New Life in Taipei

RouterOS CPU效能監控發送即時告警

2022-09-03T12:58:00.004+08:00

CPU效能監控發送即時告警，DeviceAverageLoadThreshold設定為CPU平均用量超過40%，送出Slack告警通知

/system scheduler

add interval=5m name=CPUOverloadCheck on-event=":local ScriptName \"CPUOverloadCheck\";\r\

\n:local ScriptRunning [system script job find where script=\$ScriptName];\r\

\n:if (\$ScriptRunning) do={\r\

\n :log info \"The script \$ScriptName cannot be run, the script is already running (Change the NumberOfMeasurements to redu\

ce the script)\";\r\

\n} else={\r\

\n /system script run \$ScriptName;\r\

\n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup

/system script

add dont-require-permissions=yes name=CPUOverloadCheck owner=wallacelocal policy=\

ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":local DeviceAverageLoadThreshold 40;\r\

\n:local NumberOfMeasurements 5;\r\

\n:local Time [/system clock get time];\r\

\n:local Date [/system clock get date];\r\

\n:local Load 0;\r\

\n:local Message \"\";\r\

\n:for Measurement from=1 to=\$NumberOfMeasurements do={\r\

\n :local CPULoad [/system resource get cpu-load];\r\

\n :set Load (\$Load + \$CPULoad);\r\

\n :set Message (\$Message . [:tostr \$CPULoad] . \"% \");\r\

\n :delay 5s;\r\

\n}\r\

\n:local AverageCPULoad (\$Load / \$NumberOfMeasurements);\r\

\nif (\$AverageCPULoad > \$DeviceAverageLoadThreshold) do={\r\

\n :log warning \"Average CPU load = \$AverageCPULoad%\";\r\

\n :set Message \"CPU utilization exceeded \$DeviceAverageLoadThreshold% threshold. Result of \$NumberOfMeasurements times C\

PU load measurements: \$Message\";\r\

\n :local MessageText \"CPU Average Overload \$AverageCPULoad%. \$Message\";\r\

\n\t/tool fetch mode=https url=\"https://hooks.slack.com/services/AAAZ0S4ZZ/B5EJGGGER/3427P7uGAGAbiYC\" http-method=p\

ost http-data=\"payload={\\\"text\\\": \\\"\$MessageText\\\",\\\"channel\\\":\\\"circuit-alert\\\",\\\"username\\\":\\\"\$[/sy\

stem identity get name]\\\",\\\"icon_url\\\":\\\"https://spy-family.net/assets/img/special/episode11/01.png\\\"}\"\r\

\n}"

RouterOS SCP備份Script

2022-08-26T15:53:00.002+08:00

#For SCP Backup
/system backup save name=full
:local strid (:put ([/system identity get name] . ".backup"));
:put $strid;
/tool fetch upload=yes url="sftp://10.77.21.41/home/autobackup/ROS-Backup/$strid" user=autobackup password=dafsdfXX13X src-path=full.backup src-address=10.33.41.26

Cacti 指令加入監控device

2022-08-10T09:39:00.005+08:00

先用下方指令找出對應的template ID的對應

php -q /var/www/html/cacti/cli/add_graph_template.php --list-hosts

php -q /var/www/html/cacti/cli/add_tree.php --list-hosts

建立設備清單對應表
[root@LAB ~]# vi ROSID
10.233.88.21 ROS-CHT-03-DCLAB
10.233.88.22 ROS-CHT-04-DCLAB
10.233.88.23 ROS-CHT-05-DCLAB
10.233.88.24 ROS-TFN-17-DCLAB
10.233.88.25 ROS-TFN-18-DCLAB
10.233.88.26 ROS-TFN-19-DCLAB
10.233.88.27 ROS-TFN-20-DCLAB
10.233.88.28 ROS-TFN-21-DCLAB

建立一組Script讀入指定的設備清單
[root@LAB ~]#vi autoROS.sh
#!/bin/sh
while read IP HOST
do
php /var/www/html/cacti/cli/add_device.php --description=${HOST} --ip=${IP} --community=XXXZZZZ --template=13;
done < /root/ROSID

最後執行 Script即完成

[root@LAB ~]#chmod +x autoROS.sh
[root@LAB ~]#sh autoROS.sh

還有其它更進階的用法，例如連圖片Graph也加上，更多指令用法可參考
https://files.cacti.net/docs/html/index.html
https://files.cacti.net/docs/html/cli_add_device.html
https://files.cacti.net/docs/html/cli_add_graph_template.html
https://files.cacti.net/docs/html/cli_add_data_query.html

ElastiFlow + Grafana 分析流量應用

2021-10-24T23:00:00.010+08:00

工作早期使用的Neflow分析軟體NfSen太舊了(官方已無更新)，加上新版的瀏覽器無法完全支援，索性將全部的Netflow網管主機換成比較新的分析軟體ElastiFlow來收集資料，然後再用 Grafana 去畫出自己想要的圖型分析跟告警發送。目前官方ElastiFlow Open Source的版本到4.0.1之後，就變成了收費軟體了，基於使用上的彈性，所以還是使用該版本做為使用。

以下為安裝的方式，會使用docker的方式來安裝ELK軟體，然後手動安裝Grafana軟體，並在做完必要的設定佈署後，會將Kibana給停用，節省主機的效能資源，因為是3種服務都安裝在同一台的方式，所以硬體效能不能太差(官方有建議的Flow per second對應的硬體規格)，以下為使用12 core 、46G RAM、1T HD的方式佈署。

先安裝Docker軟體
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum makecache fast
yum install docker-ce

確認安裝是否成功，並將服務加到開機會自動啟動
docker --version
sudo systemctl enable docker.service
sudo systemctl start docker.service
sudo systemctl status docker.service

安裝Docker Compose，之後可以用YAML 檔案來定義服務
curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

sudo chmod +x /usr/local/bin/docker-compose
檢查安裝是否有成功
docker-compose -v

接著照著ElastiFlow官方文件上面的建議，定義好YAML 檔案與優化Linux主機的UDP的效能
編輯vi /etc/sysctl.d/87-elastiflow.conf ，然後加入官方的建議UDP設定值，接著照著主機的效能規格去定義好相關的YAML檔案來使用Docker來啟動ELK服務收集Netflow資料
vi docker-compose.yml ，紅色的地方照實際需求修改對應的設定值

version: '3'

services:
  elastiflow-elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.8.1
    container_name: elastiflow-elasticsearch
    restart: 'always'
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 131072
        hard: 131072
      nproc: 8192
      fsize: -1
    network_mode: host
    volumes:
      # 使用下面命令建立數據目錄(把Netflow檔案放在Docker的外層本機目錄中)
      # mkdir /qyt_elastiflow && chown -R 1000:1000 /qyt_elastiflow
      - /qyt_elastiflow:/usr/share/elasticsearch/data
    environment:
      # JVM Heap size
      #   - 照使用的規格定義JVM的可用的Ram Size
      #   - 此處設定為25G
      ES_JAVA_OPTS: '-Xms25g -Xmx25g'
      cluster.name: elastiflow
      bootstrap.memory_lock: 'true'
      network.host: 0.0.0.0
      http.port: 9200
      discovery.type: 'single-node'
      indices.query.bool.max_clause_count: 8192
      search.max_buckets: 250000
      action.destructive_requires_name: 'true'

  elastiflow-kibana:
    image: docker.elastic.co/kibana/kibana:7.8.1
    container_name: elastiflow-kibana
    restart: 'no'
    depends_on:
      - elastiflow-elasticsearch
    network_mode: host
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 5601
      SERVER_MAXPAYLOADBYTES: 8388608

      ELASTICSEARCH_HOSTS: "http://127.0.0.1:9200"
      ELASTICSEARCH_REQUESTTIMEOUT: 132000
      ELASTICSEARCH_SHARDTIMEOUT: 120000

      KIBANA_DEFAULTAPPID: "dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5"
      KIBANA_AUTOCOMPLETETIMEOUT: 3000
      KIBANA_AUTOCOMPLETETERMINATEAFTER: 2500000

      LOGGING_DEST: stdout
      LOGGING_QUIET: 'false'

  elastiflow-logstash:
    image: robcowart/elastiflow-logstash:4.0.1
    container_name: elastiflow-logstash
    restart: 'always'
    depends_on:
      - elastiflow-elasticsearch
    network_mode: host
    environment:
      # JVM Heap size - this MUST be at least 3GB (4GB preferred)
      LS_JAVA_OPTS: '-Xms5g -Xmx5g'

      # ElastiFlow global configuration
      ELASTIFLOW_AGENT_ID: elastiflow
      ELASTIFLOW_GEOIP_CACHE_SIZE: 16384
      ELASTIFLOW_GEOIP_LOOKUP: 'true'
      ELASTIFLOW_ASN_LOOKUP: 'true'
      ELASTIFLOW_OUI_LOOKUP: 'false'
      ELASTIFLOW_POPULATE_LOGS: 'true'
      ELASTIFLOW_KEEP_ORIG_DATA: 'true'
      ELASTIFLOW_DEFAULT_APPID_SRCTYPE: '__UNKNOWN'

      # Name resolution option
      ELASTIFLOW_RESOLVE_IP2HOST: 'false'
      ELASTIFLOW_NAMESERVER: '127.0.0.1'
      ELASTIFLOW_DNS_HIT_CACHE_SIZE: 25000
      ELASTIFLOW_DNS_HIT_CACHE_TTL: 900
      ELASTIFLOW_DNS_FAILED_CACHE_SIZE: 75000
      ELASTIFLOW_DNS_FAILED_CACHE_TTL: 3600

      ELASTIFLOW_ES_HOST: '127.0.0.1:9200'
      ELASTIFLOW_NETFLOW_IPV4_PORT: 2055
      ELASTIFLOW_NETFLOW_UDP_WORKERS: 2
      ELASTIFLOW_NETFLOW_UDP_QUEUE_SIZE: 4096
      ELASTIFLOW_NETFLOW_UDP_RCV_BUFF: 33554432

      ELASTIFLOW_SFLOW_IPV4_PORT: 6343
      ELASTIFLOW_SFLOW_UDP_WORKERS: 2
      ELASTIFLOW_SFLOW_UDP_QUEUE_SIZE: 4096
      ELASTIFLOW_SFLOW_UDP_RCV_BUFF: 33554432

      ELASTIFLOW_IPFIX_UDP_IPV4_PORT: 4739
      ELASTIFLOW_IPFIX_UDP_WORKERS: 2
      ELASTIFLOW_IPFIX_UDP_QUEUE_SIZE: 4096
      ELASTIFLOW_IPFIX_UDP_RCV_BUFF: 33554432

接著在Linux上面先設定好NetFlow存放的外層目錄

mkdir /qyt_elastiflow && chown -R 1000:1000 /qyt_elastiflow
接著佈署容器，等待一段時間後、可瀏覽器中進入Kibana圖形化界面
docker-compose up -d

因為目前還沒有Netflow (UDP-2055)或是Sflow(UDP-6343)或是IPFX(UDP-4739)的資料丟入，所以會顯示無資料，此時需要去網路設備上面設定相關的Flow Exporter的發送設定，可參考先前文章的設定，LAB環境是使用RouterOS

在Kibana建立對應的索引

建立index pattern

名字取為elastiflow-4.0.1-*

接著選@timestamp 做為index的分類名

import elastiflow.kibana.7.8.x.ndjson 的內建面板(之後會用Grafana取代，非必要動作)
檔案從這邊捉取

匯入完成後，可以在界面中看到多個dashboards信息

接著在Linux上面先設定好需要的本機ACL

給本機自己讀取ElasticSearch

firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.88.5/32" port port="9200" protocol="tcp" accept"

給之後Grafana讀取ElasticSearch

firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.88.5/32" port port="9200" protocol="tcp" accept"
給第一次做import面板使用Kibana UI

firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.88.0/24" port port="5601" protocol="tcp" accept"

給NetFlow、Sflow、IPFX收取資料的服務端口

firewall-cmd --permanent --add-port=2055/udp

firewall-cmd --permanent --add-port=6343/udp

firewall-cmd --permanent --add-port=4739/udp

重新讀入新的ACL清單

firewall-cmd --reload

firewall-cmd --list-all --permanent

接著透過Kibana做index資料存放天數的設定，可照實際硬碟空間與每日的NetFlow資料量設定
此處建立一組lifecycle的規則叫做elastiflow

接著回到Index Management頁面，確定相關的狀態是否都為正常
因為只有一台ElastiSearch，要改一下shards與replicas的數量如下，不然不會顯示Green狀態

number_of_shards": "1"

number_of_replicas": "0"

將全部的容器都給開機的指令

docker-compose up -d
將全部的容器都給關機的指令
docker-compose stop

查詢目前使用中容器的指令
docker ps -a
查出目前執行中的容器的CONTAINER ID，並上網捉取GeoIP的資料庫放到本機中
更新一下GeoIP的資料庫到新版，用docker指令放到容器裡面的目錄

docker cp GeoLite2-ASN.mmdb af9ba8d2e4f9:/etc/logstash/elastiflow/geoipdbs/GeoLite2-ASN.mmdb

docker cp GeoLite2-City.mmdb af9ba8d2e4f9:/etc/logstash/elastiflow/geoipdbs/GeoLite2-City.mmdb

接著進入elastiflow-logstash的容器裡去調整shards與replicas的數量

docker exec -it 7e3dd0e3d558 /bin/bash
在容器裡面修改confg檔
vi templates/elastiflow.template.json

存檔後退出，再重新reload容器重帶服務後，設定便會生效

docker-compose stop

docker-compose up -d
docker ps -a

接著要使用Grafana來取代Kibana的畫圖功能，主要是Grafana可以做更好的圖表呈現與帳號的權限管理，在Kibana上面，這些都需要另外付費xpack授權才可以使用，Grafana的安裝方式如下

先新增Grafana Repository

vi /etc/yum.repos.d/grafana.repo

[grafana]

name = grafana

baseurl = https://packages.grafana.com/oss/rpm

repo_gpgcheck = 1

enabled = 1

gpgcheck = 1

gpgkey = http://packages.grafana.com/gpg.key

sslverify = 1

sslcacert = /etc/pki/tls/certs/ca-bundle.crt

安裝Grafana

yum install grafana

啟動grafana服務

systemctl daemon-reload

systemctl start grafana-server

查詢grafana服務狀態

systemctl status grafana-server

設定開機時自動啟動grafana服務

systemctl enable grafana-server.service

因為會使用Grafana來發送告警，所以需要先安裝告警發送的外掛

grafana-cli plugins install grafana-image-renderer

yum install -y alsa-lib.x86_64 atk.x86_64 cups-libs.x86_64 gtk3.x86_64 ipa-gothic-fonts libXcomposite.x86_64 libXcursor.x86_64 libXdamage.x86_64 libXext.x86_64 libXi.x86_64 libXrandr.x86_64 libXScrnSaver.x86_64 libXtst.x86_64 pango.x86_64 xorg-x11-fonts-100dpi xorg-x11-fonts-75dpi xorg-x11-fonts-cyrillic xorg-x11-fonts-misc xorg-x11-fonts-Type1 xorg-x11-utils

yum update nss -y

service grafana-server restart

接著就能開啟瀏覽器輸入http://<IP_Address>:3000登入，預設的帳號密碼都是admin

先對Grafana做一下設定config參數調整

vi /etc/grafana/grafana.ini (調整基本環境參數)

#################################### Server ####################################

[server]

# Protocol (http, https, h2, socket)

protocol = https

# The ip address to bind to, empty will bind to all interfaces

;http_addr =

# The http port to use

;http_port = 3000

# The public facing domain name used to access grafana from a browser

domain = 192.168.88.5

# https certs & key file

cert_file = /etc/grafana/cert.pem

cert_key = /etc/grafana/key.pem

#################################### Security ####################################

[security]

# disable creation of admin user on first start of grafana

;disable_initial_admin_creation = false

# default admin user, created on startup

;admin_user = admin

#改掉預設建立的密碼

# default admin password, can be changed before first start of grafana, or in profile settings

;admin_password = LAB58TT78V9XXX

# used for signing

;secret_key = AA2YcXXXTIGTY1LOhoPsMBB

#################################### Analytics ####################################

[analytics]

# Server reporting, sends usage counters to stats.grafana.org every 24 hours.

# No ip addresses are being tracked, only simple counters to track

# running instances, dashboard and error counts. It is very helpful to us.

# Change this option to false to disable reporting.

reporting_enabled = false

#################################### Auth LDAP ##########################

[auth.ldap]

enabled = true

config_file = /etc/grafana/ldap.toml

allow_sign_up = true

#;enabled = false

#;config_file = /etc/grafana/ldap.toml

#;allow_sign_up = true

#################################### SMTP / Emailing ##########################

[smtp]

enabled = true

host = smtp.hinet.net:25

;user =

# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""

;password =

;cert_file =

;key_file =

;skip_verify = false

from_address = NetFlow-LAB@LAB.com

from_name = NetFlow-LAB

# EHLO identity in SMTP dialog (defaults to instance_name)

ehlo_identity = LAB.com

# SMTP startTLS policy (defaults to 'OpportunisticStartTLS')

;startTLS_policy = NoStartTLS

#################################### Logging ##########################

[log]

# Either "console", "file", "syslog". Default is console and file

# Use space to separate multiple modes, e.g. "console file"

;mode = console file

# Either "debug", "info", "warn", "error", "critical", default is "info"

level = debug

#;level = info

# optional settings to set different levels for specific loggers. Ex filters = sqlstore:debug

;filters =

filters = ldap:debug

#################################### Grafana Image Renderer Plugin ##########################

[plugin.grafana-image-renderer]

# Instruct headless browser instance to use a default timezone when not provided by Grafana, e.g. when rendering panel image of alert.

# See ICU’s metaZones.txt (https://cs.chromium.org/chromium/src/third_party/icu/source/data/misc/metaZones.txt) for a list of supported

# timezone IDs. Fallbacks to TZ environment variable if not set.

;rendering_timezone =

# Instruct headless browser instance to use a default language when not provided by Grafana, e.g. when rendering panel image of alert.

# Please refer to the HTTP header Accept-Language to understand how to format this value, e.g. 'fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5'.

;rendering_language =

# Instruct headless browser instance to use a default device scale factor when not provided by Grafana, e.g. when rendering panel image of alert.

# Default is 1. Using a higher value will produce more detailed images (higher DPI), but will require more disk space to store an image.

;rendering_viewport_device_scale_factor =

# Instruct headless browser instance whether to ignore HTTPS errors during navigation. Per default HTTPS errors are not ignored. Due to

# the security risk it's not recommended to ignore HTTPS errors.

#若有使用https的話，這個地方要改成true略過

rendering_ignore_https_errors = true

# Instruct headless browser instance whether to capture and log verbose information when rendering an image. Default is false and will

# See ICU’s metaZones.txt (https://cs.chromium.org/chromium/src/third_party/icu/source/data/misc/metaZones.txt) for a list of supported

# timezone IDs. Fallbacks to TZ environment variable if not set.

;rendering_timezone =

# Instruct headless browser instance to use a default language when not provided by Grafana, e.g. when rendering panel image of alert.

# Please refer to the HTTP header Accept-Language to understand how to format this value, e.g. 'fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5'.

;rendering_language =

# Instruct headless browser instance to use a default device scale factor when not provided by Grafana, e.g. when rendering panel image of alert.

# Default is 1. Using a higher value will produce more detailed images (higher DPI), but will require more disk space to store an image.

;rendering_viewport_device_scale_factor =

# Instruct headless browser instance whether to ignore HTTPS errors during navigation. Per default HTTPS errors are not ignored. Due to

# the security risk it's not recommended to ignore HTTPS errors.

#若有使用https的話，這個地方要改成true略過

rendering_ignore_https_errors = true

vi /etc/grafana/ldap.toml (調整ldap的認證環境參數)

依照需求設定對應的設定，可參考

設定完成後，重帶Grafana服務

service grafana-server stop

service grafana-server start

上面設定完成後便可以登入Grafana，此時已將登入網頁設定改成了https://IP:3000，開始先指定好要使用的Data Source，這裡為讀取ElasticFlow存在ELK的NetFlow資料
從Configuration >> add data source (選Elasticsearch格式)

選好後送出存檔測試讀取Data Source，若有出現Index OK. Time field name OK的訊息，代表已可讀入資料，剩下的就是照需要的條件，在Grafana裡面拉出自己需要的圖型分析介面

至於圖型分析的條件式要怎麼來跟應用，可以參考原本這組ElastiFlow軟體作業建立在Kibana面板裡面的語法設定，基本上只要熟悉ElasticSearch的API查詢語法與網路流量的單位換算，花點時間就可以把整個圖型分析給拉完了，成果如下圖

也可以建立查詢用的面板，Grafana面板客製化彈性很高，依照個人需求拉出要的格式即可

如果建立好圖型樣版的話，想備份的話，面板備份的目錄是存在下面的路徑

/var/lib/grafana

最後再寫支監控Grafana服務用的Script來監控服務即完成

[root@LAB-NetFlow ~]# vi grfana-process-monitor.sh

#!/bin/bash

smokeping_status=`ps aux | grep grafana-server | grep -v grep | wc -l `

if [ ${smokeping_status} = 0 ]; then

echo "Grafana-Services 服務異常，請檢查"

data='{

"username": "'${HOSTNAME}'",

"icon_url": "https://dyltqmyl993wv.cloudfront.net/assets/stacks/grafana-image-renderer/img/grafana-image-renderer-stack-220x234.png",

"attachments": [

{

"title": "Grafana服務狀態 : 狀態異常",

"color": "#ff0000",

"text": " 請檢查'${HOSTNAME}' Grafana Process狀態"

}

"channel": "#LAB-alert"

echo $data

curl -X POST -H "Content-type: application/json" --data "$data" https://hooks.slack.com/services/ZZAAXXZZ/CCCCGBBBGGGGGLF9ADGGDDDDDD

exit 2

else

echo "Grafana-Services 服務正常運作中"

exit 0

另外，先前說過只要Grafana的圖型完成後，便不需要Kibana了，所以可以將容器中的Kibana停用與移掉相關的ACL

停用單一容器服務(先找出對應的容器ID)
docker stop ed0a8690d562

移掉Kibana用的本機ACL

firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="192.168.88.0/24" port port="5601" protocol="tcp" accept"

firewall-cmd --reload

firewall-cmd --list-all --permanent

另外Grafana面板或是設定檔想要複製到別台機器上使用的話，下面為主要的目錄與Config位置

/var/lib/grafana/grafana.db

/etc/grafana/grafana.ini

/etc/grafana/ldap.toml

以上即完成整個ElastiFlow與Grafana的安裝與設定

監控Linux Process異常時發告警

2021-08-21T18:52:00.002+08:00

近期有個工作上的需求，需要監控Linux主機上的某個服務是否有異常，並且需要在異常時發出告警通知，所以寫了shell script來監控，下面的範例是監控Smokeping的Process是否還有在正常運作，並在異常時發出Slack的通知訊息

範例如下，存檔後放到排程每五分鐘監控一次即可

#!/bin/bash

smokeping_status=`ps aux | grep FPing | grep -v grep | wc -l `

if [ ${smokeping_status} = 0 ]; then

echo "Smokeping-Services 服務異常，請檢查"

data='{

"username": "'${HOSTNAME}'",

"icon_url": "https://www.iconninja.com/files/916/202/326/ping-icon.png",

"attachments": [

{

"title": "Smokeping服務狀態 : 狀態異常",

"color": "#ff0000",

"text": " 請檢查'${HOSTNAME}' Smokeping Process狀態"

}

"channel": "#alert-monitor"

echo $data

curl -X POST -H "Content-type: application/json" --data "$data" https://hooks.slack.com/services/A8CKZ8G2C/A6FJBJKTYM/GaFDyZpDc79U3LABX79a3e

exit 2

else

echo "Smokeping-Services 服務正常運作中"

exit 0

最後的監測結果如下

異常時發出Slack告警

正常時，文字顯示狀態正常

Cacti發送Slack告警訊息到不同頻道

2021-01-15T21:59:00.004+08:00

Cacti發送Slack告警訊息到不同頻道的方式，基本上也是寫程式去做正規化表示式的過濾與條件式的判斷，前置作業可以參考先前寫的Cacti整合Slack發送告警訊息，接著要把thold_functions.php第2847行裡面的 escapeshellarg($message)改成escapeshellarg($subject) ，先改好讓發送的訊息內容為郵件的標題，這樣比較方便程式去做正規化表示式的過濾與條件式的判斷。

接著編輯這個檔案
[root@Localhost ~]#vi /var/www/html/cacti/plugins/thold/slack.php
新版的程式內容如下，依照個人需求，改到自己需要發送的頻道即可。

程式如下

<?php

/*
以下程式字串條件式判斷式，是使用正規化表示式與模糊比對的方式設計的，依照Cacti告警標題設計好的比對順序發送到特定頻道
*/

//定義此區Cacti發送的圖示與帶入的發送名字

$username = "Cacti-TEST(網管系統)" ;

$icon_emoji = ":lion_face:" ;

//以下程式段落為針對資安設備IPS與WAF的字串過濾，並發送到專用的資安設備告警頻道(#test-security)

//此處的比對[**有分**大小寫]

if (preg_match("/(WAF)|(IPS)|(SMS)|(waf)|(ips)|(sms)/", $argv[1])) {

$data = array("username" => "$username","icon_emoji" => "$icon_emoji" ,"text" => "$argv[1]" ,"channel" => "#test-security");

$data_string = json_encode($data);

$url = "https://hooks.slack.com/services/RBCD0S7D/BHB4TGXQ/faBCfqYN5IkupUY3AKG";

$c = curl_init();

curl_setopt($c, CURLOPT_URL, $url);

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($c, CURLOPT_CUSTOMREQUEST, "POST");

curl_setopt($c, CURLOPT_POSTFIELDS, $data_string);

curl_setopt($c, CURLOPT_HTTPHEADER, array(

'Content-Type: application/json',

'Content-Length: ' . strlen($data_string))

);

echo curl_exec($c);

}

//以下程式段落針對線路有關的字串過濾，並發送到專用的線路告警頻道(#test-circuit)

//此處的比對[**不分**大小寫]

elseif (preg_match("/(海纜)|(流量)|(公網)|(對點IP)|(P2P)|(IPsec)|(avg)|(OSPF)|(專線)|(BGP)|(Loopback)|(線路)|(上網)/i", $argv[1])) {

$data = array("username" => "$username","icon_emoji" => "$icon_emoji" ,"text" => "$argv[1]" ,"channel" => "#test-circuit");

$data_string = json_encode($data);

$url = "https://hooks.slack.com/services/RBCD0S7D/BHB4TGXQ/faBCfqYN5IkupUY3AKG";

$c = curl_init();

curl_setopt($c, CURLOPT_URL, $url);

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($c, CURLOPT_CUSTOMREQUEST, "POST");

curl_setopt($c, CURLOPT_POSTFIELDS, $data_string);

curl_setopt($c, CURLOPT_HTTPHEADER, array(

'Content-Type: application/json',

'Content-Length: ' . strlen($data_string))

);

echo curl_exec($c);

}

//以下程式段落為如果上面字串都不符合的話，就發送到原本預設的頻道(#test-channel)

else{

$data = array("username" => "$username","icon_emoji" => "$icon_emoji" ,"text" => "$argv[1]" ,"channel" => "#test-channel");

$data_string = json_encode($data);

$url = "https://hooks.slack.com/services/RBCD0S7D/BHB4TGXQ/faBCfqYN5IkupUY3AKG";

$c = curl_init();

curl_setopt($c, CURLOPT_URL, $url);

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($c, CURLOPT_CUSTOMREQUEST, "POST");

curl_setopt($c, CURLOPT_POSTFIELDS, $data_string);

curl_setopt($c, CURLOPT_HTTPHEADER, array(

'Content-Type: application/json',

'Content-Length: ' . strlen($data_string))

);

echo curl_exec($c);

}

最後要測試程式的字串過濾是否正確的話，可以直接對程式帶入tholdhold送出來帶入的引數$argv[1] 來測試發送結果

[root@Localhost ~]# php /var/www/html/cacti/plugins/thold/slack.php "想要發送的文字"

符合預期的話，就代表正規化語法正確與程式的判斷式正確，可以拆開很多不同的頻道發告警，只要把想拆開的條件再用php的條件判斷語句再加入即可

Linux TCP 連線數優化Script

2020-04-27T23:05:00.000+08:00

Linux TCP 連線數優化Script如下

#!/bin/sh
#TCP Setting Tuning
sysctl -w net.core.rmem_max=33554432
sysctl -w net.core.wmem_max=33554432
sysctl -w net.ipv4.tcp_rmem='4096 87380 33554432'
sysctl -w net.ipv4.tcp_wmem='4096 65536 33554432'
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_mem='50576 64768 98152'
sysctl -w net.core.netdev_max_backlog=2500
sysctl -w net.netfilter.nf_conntrack_max=1048576
sysctl -p
if cat /etc/sysctl.conf | grep "net." ; then
echo "tcp tuning is exist"
else
echo "net.core.rmem_max = 33554432" >> /etc/sysctl.conf
echo "net.core.wmem_max = 33554432" >> /etc/sysctl.conf
echo "net.ipv4.tcp_rmem = 4096 87380 33554432" >> /etc/sysctl.conf
echo "net.ipv4.tcp_wmem = 4096 65536 33554432" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
echo "net.ipv4.tcp_mem = 50576 64768 98152" >> /etc/sysctl.conf
echo "net.core.netdev_max_backlog = 10000 " >> /etc/sysctl.conf
echo "net.core.somaxconn=10000 " >> /etc/sysctl.conf
echo "net.netfilter.nf_conntrack_max = 1048576" >> /etc/sysctl.conf
fi
#Maximum TCP Session
if cat /etc/security/limits.conf | grep "soft nproc" ; then
echo "tcp session setting is exist"
else
echo "* soft nproc 10000" >> /etc/security/limits.conf
echo "* hard nproc 10000" >> /etc/security/limits.conf
echo "* soft nofile 5000" >> /etc/security/limits.conf
echo "* hard nofile 5000" >> /etc/security/limits.conf
fi

BGP Looking Glass Server

2020-02-09T21:33:00.000+08:00

日常的工作需要Looking Glass 加快查修問題的速度，除了BGP網路外，還有一般的專線跟上網線路，都會需要類似BGP Looking Glass Server的功能，想把它整合成統一的Ping Server，目前使用了Open Source的BGP Looking Glass程式，再稍微修改一下程式後，就可以達到想要的功能，以下為在CentOS上面建置的方式

Step 1：先到https://github.com/Cougar/lg ，先照網站上面的介紹，捉取程式
yum install git
git config --global url."https://".insteadOf git://
git clone https://github.com/Cougar/lg.git

Step 2：安裝必要的環境程式
yum install wget perl-Net-Telnet perl-Net-Telnet-Cisco perl-XML-Parser httpd
yum install gcc* perl-CPAN
yum install perl*
yum install mtr
yum install perl-DB_File
安裝perl的外掛，要用cpanm 安裝，後面CGI程式會到用，沒安裝會無法執行主程式，會一直跳Perl執行錯的error log
cpanm Net::SSH::Perl
cpanm Net::Telnet::Perl

Step 3：將git捉下來的程式放到WEB執行的目錄，並設定好對應的Apache的權限
mkdir /var/www/html/lg
cd /var/www/html/lg
cp /root/lg-1.9/lg.cgi .
cp /root/lg-1.9/favicon.ico .
cp /root/lg-1.9/lg.conf .

Step 4：確保/var/www/html/lg可讀，並且lg.cgi這支程式可以執行
chmod 644 *
chmod 755 lg.cgi
另外修改一下/var/www/html/lg/lg.cgi這支程式的第26行，原作者這個地方少了my 兩個字，導致未來執行lg.cgi會有錯，先修正如下
my $configfile = "lg.conf";

Step 5：調整Apache設定
vi /etc/httpd/conf/httpd.conf
加入以下設定
Alias /lg/favicon.ico "/var/www/html/lg/favicon.ico"
ScriptAlias /lg "/var/www/html/lg/lg.cgi"

AllowOverride None
AddHandler fcgid-script cgi-script .fcgi .cgi
Options +ExecCGI
AddHandler cgi-script .cgi
DirectoryIndex lg.cgi

Step 6：依照實際需求調整Looking Glass設定檔，加入需要的Router IP登入資訊
vi /var/www/html/lg/lg.conf
建議另外開一個專用的ssh帳號，並限制好可以輸入的指令權限，以免有資安上的疑慮
以下為Junos的限制方式
set system login class looking-glass permissions view-configuration
set system login class looking-glass allow-commands "(show)|(ping)|(traceroute)"
set system login class looking-glass deny-commands "(clear)|(file)|(file show)|(help)|(load)|(monitor)|(op)|(request)|(save)|(set)|(start)|(test)"

set system login user Test uid 2000
set system login user Test class looking-glass
set system login user Test authentication encrypted-password "$XfnbAZ60Iq8375TmTU0"

Step 7：原本cgi程式裡面的內容是給JunOS、Zebra、Cisco IOS的Router使用，為了要把Linux主機的MTR的traceroute與ping整合進去Looking Glass，需要稍微修改一下原本的CGI 程式裡面的zebra的指令，改成給不同台的Linux主機使用，並加入Junos可以用loopback IP做Ping與Traceroute的來源IP

"zebra" => {
"ipv4" => {
"bgp" => "show ip bgp %s",
"advertised-routes" => "show ip bgp neighbors %s advertised-routes",
"summary" => "show ip bgp summary",
"ping" => "ping %s -c 15 -w 1000",
"trace" => "mtr %s --report -c 5 --report-wide --no-dns"
},
"ipv6" => {
"bgp" => "show bgp ipv6 %s",
"advertised-routes" => "show bgp ipv6 neighbors %s advertised-routes",
"summary" => "show bgp ipv6 summary",
"ping" => "ping ipv6 %s",
"trace" => "traceroute ipv6 %s"
}
},

"junos" => {
"ipv4" => {
"trace" => "traceroute %s as-number-lookup interface lo0 inet"
},
"ipv6" => {
"trace" => "traceroute %s interface lo0 inet"
},
"ipv46" => {
"bgp" => "show bgp %s",
"advertised-routes" => "show route advertising-protocol bgp %s ",
"summary" => "show bgp summary",
"ping" => "ping %s interface lo0 inet count 50 rapid"
}
}

並且調整把三個地方的my $remotecmd = "$command; quit";
改成my $remotecmd = "$command; exit";
另外再把MTR與Traceroute的權限打開給受限制的低權限的ssh帳號
setcap cap_net_raw=pe /bin/traceroute
setcap cap_net_raw=pe /usr/sbin/mtr
ln -s /usr/sbin/mtr /usr/local/bin/mtr
chmod o+s /usr/sbin/mtr

Step 8：最後調整一下lg.conf裡面的一些網頁顯示的方式與圖片與Log位置
vi /var/www//html/lg/lg.conf
mkdir /var/www/html/images
cp logo.png /var/www/html/images/logo.png

指定好程式的log目錄

touch /var/log/lg.log

chown apache:apache /var/log/lg.log

Step 9：打開網頁測試 http://IP/lg.cgi

後記：實際建置時遇到不少的perl問題，可以到APACHE的error log裡面去找出異常的CGI執行行數的error log，然後再安裝對應的perl 套件
cat /var/log/httpd/error_log
cat /var/log/lg.log

Smokeping整合Slack發送告警訊息

2019-11-09T11:34:00.000+08:00

Smokeping工具，安裝的方式可參考官網，目前實作用Slack發出告警訊息
依照個人安裝的目錄，調整相關的設定檔路徑即可
vi /usr/local/smokeping/etc/slack_notify.sh
#!/bin/bash
function send_alert {
# Send a SmokePing status alert to the slack channel

alertname="$1"
target="$2"
losspattern="$3"
rtt="$4"
hostname="$5"

case "${alertname}" in
someloss)
#not ideal but will continue
color="good"
;;
highloss)
#we will live
color="warning"
;;
majorloss)
#this is real bad.
color="danger"
;;
*)
echo "Unsupported loss alert name"
esac

losspattern=$(echo $losspattern | rev | cut -d',' -f 1 | rev)

echo "Sending Slack alert, Alert: $alertname, Target: $target, Loss Pattern: $losspattern, RTT: $rtt, Hostname: $hostname" >> /tmp/smokeping.log

data='{
"username": "MYLAB-Smokeping",
"icon_url": "https://a.slack-edge.com/production-standard-emoji-assets/10.2/google-large/1f383@2x.png",
"attachments": [
{
"title": "Alert type : '${alertname}'",
"color": "'${color}'"
},
{
"text": " ",
"fields": [
{
"title": "Packet Source",
"value": "'${HOSTNAME}'",
"short": "true"
},
{
"title": "Packet Destination",
"value": "'${target}'('${hostname}')",
"short": "true"
},
{
"title": "Packet Loss (%)",
"value": "'${losspattern}'",
"short": "true"
},
{
"title": "Graph",
"value": "http://192.88.34.54/smokeping?target='${target}'",
"short": "true"
}
]
}
],
"channel": "#mytest-channel"
}'

echo $data
curl -X POST -H "Content-type: application/json" --data "$data" https://hooks.slack.com/services/T9DKZ0S4Q/A1EJ51GEB/x1d4B7uGhbpZn7L7KAbiN5sV

}

send_alert "$1" "$2" "$3" "$4" "$5"

exit 0

存檔後離開，並將檔案改成可執行檔
chmod +x /usr/local/smokeping/etc/slack_notify.sh
調整Smokeping的設定檔的告警值
vi /usr/local/smokeping/etc/config
*** General ***
owner =LAB-TEST
contact = LAB-TEST@LAB-TEST.com
mailhost = my.mail.host
sendmail = /usr/sbin/sendmail
# NOTE: do not put the Image Cache below cgi-bin
# since all files under cgi-bin will be executed ... this is not
# good for images.
imgcache = /usr/local/smokeping/cache
imgurl = cache
datadir = /usr/local/smokeping/data
piddir = /usr/local/smokeping/var
cgiurl = http://192.88.34.54/smokeping.cgi
smokemail = /usr/local/smokeping/etc/smokemail.dist
tmail = /usr/local/smokeping/etc/tmail.dist
# specify this to get syslog logging
syslogfacility = local0
# each probe is now run in its own process
# disable this to revert to the old behaviour
# concurrentprobes = no

*** Alerts ***
#不用Email發送，而是在原本的信箱後面，加上 | 後調用Script執行檔案

to = |/usr/local/smokeping/etc/slack_notify.sh
from = LAB-TEST@LAB-TEST.com

+rttdetect
type = rtt
# in milliseconds
pattern = >2100,>2100,>2100
comment = There is a serious connectivity issue with this node

+someloss
type = loss
# in percent
pattern = >0%<=25%,*12*,>0%<=25%,*12*,>0%<=25%
comment = loss 3 times in a row

+highloss
type = loss
# in percent
pattern = >25%<=50%,*12*,>25%<=50%,*12*,>25%<=50%
comment = loss 3 times in a row

+majorloss
type = loss
pattern = >50%
edgetrigger = yes
comment = host down

*** Database ***

step = 60
pings = 20

# consfn mrhb steps total

AVERAGE 0.5 1 1008
AVERAGE 0.5 12 4320
MIN 0.5 12 4320
MAX 0.5 12 4320
AVERAGE 0.5 144 720
MAX 0.5 144 720
MIN 0.5 144 720

*** Presentation ***
charset = utf-8
template = /usr/local/smokeping/etc/basepage.html.dist

+ charts

menu = Charts
title = The most interesting destinations

++ stddev
sorter = StdDev(entries=>4)
title = Top Standard Deviation
menu = Std Deviation
format = Standard Deviation %f

++ max
sorter = Max(entries=>5)
title = Top Max Roundtrip Time
menu = by Max
format = Max Roundtrip Time %f seconds

++ loss
sorter = Loss(entries=>5)
title = Top Packet Loss
menu = Loss
format = Packets Lost %f

++ median
sorter = Median(entries=>5)
title = Top Median Roundtrip Time
menu = by Median
format = Median RTT %f seconds

+ overview

width = 600
height = 50
range = 10h

+ detail

width = 600
height = 200
unison_tolerance = 2

"Last 3 Hours" 3h
"Last 30 Hours" 30h
"Last 10 Days" 10d
"Last 400 Days" 400d

#+ hierarchies
#++ owner
#title = Host Owner
#++ location
#title = Location

*** Probes ***

+ FPing

binary = /usr/local/sbin/fping

+ DNS

binary = /usr/bin/dig # mandatory

+ Curl
# probe-specific variables
binary = /usr/bin/curl
forks = 5
offset = 50%
step = 60

*** Slaves ***
secrets=/usr/local/smokeping/etc/smokeping_secrets.dist
+boomer
display_name=boomer
color=0000ff

+slave2
display_name=another
color=00ff00

*** Targets ***

probe = FPing

menu = Top
title = Network Latency Grapher
remark = Welcome to the SmokePing website of TEST-LAB Company. \
Here you will learn all about the latency of our network.

+ Local_GW
menu = Local_GW
title = Local_GW
host = 192.88.34.254
alerts = someloss,highloss,majorloss

+TEST-Monitor-01
menu = TEST-Monitor-01
title = TEST-Monitor-01

++Ping_TEST-IP-1
title = 168.95.1.1
host = 168.95.1.1
alerts = someloss,highloss,majorloss

++Ping_TEST-IP-2
title = 8.8.8.8
host = 8.8.8.8

alerts = someloss,highloss,majorloss

存檔後離開，當有發生someloss,highloss,majorloss等級的掉包率時，便可發出Slack告警到指定的#channel裡面

Juniper 高階SRX Cluster Login Other RE方式

2019-10-05T00:12:00.000+08:00

適用於高階SRX 的型號如3000系列或是5000系列

{primary:node0}
user@SRX01-LAB-DC> start shell 
% rlogin -Jk -T node1
 
--- JUNOS 15.1X49-D170.4 built 2019-02-22 23:02:01 UTC
{secondary:node1}
user@SRX02-LAB-DC>

適用於一般低階SRX 的型號(通用指令)

{primary:node0}
user@SRX01-LAB-DC> request routing-engine login node 1          
 
--- JUNOS 15.1X49-D170.4 built 2019-02-22 23:02:01 UTC
{secondary:node1}
user@SRX02-LAB-DC>

Cisco 3850X IP SLA send syslog config

2019-08-03T14:15:00.000+08:00

ip sla 1
icmp-echo 192.168.99.205
threshold 500
timeout 500
frequency 1

ip sla 2
icmp-echo 192.168.99.201
threshold 500
timeout 500
frequency 1

ip sla 3
icmp-echo 192.168.99.197
threshold 500
timeout 500
frequency 1

ip sla 4
icmp-echo 192.168.99.193
threshold 500
timeout 500
frequency 1

ip sla 5
icmp-echo 192.168.99.189
threshold 500
timeout 500
frequency 1

ip sla reaction-configuration 1 react timeout threshold-type immediate
ip sla reaction-configuration 2 react timeout threshold-type immediate
ip sla reaction-configuration 3 react timeout threshold-type immediate
ip sla reaction-configuration 4 react timeout threshold-type immediate
ip sla reaction-configuration 5 react timeout threshold-type immediate
ip sla logging traps
ip sla enable reaction-alerts

track 1 ip sla 1 reachability
track 2 ip sla 2 reachability
track 3 ip sla 3 reachability
track 4 ip sla 4 reachability
track 5 ip sla 5 reachability

ip sla schedule 1 life forever start-time now
ip sla schedule 2 life forever start-time now
ip sla schedule 3 life forever start-time now
ip sla schedule 4 life forever start-time now
ip sla schedule 5 life forever start-time now

Juniper OSPF traceoptions

2019-07-21T18:09:00.001+08:00

set protocols ospf traceoptions file ospf.log
set protocols ospf traceoptions flag database-description
set protocols ospf traceoptions flag event
set protocols ospf traceoptions flag error
set protocols ospf traceoptions flag lsa-request

其它OSPF狀態檢查
show log ospf.log

show ospf database

show ospf interface

show ospf route

show route protocol ospf

show ospf statistics

Juniper SRX Monitor Traffic

2019-06-27T21:36:00.002+08:00

Host:
root# run monitor traffic interface ge-0/0/x matching "host 10.130.38.94" no-resolve

Protocol:
root# run monitor traffic interface ge-0/0/x matching arp

Port:
root# run monitor traffic interface ge-0/0/x matching "port 22"

IP address:
root# run monitor traffic interface ge-0/0/x matching "host 10.130.38.94" no-resolve detail

A network:
root# run monitor traffic interface ge-0/0/x matching "net 225.1.1.0/24" no-resolve detail

TCP port 179:
root# run monitor traffic interface ge-0/0/x matching "tcp port 179"

UDP port 646:
root# run monitor traffic interface ge-0/0/x matching "udp port 646"

Increase the size of capture:
root# run monitor traffic interface ge-0/0/x matching arp size 1500

Save the capture to a file:
root# run monitor traffic interface ge-0/0/x matching arp write-file capture.pcap <<<<< write-file is a hidden command so type it out

Matching "not tcp port 3128” and matching tcp port 23
root# run monitor traffic interface ge-0/0/x matching "not tcp port 3128 and tcp port 23"

Matching BDPUs
monitor traffic interface ge-0/0/1 no-resolve size 1500 layer2-headers matching "ether dst 01:80:c2:00:00:00"

A more complicated combination but might be useful in some cases:
root# run monitor traffic interface ge-0/0/x matching "arp or (icmp and host 3.3.3.2)"

股票配息

2018-06-12T21:55:00.001+08:00

中華電信(2412) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	4.80	0.00	0.00	0.00	4.80

中鋼(2002) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	0.88	0.00	0.00	0.00	0.88

裕民(2606) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	1.20	0.00	0.00	0.00	1.20

長興(1717) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	0.50	0.70	0.00	0.70	1.20

遠東新(1402) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	1.20	0.00	0.00	0.00	1.20

亞泥(1102) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	1.20	0.00	0.00	0.00	1.20

台灣大(3045) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	5.60	0.00	0.00	0.00	5.60

合庫金(5880) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	0.75	0.30	0.00	0.30	1.05

第一金(2892) 股利政策

年　度	現金股利	盈餘配股	公積配股	股票股利	合　計
106	0.90	0.10	0.00	0.10	1.00

Linux ICMP 監控Script

2018-05-05T11:11:00.002+08:00

每秒發送1個ICMP封包，加上時間標記並記錄下來
[root@Localhost ~]# vi ping_check.sh
#!/bin/bash

DATE=$(date +"%d.%m.%Y %T")
SHORT_DATE=$(date +"%d.%m.%Y")

echo
echo "Pinging host " $@
echo

HOST=$@

ping $HOST | while read PONG
do
grep -q ttl <<< "$PONG"

if [ $? -eq 0 ]; then

echo "`date`: $PONG"
echo "`date`: $PONG" &>> ping_check_$SHORT_DATE.log

else

echo "`date`: ping failed, $HOST host is DOWN!" &>> ping_check_$SHORT_DATE.log
echo "$PONG" &>> ping_check_$SHORT_DATE.log
fi
done

[root@Localhost ~]#chmod +x ping_check.sh
[root@Localhost ~]#sh ping_check.sh google.com
執行後的Log格式顯示如下

若系統帳號登出後，要再背景執行的話，要再加上nohup指令執行即可
[root@Localhost ~]#nohup sh ping_check.sh google.com &

Cisco 2960X NetFlow設定

2018-03-16T21:56:00.002+08:00

flow record NETFLOW-RECORD
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect transport tcp flags
collect interface input
collect counter bytes long
collect counter packets long
collect counter bytes permanent
collect counter packets permanent
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
flow exporter NETFLOW-EXPORTER
destination 192.168.88.100
source Vlan300
transport udp 9996
!
flow monitor NETFLOW-MONITOR
exporter NETFLOW-EXPORTER
cache timeout active 60
record NETFLOW-RECORD
!
sampler NETFLOW-FLOWSAMPLER
mode random 1 out-of 500
!
interface GigabitEthernet1/0/1
ip flow monitor NETFLOW-MONITOR sampler NETFLOW-FLOWSAMPLER input

參考連結
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/fnf/configuration_guide/b_fnf_1522e_2960x_cg/b_fnf_32se_3850_cg_chapter_010.html

Splunk整合Slack發送即時警示訊息

2018-03-08T22:04:00.001+08:00

Splunk也可以跟Slack整合即時發送告警訊息，設定方式如下

Step1：先到下方Splunk網頁去捉取Slack Notification Alert應用套件安裝
https://splunkbase.splunk.com/app/2878/

Step2：安裝完成後，在應用套件-->Slack Alerts-->設定，將申請好的Slack API Webhook網址貼上去，並存檔，申請API的方式可參考上篇文章連結

Step3：在Splunk頁面-->警示-->設定即時警示動作，選擇觸發動作為Slack
照需求選好要發送的頻道，訊息內容的地方，可以個人需求填入，也可以將警示的結果用Splunk定義好的變數參數代入，變數代表的內容可以Splunk網站的這個連結
我使用的變數如下
$server.serverName$:bangbang:$name$:$result._raw$

Step 4：產生一筆告警，讓Splunk透由Slack API發送推播訊息到手機裡，效果如下

Cacti整合Slack發送告警訊息

2018-02-28T17:20:00.000+08:00

Slack目前支援使用API或是Webhook的方式來發送訊息到指定的Channel中，Cacti只要稍為調整一下tholdhold的程式後，便可以經由Slack來發送告警訊息並且推播到手機中。下面介紹如何透過Slack Webhook的方式來傳送告警訊息。

一、申請好Slack的帳號，在Slack的網站裡面點選進入APP&Custom Integrations ->Build->Make a Custom Integration 新增 Incoming WebHooks，新增想要送的channels，申請完可以取得Webhook URL

二、先在Cacti裡面用Curl指令測試上面產生的Webhook URL來發送訊息到#random頻道做測試
curl -X POST --data-urlencode 'payload={"channel": "#random", "username": "Cacti-Slack-LAB", "text": "This is posted to #alert and comes from a bot named webhookbot.", "icon_emoji": ":bear:"}' https://hooks.slack.com/services/A3DBDQ74Z/A9C2K15GD/cf23G7uCET2Y2FLK9ABiY52X
發送成功的話，在#random頻道裡會收到相關通知訊息

三、Slack是用json的格式來發訊，需要先在Cacti裝一下php-pecl-json
[root@Localhost ~]#yum install -y php-pecl-json
裝完要restart httpd服務

四、在Cacti的tholdhold安裝目錄下建立一支php程式名叫slack.php
[root@Localhost ~]#vi /var/www/html/cacti/plugins/thold/slack.php
PHP程式內容如下，下面紅色的地方可自訂發訊人的名稱與圖示
$data = array("username" => "Cacti-Slack-LAB","icon_emoji" => ":cactus:" ,"text" => "$argv[1]");
$data_string = json_encode($data);
$url = "https://hooks.slack.com/services/A3DBDQ74Z/A9C2K15GD/cf23G7uCET2Y2FLK9ABiY52X";
$c = curl_init();
curl_setopt($c, CURLOPT_URL, $url);
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($c, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($c, CURLOPT_POSTFIELDS, $data_string);
curl_setopt($c, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($data_string))
);
echo curl_exec($c);

五、接著調整修改thold_functions.php這隻程式，找到大約在2836行的附近找到
function thold_mail($to, $from, $subject, $message, $filename, $headers = '')
然後移動到function 的最尾端可以看到return ''; 接著在return '';前加入
$sms = shell_exec('php /usr/share/cacti/plugins/thold/slack.php ' .escapeshellarg($message).'');

六、接著在Cacti裡產生相關的up/down或是tholdhold告警測試，Slack通知結果如下
Web通知效果

手機APP通知效果

七、若要讓手機收到即時推播訊息的話，需要在Channel頻道與手機APP上面做以下設定

Automaticall disable notifycation from那邊不要去打勾，不然特定時間會收不到

選All new messages 跟Notify Me on Mobile As quicky as possible

調整完以上設定之後，便可以即時收到tholdhold傳到Slack的通知，即便發信的SMTP的主機異常，或是公司的Mail Server有問題時，都不影響告警的發送。

最後用下面這張圖來代表工程師的無奈與心酸XDD~~

Cisco NX-OS CLI - Part2

2018-02-02T16:58:00.001+08:00

Cisco IOS CLI	Cisco NX-OS CLI
Configuring a Routed Interface

interface gigabitethernet 1/1 ip address 192.168.1.1 255.255.255.0 no shutdown	interface ethernet 1/1 ip address 192.168.1.1/24 no shutdown

Configuring a Switched Interface (VLAN 10)

vlan 10 interface gigabitethernet 1/1 switchport switchport mode access switchport access vlan 10 no shutdown	vlan 10 interface ethernet 1/1 switchport switchport mode access switchport access vlan 10 no shutdown

Configuring a Switched Virtual Interface (SVI)

Cisco IOS Software does not have the ability to enable or disable SVI interfaces using the feature command. interface vlan 10 ip address 192.168.1.1 255.255.255.0 no shutdown	feature interface-vlan interface vlan 10 ip address 192.168.1.1./24 no shutdown

Configuring a Switched Trunk Interface

interface GigabitEthernet 1/1 switchport switchport trunk encapsulation dot1q switchport trunk native vlan 2 switchport trunk allowed vlan 10,20 switchport mode trunk no shutdown	interface ethernet 1/1 switchport mode trunk switchport trunk allowed vlan 10,20 switchport trunk native vlan 2 no shutdown

Configuring a Routed Trunk Sub-Interface

interface gigabitethernet 1/1 no switchport no shutdown interface gigabitethernet1/1.10 encapsulation dot1Q 10 ip address 192.168.1.1 255.255.255.0 no shutdown	interface ethernet 1/1 no switchport no shutdown interface ethernet 1/1.10 encapsulation dot1q 10 ip address 192.168.1.1/24 no shutdown
Configuring a Loopback Interface

interface loopback 1 ip address 192.168.1.1 255.255.255.255 no shutdown	interface loopback 1 ip address 192.168.1.1/32 no shutdown

Configuring a Tunnel Interface

Cisco IOS Software does not have the ability to enable or disable Tunnel interfaces using the feature command. interface Tunnel 1 ip address 192.168.1.1 255.255.255.0 tunnel source 172.16.1.1 tunnel destination 172.16.2.1 no shutdown	feature tunnel interface tunnel 1 ip address 192.168.1.1/24 tunnel source 172.16.1.1 tunnel destination 172.16.2.1 no shutdown

interface gigabitethernet 1/1 description Test Interface	interface ethernet 1/1 description Test Interface
Configuring an Interface Description

interface gigabitethernet 1/1 mtu 9216	interface ethernet 1/1 mtu 9216
Configuring Jumbo Frames

interface range gigabitethernet 1/1-2 or interface range gigabitethernet 1/1, gigabitethernet 2/1	interface ethernet 1/1-2 or interface ethernet 1/1, ethernet 2/1
Configuring Multiple Interfaces (Examples)

Cisco IOS Software does not have the ability to configure port profiles.	port-profile type ethernet Email-Template switchport switchport access vlan 10 spanning-tree port type edge no shutdown description Email Server Port state enabled interface ethernet 2/1-48 inherit port-profile Email-Template
Configuring Port Profiles

test cable-diagnostics tdr interface gigabitethernet 1/1	test cable-diagnostics tdr interface etherent 1/1
TDR Cable Diagnostics

Cisco IOS Software does not have the ability to enable a located-led per interface.	interface ethernet 1/1 beacon
Configuring the Interface Locator-LED (Beacon)

Cisco IOS Software does not have the ability to connect a Nexus 2000(FEX).	interface ethernet 101/1/1
Configuring a Nexus 2000(FEX) Host Interface

Verification Command Comparison

The following table lists some useful show commands for verifying the status and troubleshooting an interface.

Cisco NX-OS Interface	Cisco IOS Software Interface	Command Description
show interface	show interface	Displays the status and statistics for all interfaces or a specific interface
show interface ethernet	-	Displays the status and statistics for a FEX host interface
show interface ethernet cable-diagnostics tdr	show cable-diagnostics tdr interface type	Displays TDR test results
show interface brief	-	Displays a brief list of the interfaces (type, mode, status, speed, MTU)
show interface capabilities	show interface capabilities	Displays interface capabilities
show interface counters	show interface counters	Displays interface counters (input/output unicast, multicast & broadcast)
show interface debounce	show interface debounce	Displays the de-bounce status and time in ms for all interfaces
show interface description	show interface description	Displays all interfaces with configured descriptions
show interface ethernet	show interface ethernet	Displays status and statistics for a specific interface
show interface fex-fabric	-	Displays FEX fabric interface status
show interface flowcontrol	show interface flowcontrol	Displays Flow Control (802.1p) status and state for all interfaces
show interface loopback	show interface loopback	Displays status and statistics for a specific loopback interface
show interface mac-address	-	Displays all interfaces and their associated MAC Addresses
show interface mgmt	-	Displays status and statistics for the management interface located on the supervisor
show interface port-channel	show interface port-channel	Displays status and statistics for a specific port-channel
show interface priority-flow-control	-	Displays PFC information
show interface pruning	show interface pruning	Displays trunk interfaces VTP pruning information
show interface snmp-ifindex	-	Displays SNMP interface index
show interface status	show interface status	Displays all interfaces and their current status
show interface switchport	show interface switchport	Displays a list of all interfaces that are configured as switchports
show interface transceiver	show interface transceiver	Displays a list of all interfaces and optic information (calibrations, details)
show interface trunk	show interface trunk	Displays a list of all interfaces configured as trunks
show interface tunnel <#>	show interface tunnel <#>	Displays status and statistics for a specific tunnel interface
show interface vlan <#>	show interface vlan <#>	Displays status and statistics for a specific VLAN interface
-	-	-
show port-profile	-	Displays all port profile information
show port-profile brief	-	Displays brief port profile information
show port-profile expand-interface	-	Displays active profile configuration applied to an interface
show port-profile name	-	Displays specific port profile
show port-profile sync-status	-	Displays interfaces out of sync with port profiles
show port-profile usage	-	Displays interfaces inherited to a port profile

Cisco NX-OS CLI - Part1

2018-02-02T16:55:00.001+08:00

Cisco IOS CLI	Cisco NX-OS CLI
Default User Prompt

c6500>	n7000#

Entering Configuration Mode

c6500# configure terminal	n7000# configure terminal

Saving the Running Config to the Startup Config (nvram)

c6500# write memory or c6500# copy running-config startup-config	n7000# copy running-config startup-config

Erasing the startup config (nvram)

c6500# write erase	n7000# write erase

Installing a License

Cisco IOS Software does not require a license file installation.	n7000# install license bootflash:license_file.lic

Interface Naming Convention

interface Ethernet 1/1 interface FastEthernet 1/1 interface GigabitEthernet 1/1 interface TenGigabitEthernet 1/1	interface Ethernet 1/1

Default VRF Configuration (management)

Cisco IOS Software doesn’t enable VRFs by default.	vrf context management

Configuring the Software Image Boot Variables

boot system flash sup-bootdisk:s72033-ipservicesk9_wan-mz.122-33.SXH1.bin	boot kickstart bootflash:/n7000-s1-kickstart.4.0.4.bin sup-1 boot system bootflash:/n7000-s1-dk9.4.0.4.bin sup-1 boot kickstart bootflash:/n7000-s1-kickstart.4.0.4.bin sup-2 boot system bootflash:/n7000-s1-dk9.4.0.4.bin sup-2

Enabling Features

Cisco IOS Software does not have the functionality to enable or disable features.	feature ospf

Enabling TELNET (SSHv2 is recommended)

Cisco IOS Software enables TELNET by default.	feature telnet
Configuring the Console Timeout

line console 0 exec-timeout 15 0 login	line console exec-timeout 15
Configuring the VTY Timeout and Session Limit

line vty 0 9 session-limit 10 exec-timeout 15 0 login	line vty session-limit 10 exec-timeout 15

Verification Command Comparison

The following table compares some useful show commands for verifying the initial system startup and running configuration.

Cisco NX-OS	Cisco IOS Software	Command Description
show running-config	show running-config	Displays the running configuration
show startup-config	show startup-config	Displays the startup configuration
-	-	-
show interface	show interface	Displays the status for all of the interfaces
show interface ethernet	show interface <int type>	Displays the status for a specific interface
show interface mgmt 0	-	Displays the status for the mgmt interface
-	-	-
show boot	show boot	Displays the current boot variables
-	-	-
show clock	show clock	Displays the system clock and time zone configuration
show clock detail	show clock detail	Displays the summer-time configuration
-	-	-
show environment	show environment	Displays all environment parameters
show environment clock	show environment status clock	Displays clock status for A/B and active clock
show environment fan	show environment cooling fan-tray	Displays fan status
show environment power	show power	Displays power budget
show environment temperature	show environment temperature	Displays environment data
-	-	-
show feature	-	Displays the features and routing processes enabled
-	-	-
show log logfile	show log	Displays the local log
show log nvram	-	Displays persistent log messages (severity 0-2) stored in NVRAM
show module	show module	Displays installed modules and their status
show module uptime	-	Displays how long each module has be powered up
show module fabric	-	Displays fabric modules and their current status
show platform fabric-utilization	show fabric utilization	Displays the % of fabric utilized per module
show process cpu	show process cpu	Displays the processes running on the CPU
show process cpu history	show process cpu history	Displays the process history of the CPU in chart form
show process cpu sorted	show process cpu sorted	Displays sorted processes running on the CPU
-	-	-
show system cores	-	Displays the core dump files if present
show system exception-info	show exception	Displays last exception log
show system redundancy status	show redundancy	Displays the supervisors High Availability status
show system resources	show process cpu	Displays CPU and memory usage data
show system uptime	-	Displays system and kernel start time (Displays active supervisor uptime)
-	-	-
show tech-support	show tech-support	Displays system technical information for Cisco TAC
show tech-support	show tech-support	Displays feature specific technical information for Cisco TAC
-	-	-
show version	show version	Displays running software version, basic hardware, CMP status and system uptime
-	-	-
show line	show line	Displays console and auxiliary port information
show line com1	-	Displays auxiliary port information
show line console	show line console 0	Displays console port information
show line console connected	-	States if the console port is physically connected
show terminal	show terminal	Displays terminal settings
show users	show users	Displays current virtual terminal settings
-	-	-
show vrf	show ip vrf	Displays a list of all configured VRFs
show vrf	show ip vrf	Displays an specified VRF
show vrf detail	show vrf detail	Displays details for a specified
show vrf interface	-	Displays interface assignment for a specified VRF
show vrf default	-	Displays a summary of the default VRF
show vrf detail	show vrf detail	Displays details for all VRF's
show vrf interface	show ip vrf interface	Displays VRF interface assignment
show vrf management	-	Displays a summary of the management VRF
-	-	-
show license	-	Displays all license file information
show license brief	-	Displays the license file names installed
show license file	-	Displays license contents based on a specified name
show license host-id	-	Displays the chassis Host-ID used for creating a license
show license usage	-	Displays all licenses used by the system
show license usage	-	Displays all licenses used by the system per type
show license usage vdc-all	-	Displays all licenses used by the system for all VDCs
-	-	-
show vdc	-	Displays a list of the configured VDC's
show vdc	-	Displays a summary of the individual VDC
show vdc detail	-	Displays configuration details for a specific VDC
show vdc membership	-	Displays interface membership for a specific VDC
show vdc resource	-	Displays resource allocation for a specific VDC
show vdc current-vdc	-	Displays the VDC that the user is currently in
show vdc detail	-	Displays details information for all VDCs
show vdc membership	-	Displays interface membership for all VDCs
show vdc resources	-	Displays resource allocation for all VDCs

Splunk即時告警失效問題

2018-01-01T23:50:00.000+08:00

Splunk近期加了不少的即時告警通知的功能，結果在使用上發現會有的部分告警沒辦法正常發送即時通知Email，一開始不以為意，以為是SMTP發信的問題，但後來仔細檢查後，才知道是Splunk為了系統的search效能，所以有做一些預設的限制，而剛好即時告警又是Splunk功能裡很吃效能的一個功能，如果是預設四核心CPU的Splunk主機的話，預設只能同時使用5組的Realtime Alert，這也就是為什麼有時候，有的即時告警正常，有時又異常的原因，要加大可以使用即時告警的數量的話，可修改Splunk安裝目錄下的config檔的參數
C:\Program Files\Splunk\etc\system\default\limits.conf
修改後要記得要重新Restart Splunk services

預設值如下，可用即時告警計算出來，以4 core CPU的話，是只能使用5組
############################################################################
# Concurrency
############################################################################
# This section contains settings for search concurrency limits.
# The total number of concurrent searches is
# base_max_searches + #cpus*max_searches_per_cpu

# The base number of concurrent searches.
base_max_searches = 6

# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 1

# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 1

調整如下後可放大到18組
############################################################################
# Concurrency
############################################################################
# This section contains settings for search concurrency limits.
# The total number of concurrent searches is
# base_max_searches + #cpus*max_searches_per_cpu

# The base number of concurrent searches.
base_max_searches = 10

# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 2

# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 2

Juniper BGP 調整特定國家路由優先權

2017-11-19T22:46:00.001+08:00

針對國別調整BGP優先權
一、先用https://ipinfo.io/countries/cn 找出要調整的國家的全部AS Number，將這些AS Number做利用正規化表示法設定成一組國別清單

set policy-options as-path China-AS-Path ".* 4134 |.* 4538 |.* 4611 |.* 4808 |.* 4809 |.* 4812 |.* 4813 |.* 4815 |.* 4816 |.* 4835 |.* 4837 |.* 4847 |.* 4859 |.* 7497 |.* 7549 |.* 7638 |.* 7640 |.* 7641 |.* 9298 |.* 9306 |.* 9308 |.* 9389 |.* 9391 |.* 9394 |.* 9395 |.* 9401 |.* 9535 |.* 9801 |.* 9802 |.* 9803 |.* 9805 |.* 9807 |.* 9808 |.* 9809 |.* 9810 |.* 9811 |.* 9812 |.* 9814 |.* 9929 |.* 9939 |.* 10206 |.* 10212 |.* 17428 |.* 17429 |.* 17430 |.* 17431 |.* 17490 |.* 17621 |.* 17622 |.* 17623 |.* 17633 |.* 17638 |.* 17739 |.* 17775 |.* 17781 |.* 17785 |.* 17799 |.* 17816 |.* 17883 |.* 17897 |.* 17962 |.* 17964 |.* 17966 |.* 17968 |.* 17969 |.* 18011 |.* 18118 |.* 18239 |.* 18241 |.* 18242 |.* 18243 |.* 18244 |.* 18245 |.* 18257 |.* 18344 |.* 23650 |.* 23724 |.* 23771 |.* 23839 |.* 23840 |.* 23841 |.* 23842 |.* 23844 |.* 23848 |.* 23851 |.* 23853 |.* 23910 |.* 23911 |.* 24059 |.* 24133 |.* 24134 |.* 24137 |.* 24138 |.* 24139 |.* 24141 |.* 24143 |.* 24147 |.* 24151 |.* 24311 |.* 24400 |.* 24404 |.* 24406 |.* 24409 |.* 24413 |.* 24414 |.* 24416 |.* 24420 |.* 24422 |.* 24424 |.* 24427 |.* 24428 |.* 24429 |.* 24430 |.* 24444 |.* 24445 |.* 24489 |.* 24490 |.* 24495 |.* 24547 |.* 24575 |.* 37937 |.* 37940 |.* 37941 |.* 37942 |.* 37943 |.* 37957 |.* 37958 |.* 37963 |.* 37965 |.* 37970 |.* 37981 |.* 38019 |.* 38027 |.* 38057 |.* 38238 |.* 38283 |.* 38339 |.* 38340 |.* 38341 |.* 38342 |.* 38345 |.* 38346 |.* 38353 |.* 38357 |.* 38358 |.* 38363 |.* 38364 |.* 38365 |.* 38366 |.* 38367 |.* 38370 |.* 38372 |.* 38375 |.* 38378 |.* 38379 |.* 38380 |.* 38381 |.* 38792 |.* 45057 |.* 45058 |.* 45061 |.* 45062 |.* 45064 |.* 45069 |.* 45070 |.* 45071 |.* 45075 |.* 45079 |.* 45080 |.* 45083 |.* 45084 |.* 45086 |.* 45087 |.* 45090 |.* 45093 |.* 45095 |.* 45100 |.* 45101 |.* 45102 |.* 45110 |.* 45113 |.* 45587 |.* 45888 |.* 55439 |.* 55461 |.* 55468 |.* 55515 |.* 55786 |.* 55956 |.* 55958 |.* 55960 |.* 55963 |.* 55966 |.* 55967 |.* 55971 |.* 55973 |.* 55982 |.* 55986 |.* 55988 |.* 55990 |.* 55992 |.* 55994 |.* 55996 |.* 55998 |.* 56000 |.* 56001 |.* 56002 |.* 56003 |.* 56005 |.* 56006 |.* 56008 |.* 56012 |.* 56013 |.* 56015 |.* 56019 |.* 56040 |.* 56041 |.* 56042 |.* 56044 |.* 56046 |.* 56047 |.* 56048 |.* 56282 |.* 56292 |.* 58416 |.* 58448 |.* 58461 |.* 58466 |.* 58517 |.* 58518 |.* 58519 |.* 58520 |.* 58536 |.* 58539 |.* 58540 |.* 58541 |.* 58542 |.* 58543 |.* 58563 |.* 58571 |.* 58593 |.* 58741 |.* 58811 |.* 58844 |.* 58845 |.* 58850 |.* 58852 |.* 58854 |.* 58864 |.* 58866 |.* 58879 |.* 58962 |.* 58997 |.* 58998 |.* 59008 |.* 59009 |.* 59010 |.* 59011 |.* 59015 |.* 59019 |.* 59023 |.* 59025 |.* 59028 |.* 59029 |.* 59034 |.* 59037 |.* 59045 |.* 59049 |.* 59050 |.* 59063 |.* 59065 |.* 59067 |.* 59072 |.* 59073 |.* 59074 |.* 59077 |.* 59078 |.* 59083 |.* 59089 |.* 63530 |.* 63531 |.* 63534 |.* 63535 |.* 63540 |.* 63541 |.* 63545 |.* 63548 |.* 63549 |.* 63554 |.* 63555 |.* 63558 |.* 63561 |.* 63570 |.* 63571 |.* 63580 |.* 63582 |.* 63583 |.* 63616 |.* 63617 |.* 63620 |.* 63621 |.* 63631 |.* 63634 |.* 63646 |.* 63655 |.* 63659 |.* 63677 |.* 63678 |.* 63679 |.* 63680 |.* 63689 |.* 63690 |.* 63691 |.* 63696 |.* 63697 |.* 63707 |.* 63711 |.* 63725 |.* 63835 |.* 63838 |.* 131325 |.* 131450 |.* 131477 |.* 131486 |.* 131503 |.* 131519 |.* 131524 |.* 131535 |.* 132058 |.* 132203 |.* 132510 |.* 132525 |.* 132719 |.* 133111 |.* 133118 |.* 133119 |.* 133151 |.* 133194 |.* 133219 |.* 133465 |.* 133475 |.* 133478 |.* 133513 |.* 133514 |.* 133626 |.* 133774 |.* 133775 |.* 133776 |.* 133865 |.* 133952 |.* 134103 |.* 134238 |.* 134417 |.* 134418 |.* 134419 |.* 134420 |.* 134542 |.* 134543 |.* 134755 |.* 134756 |.* 134761 |.* 134762 |.* 134763 |.* 134764 |.* 134765 |.* 134766 |.* 134768 |.* 134769 |.* 134771 |.* 134772 |.* 134810 |.* 135006 |.* 135061 |.* 135357 |.* 135363 |.* 135365 |.* 135577 |.* 135629 |.* 136011 |.* 136180 |.* 136189 |.* 136190 |.* 136390 |.* 136421 |.* 136559 |.* 136758"

二、調整BGP的Inbound的Filter設定，將從上游收到的結尾為特定國別的AS Path的Local Preference權值加大為150，高於預設的100，便可以讓內部的機器，在出去的Outbound方向是走特定的Transit Peer 出去

set policy-options policy-statement Upstream-BGP-IN term 50 from as-path China-AS-Path
set policy-options policy-statement Upstream-BGP-IN term 50 then local-preference 150
set policy-options policy-statement Upstream-BGP-IN term 50 then accept

Enable SSHv2 on Cisco Router & Switch

2017-11-02T22:27:00.000+08:00

Steps to enable SSHv2 on Cisco Router & Switch

1. Define the hostname

2. configure the domain name

3. Specifies the RSA key pair to use for using SSH.
R2(config)#ip ssh rsa key-pair name {key-pair name}
By doing so SSH version 1.5 is deactivated

4. For SSH Version 2, the modulus size must be at least 768 bits.
R2(config)# crypto key generate rsa usage-keys label {keypair-name} modulus 768

4. Enable SSH version 2

5. Check the version with "show ip ssh"

Juniper SRX QoS 設定 ( Class of Service)

2017-09-16T21:57:00.000+08:00

Key Components
Interface Egress Queues – When a physical interface tries to send more traffic than its bandwidth permits, packets are queued in one of a few different numbered queues

Interface Bandwidth Definition – You should manually define the bandwidth of an interface if it is lower than the line speed. For example, a 1gbit interface connected to a 200mbit fibre ethernet line needs to be defined as being 200mbit else it will assume 1gbit and QoS will not work

Forwarding Classes – These effectively assign a name to a numbered queue, for example assured-forwarding

Assignment of traffic to a forwarding class – This can be done in a number of ways:
Classifiers – These observe DSCP, Inet Precedence or other marker types to assign ingress traffic to forwarding classes
Firewall Rules – Ingress traffic can be matched with firewall rules and assigned to forwarding classes

Drop Profiles – A drop profile defines the probability of packets being dropped when a queue reaches a certain size

Schedulers – These define how differently queued egress traffic is prioritized

Scheduler Maps – These link forwarding classes to schedulers

設定規劃目標如下

一、DB封包的服務保證擁有15%專線總頻寬

二、DB封包的服務在專線總頻寬滿載時，會優先傳送

三、BFD封包的Hello Packet偵測封包保證擁有5%專線總頻寬

四、BFD封包的Hello Packet偵測封包在專線總頻寬滿載時，會優先傳送

五、專線總頻寬滿載時， BFD的封包優先級會比DB封包來的高

六、DB與BFD的實際使用流量，若未使用達到保證頻寬時，剩下來的流量可分配給其它一般流量做使用(Best-effort)

set interfaces ge-0/0/8 per-unit-scheduler

set interfaces ge-0/0/8 unit 190 bandwidth 40m

set interfaces ge-0/0/8 unit 190 vlan-id 190

set interfaces ge-0/0/8 unit 190 family inet filter output Traffic-To-Qos

set interfaces ge-0/0/8 unit 190 family inet address 172.16.0.1/30

set firewall filter Traffic-To-Qos term DB-Packet from protocol tcp

set firewall filter Traffic-To-Qos term DB-Packet from port 3260

set firewall filter Traffic-To-Qos term DB-Packet from port 6379

set firewall filter Traffic-To-Qos term DB-Packet from port 26379-26480

set firewall filter Traffic-To-Qos term DB-Packet from port 27017-27019

set firewall filter Traffic-To-Qos term DB-Packet from port 28000-28100

set firewall filter Traffic-To-Qos term DB-Packet then forwarding-class expedited-forwarding

set firewall filter Traffic-To-Qos term BFD-Packet from protocol udp

set firewall filter Traffic-To-Qos term BFD-Packet from port 3784-3785

set firewall filter Traffic-To-Qos term BFD-Packet from port 4784-4785

set firewall filter Traffic-To-Qos term BFD-Packet then forwarding-class network-control

set firewall filter Traffic-To-Qos term Other-Packet then accept

set class-of-service drop-profiles low_drop fill-level 95 drop-probability 0

set class-of-service drop-profiles low_drop fill-level 100 drop-probability 100

set class-of-service drop-profiles med_drop fill-level 75 drop-probability 0

set class-of-service drop-profiles med_drop fill-level 95 drop-probability 30

set class-of-service drop-profiles high_drop fill-level 50 drop-probability 0

set class-of-service drop-profiles high_drop fill-level 95 drop-probability 50

set class-of-service interfaces ge-0/0/8 unit 190 scheduler-map Test-Map-Qos

set class-of-service interfaces ge-0/0/8 unit 190 shaping-rate 40m

set class-of-service scheduler-maps Test-Map-Qos forwarding-class expedited-forwarding scheduler ef

set class-of-service scheduler-maps Test-Map-Qos forwarding-class assured-forwarding scheduler af

set class-of-service scheduler-maps Test-Map-Qos forwarding-class best-effort scheduler be

set class-of-service scheduler-maps Test-Map-Qos forwarding-class network-control scheduler nc

set class-of-service schedulers ef transmit-rate percent 15

set class-of-service schedulers ef buffer-size percent 15

set class-of-service schedulers ef priority medium-high

set class-of-service schedulers ef drop-profile-map loss-priority high protocol any drop-profile high_drop

set class-of-service schedulers ef drop-profile-map loss-priority medium-high protocol any drop-profile med_drop

set class-of-service schedulers ef drop-profile-map loss-priority medium-low protocol any drop-profile med_drop

set class-of-service schedulers ef drop-profile-map loss-priority low protocol any drop-profile low_drop

set class-of-service schedulers nc transmit-rate percent 5

set class-of-service schedulers nc buffer-size percent 5

set class-of-service schedulers nc priority high

set class-of-service schedulers nc drop-profile-map loss-priority high protocol any drop-profile high_drop

set class-of-service schedulers nc drop-profile-map loss-priority medium-high protocol any drop-profile med_drop

set class-of-service schedulers nc drop-profile-map loss-priority medium-low protocol any drop-profile med_drop

set class-of-service schedulers nc drop-profile-map loss-priority low protocol any drop-profile low_drop

set class-of-service schedulers be transmit-rate remainder

set class-of-service schedulers be buffer-size remainder

set class-of-service schedulers be priority low

set class-of-service schedulers be drop-profile-map loss-priority high protocol any drop-profile high_drop

set class-of-service schedulers be drop-profile-map loss-priority medium-high protocol any drop-profile med_drop

set class-of-service schedulers be drop-profile-map loss-priority medium-low protocol any drop-profile med_drop

set class-of-service schedulers be drop-profile-map loss-priority low protocol any drop-profile low_drop

set class-of-service schedulers af transmit-rate percent 50

set class-of-service schedulers af buffer-size percent 50

set class-of-service schedulers af priority medium-low

set class-of-service schedulers af drop-profile-map loss-priority high protocol any drop-profile high_drop

set class-of-service schedulers af drop-profile-map loss-priority medium-high protocol any drop-profile med_drop

set class-of-service schedulers af drop-profile-map loss-priority medium-low protocol any drop-profile med_drop

set class-of-service schedulers af drop-profile-map loss-priority low protocol any drop-profile low_drop

DARTSLIVE-200S 藍芽飛鏢靶開箱

2017-08-27T11:48:00.000+08:00

最近從日本帶回來的新玩具：DARTSLIVE-200S 藍芽飛鏢靶
下班回到家玩一下，還挺舒壓的~~