suggest that you setup virtualhost to access to OURMON from your web browser;
Deny from all
Allow from 18.104.22.168 # only allow authorized IP Address to access your OURMON.
CustomLog /var/log/ourmon-access_log common
You might also interest to change the viewing of OURMON site at your own convenience at /usr/local/www/data/ourmon/index.html, remember to make a copy before you make any changes.
Below are some graph that shown on our OURMON page;
updated : 19/10/2008
1. when start ourmon with “/usr/local/etc/rc.d/ourmon.sh start” return error :
sysctl: unknown oid ‘debug.bpf_bufsize’
sysctl: unknown oid ‘debug.bpf_maxbufsize’
change “sysctl -w debug.bpf_bufsize=8388608” & “sysctl -w debug.bpf_maxbufsize=8388608” in /usr/local/etc/rc.d/ourmon.sh to “sysctl -w net.bpf.bufsize=8388608” & “sysctl -w net.bpf.maxbufsize=8388608” to solve the error.
2. should the promicuous interface not picking up any traffic, bring it down (e.g. ifconfig rl0 down) and bring it up (ifconfig rl0 up) again should do the trick. Use tcpdump -i rl0 to see if it see any traffice.