Bandwidth alarm review

A tool for monitoring and warning you of sudden excess bandwidth usage

License: BSD License File size: 0K Developer: Matthew Bloch

0

A tool for monitoring and warning you of sudden excess bandwidth usage. We built this after a couple of heart attacks, false alarms and big bills incurred by our customers at short notice.

Its main feature is to warn you immediately when a sudden bandwidth spike is detected, by email and SMS. It will also take a sample of the traffic with tcpdump for analysis if the spike stops before you can get to the machine to examine what's going on.

The program is designed to be simple, independent of the host system, and reliable at warning you as insurance against more complicated bandwidth monitoring systems failing-- in the case where a lapse in concentration can cost you thousands of pounds, you may want to consider having more than one bandwidth monitoring scheme in place :-)

Configuring & usage:

You should invoke the program something like this:

/usr/local/bin/bwalarm 2>&1 | logger -t bwalarm

which will send the program's diagnostic output to your system logs in case you don't see the email or SMS. You do look at your logs regularly don't you? :-)

The script is intended to be a stand-alone program which runs forever on a UNIX system. To change its settings you should edit the top of the file which is reasonable well-documented: essentially you point it at sendmail, tcpdump and set the parameters for issuing an alarm.

So that's the maximum number of packets/bytes per minutes/hour/day, and you can set up as many conditions as you want. Finally which email addresses or phone numbers to notify, and your account details at Clickatell, and you're away.

For SMS notification you should sign up with South-African SMS provider Clickatell who are cheap at around ?0.03 per message.

While the program is running it logs alerts to stderr but can show you every reading it takes if you invoke it with the --verbose flag. If you use the --test flag, SMS and email sending will be disabled. You can also tell the program to dump its current list of byte,packet counter pairs to stderr by sending it SIGALRM.