jonschipp-nagios-plugins/check_bro.sh

#!/usr/bin/env bash

# Author: Jon Schipp
# Date: 11-08-2013
########
# Examples:

# 1.) Check status of all Bro workers
# $ ./check_bro.sh -f /usr/local/bro-2.2/bin/broctl -T status

# 2.) Return average packet loss for the 3 named bro workers
# $ ./check_bro.sh -T loss -i "nids0,nids1,nids2"

# 3.) Check average packet loss of all bro workers against warning and critical thresholds i.e > 10% or 20% packet loss.
# $ ./check_bro.sh -T loss -i all -w 10 -c 20

# 4.) Check packet loss percentage for the last most recent interval from Bro's capture_loss.log above 10% loss.
# $ ./check_bro.sh -f /usr/local/bro-2.2/logs/current/capture_loss.log -T capture_loss -c 10

# 5.) Check average packet loss reported by Myricom's SnifferG driver for each Bro node.
# $ ./check_bro.sh -T myricom -i "192.168.1.254,192.168.1.253" -u bro

# Nagios Exit Codes
OK=0
WARNING=1
CRITICAL=2
UNKNOWN=3

# Default location of broctl
# Set this to the proper location if your installation differs or use ``-f''
BROCTL=/usr/local/bro/bin/broctl

# Default location of myri_counters
# Set this to the proper location if your installation differs
MYRI_COUNTERS=/opt/snf/bin/myri_counters

# Default location of capture_loss.log
# Set this to the proper location if your installation differs
CAPTURE_LOG=/usr/local/bro/logs/current/capture_loss.log

usage()
{
cat <<EOF

Check status of Bro and Bro workers.
This script should be run on the Bro manager.

Options:
  -c <int>                Critical threshold as percent of packet loss
  -f <path>               Set optional absolute path for broctl, myri_counters, or capture_loss.log (Use as first option)
                          (def: $BROCTL,
                          $MYRI_COUNTERS,
                          $CAPTURE_LOG)
  -i <node/worker>        Identifier for Bro instance(s). IP, FQDN, or name depending on the check. (sep:, )
  -p <name>               Print the value of data from Bro e.g. Notice::suppressing or capture_filter
  -T <type>               Check type, "status/loss/capture_loss/myricom/print"
                          status - Check status of all Bro workers
                          loss   - Average packet loss by name for a single-
                            (\`\`-i nids01''), set (\`\`-i "nids01,nids02"), or all workers (\`\`-i all'').
                          capture_loss - Checks for packet loss in capture_loss.log
                          myricom - Average Myricom Sniffer driver packet loss by IP or FQDN for a single-
                            (\`\`-i 192.168.1.1'') or set (\`\`-i "192.168.1.1,192.168.1.2") of Bro nodes
                            Connects to nodes via SSH (pub-key auth). If username is not root use ``-u''.
                          print   - Print Bro values
  -u <user>               Username for the myricom check (def: root)
  -w <int>                Warning threshold as percent of packet loss

Usage: $0 -f /usr/local/bro-dev/bin/brotcl -T status
$0 -f /usr/local/bro-2.2/logs/current/capture_loss.log -T capture_loss -c 20
EOF
}

argcheck() {
# if less than n argument
if [ $ARGC -lt $1 ]; then
  echo "Missing arguments! Use \`\`-h'' for help."
  exit 1
fi
}

# Initialize variables
CRIT=0
WARN=0
LIST_NODES=0
LOSS_CHECK=0
CAPTURE_LOSS_CHECK=0
STATUS_CHECK=0
PRINT_CHECK=0
MYRI_CHECK=0
MYRI_STATS=0
USER=root
LOSS=0
RECV=0
RUNNING=0
STOPPED=0
CRASHED=0
UNKNOWN_WORKER=0
WORKERS=all
EXCLUDE=none
ARGC=$#

argcheck 1

while getopts "hfc:i:lm:p:T:u:w:" OPTION
do
  case $OPTION in
    h)
      usage
      ;;
    f)
      shift
      if [[ $1 == *broctl ]]; then
        BROCTL="$1"
      elif [[ $1 == *myri_counters ]]; then
        MYRI_COUNTERS=$1
      elif [[ $1 == *capture_loss.log ]]; then
        CAPTURE_LOG=$1
      else
        echo "File name appears to be incorrect, maybe try setting the approprate variable in $0."
      fi
      ;;
    c)
      CHECK_THRESHOLD=1
      CRIT="$OPTARG"
      ;;
    l)
      LIST_NODES=1
      ;;
    i)
      if [ $LOSS_CHECK -eq 1 ] && [[ "$OPTARG" == all ]]; then
        WORKERS=".*"
      elif [ $LOSS_CHECK -eq 1 ]; then
        WORKERS=$(echo "$OPTARG" | sed 's/,/:\\|/g')
      elif [ $MYRI_CHECK -eq 1 ]; then
        NODE=$(echo "$OPTARG" | sed 's/,/ /g')
      else
        echo "ERROR: Argument is in incorrect format or \`\`-T <type>'' was not specified first"
        exit $UNKOWN
      fi
      ;;
    p)
      PRINT="$OPTARG"
      ;;
    T)
      if [[ "$OPTARG" == status ]]; then
        STATUS_CHECK=1
      elif [[ "$OPTARG" == myricom ]]; then
        MYRI_CHECK=1
      elif [[ "$OPTARG" == loss ]]; then
        LOSS_CHECK=1
      elif [[ "$OPTARG" == capture_loss ]]; then
        CAPTURE_LOSS_CHECK=1
      elif [[ "$OPTARG" == print ]]; then
        PRINT_CHECK=1
      else
        echo "Unknown argument type"
        exit $UNKNOWN
      fi
      ;;
    u)
        USER="$OPTARG"
        ;;
    w)
        WARN="$OPTARG"
        ;;
    \?)
        exit 1
        ;;
  esac
done

if [ $LOSS_CHECK -eq 1 ] || [ $STATUS_CHECK -eq 1 ] || [ $LIST_NODES -eq 1 ] || [ $PRINT_CHECK -eq 1 ] ; then
  if [ ! -f $BROCTL ];
  then
    echo "ERROR: Broctl has not been found. Update the BROCTL variable in $0 or specify the path with \`\`-f''"
    exit 1
  fi
fi

if [ $LIST_NODES -eq 1 ]; then
  $BROCTL nodes
  exit $OK
fi

if [ $LOSS_CHECK -eq 1 ]; then

# Total average packet loss as a percent for specified workers
FLOAT_LOSS=$($BROCTL netstats | grep "$WORKERS" | sed 's/[a-z]*=//g' | awk '{ drop += $4 ; link += $5 } END { printf("%f\n", ((drop/NR) / (link/NR))* 100) }')
LOSS=$(/usr/bin/printf "%d\n" $FLOAT_LOSS 2>/dev/null)

  if [ $LOSS -gt $CRIT ] ;then
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $CRITICAL
  elif [ $LOSS -gt $WARN ]; then
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $WARNING
  else
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $OK
  fi
fi

 # Check status of Bro workers

if [ $STATUS_CHECK -eq 1 ]; then

# Broctl stderr is whitespace separated and we need to match on entire line
IFS=$'\n'

  for line in $($BROCTL status 2>&1 | grep -v 'Name\|waiting\|Getting')
  do
    NAME=$(echo "$line" | awk '{ print $1 }')
    case "$line" in
    *stop*)
      echo "$NAME has stopped"
      STOPPED=$((STOPPED+1))
      ;;
    *fail*)
      echo "$NAME has crashed"
      CRASHED=$((CRASHED+1))
      ;;
    *run*)
      echo "$NAME is running"
      RUNNING=$((RUNNING+1))
      ;;
    *)
      echo "Unknown status of worker: $NAME"
      UNKNOWN_WORKER=$((UNKNOWN_WORKER+1))
      ;;
    esac
  done

  if [ $STOPPED -gt 0 ] || [ $CRASHED -gt 0 ] || [ $UNKNOWN_WORKER -gt 0 ]; then
    echo "-> $STOPPED stopped workers, $CRASHED crashed workers, $RUNNING running workers, and $UNKNOWN_WORKER workers with an unknown status"
    exit $CRITICAL
  else
    echo "All $RUNNING instances are running!"
    exit $OK
  fi
fi

if [ $CAPTURE_LOSS_CHECK -eq 1 ]; then
  if [ ! -f $CAPTURE_LOG ]; then
    echo "capture_loss.log cannot be found, modify CAPTURE_LOG in $0 or use \`\`-f''"
    exit $UNKNOWN
  fi

  INTERVAL=$(awk 'NR == 9 { printf("%d\n", $2) }' $CAPTURE_LOG)
  TIME=$(date +"%s")
  RECENT=$(echo $((TIME-INTERVAL)))

  awk -v recent=$RECENT -v crit=$CRIT -v loss=0 -v threshold=0 '! /^#/ && $1 > recent && $4 > 0 \
    {
      loss++; decimal=sprintf("%d", $6);
      if ( strtonum(decimal) > crit ) {
        threshold++
        print "Peer: "$3,"\t","Loss:", $6;
      }
    }

    END {
      if ( loss >= 1 ) {
        print "\n--------------------\n"loss,"instances of loss with",threshold,"exceeding the threshold ("crit"%).";
        if ( threshold > 0 ) {
          exit 2
        }
        exit 0
      }
    else
      print "\nNo loss detected"; }' $CAPTURE_LOG

  if [ $? -eq 2 ]; then
    exit $CRITICAL
  else
    exit $OK
  fi
fi

if [ $PRINT_CHECK -eq 1 ]; then
  $BROCTL print $PRINT
  exit $OK
fi

if [ $MYRI_CHECK -eq 1 ]; then

LOSS=0
RECV=0
COUNT=0
LOSS_TOT=0
RECV_TOT=0
AVERAGE=0

  if [ ! -f $MYRI_COUNTERS ]; then
    echo "ERROR: myri_counters has not been found. Update the MYRI_COUNTERS variable in $0 or specify the path with \`\`-f''"
    exit $UNKOWN
  fi

  for node in $NODE
  do
    MYRI_STATS=$(ssh -l $USER $node $MYRI_COUNTERS | awk -F : '/SNF drop ring full|SNF recv pkts/ { print $2 }' | sed 's/[ \t]*//')
    RECV=$(echo $MYRI_STATS | awk '{ print $1 }')
    LOSS=$(echo $MYRI_STATS | awk '{ print $2 }')
    LOSS_TOT=$((LOSS+LOSS_TOT))
    RECV_TOT=$((RECV+RECV_TOT))
    COUNT=$((COUNT+1))
    echo "$node: Lost $LOSS of $RECV"
  done

  echo "--------------------"

  # Average
  FLOAT_LOSS=$(echo "(($LOSS_TOT / $COUNT) / ($RECV_TOT / $COUNT)) * 100" | bc -l)
  LOSS=$(/usr/bin/printf "%d\n" $FLOAT_LOSS 2>/dev/null)

  if [ $LOSS -gt $CRIT ]; then
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $CRITICAL
  elif [ $LOSS -gt $WARN ]; then
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $WARNING
  else
    echo "Average packet loss is: $FLOAT_LOSS"
    exit $OK
  fi
fi