Big Sister

  (See also the HTML version in the doc subdirectory)


  This is Big Sister Version 0.98beta. Please read the
  RELEASE_NOTES-0.98a file to get some information on new

The name

  Yes, it is called nearly like Sean MacGuire's Big Brother and
  it works nearly like it ... Actually it is even compatible
  with it.

Why was it written then

  ... because I liked the idea behind Big Brother but did not like
      the limitations (mainly performance!) in using shell scripts ...
  ... and also because I needed a few more monitors such as sar,
      rpc and snmp ...
  ... a history would also be fine ...
  ... some way to reduce the number of alarms (e.g. when a router is
      going down I don't want to get 20 alarms stating that all the
      machines behind this router are unreachable) ...
  ... I also wanted to be able to do a more decent grouping on the
      display server ...
  ... and thought about porting BB to other platforms - such as win95
      or NT
  ... and thought about integrating it into the HP Openview/SNMP NMS running
      at our site
  So I started to rewrite BB in Perl step by step.

  In the meantime you will find that Big Sister and Big Brother still
  share some compatible concepts (e.g. the client/server protocol and
  part of the log file format) but do not have too much in common any

Get Help / Sending Comments / Author(s) / Contributions

  The preferred way of asking for support / reporting bugs is now
  via the Support / Bug manager at

  This makes tracking bugs and support requests much more easy.

  Big Sister was originally written by:

	Thomas Aeby, Switzerland

  In the meantime (random order)

	Joseph Gooch
	Richard Cross
	Derek Douville
	Mike Lowe

  joined in. Many contributions have been made from interested
  people out there. Please see the CREDITS section and copyright/
  author notices in the sources.

  Feel free to sent comments or ask for help ...

  You may find the page




  Please read the INSTALL document.

Directory structure

  By default Big Sister installs in /usr/local/lib/bs (but should run
  anywhere else). Below its root directory it installs:

	- bin	the binaries
	- adm	the place where configuration files local to the machine
		should go
	- uxmon	the client software of Big Sister (Unix Monitor)
	- etc	various configuration files (not very populated yet)
	- www	the directory where Big Sister generates its HTML files
	- www/logs	the directory where the client status files
			end up
	- www/logs/history	the directory where the history goes to
	- var	the location where Big Sister stores any file (except
		for the WWW files) it writes to

  Some people might want to move www to /var and place a link into
  /usr/local/lib/bs. "www" is only used on the Status Collector machine.

What config files do you want to edit

  adm/bb-display.cfg	Tells bbdisp.pm what Web pages it should create and which
			tables they should contain.
			NOTE: Any host will only appear on your status web
			      page when it is
				- listed in bb-display.cfg
				- or uses dynamic grouping

  adm/hosts.allow	OBSOLETE (but still active)

  adm/permissions	tell bbd which agents are allowed to connect and
			what they are allowed to send

  adm/grouping		Grouping information for dynamic join/leave of
			host groups (when using the generic uxmon-rules.pl)

  adm/uxmon-net		The agent configuration file
  			Do not forget to at least edit this file after
			a new installation

  etc/syslog		If you are checking system log files ("syslog" check)

  etc/mibs.txt		If you are using snmp monitor this file is used for
			mapping text to oids

  etc/OV		configuration file for HP Openview uxmon Monitor (only
			if you are using the "OV" check)

  adm/bb_event_generator.cfg	The configuration file for the alarm generator

  adm/notify.cfg	If you use bb_event_generator with notify this is
			the notify configuration file

			The definitions in this file are used as a template
			for creating performance data history databases

  etc/bsmon.cfg,	configures the various Big Sister server modules

  see the file CONFIG for a description of these files

How to start it

  A shell script named 'bb_start' is supplied. This should go into /etc/rc2.d
  (or /sbin/rc2.d or wherever your startup scripts usually go) so that Big Sister
  is started during system reboot.

  Of course you can use bb_start manually:

	bin/bb_start start		start Big Sister
	bin/bb_start stop		stop Big Sister
	bin/bb_start restart		stop/restart Big Sister

Overall function

  Big Sister comes in two parts: The "Status Collector" (bbd & bsmon)
  and the "Agent" (uxmon). Uxmon is meant to run on one or more machines. It's
  purpose is to check the local status on the machine (e.g. CPU load, disk usage,
  ...) it is running and the network status of neighbouring machines (e.g. ping,
  RPC, telnet to specific ports, etc.). It reports the status periodically to
  the "Status Collector". The "Status Collector" saves the reported stati,
  creates Web pages showing them, generates alarm messages on pre-configured
  status changes, collects, stores and displays trend data and so forth.

Currently implemented monitors

  - oracle: Oracle database check
  - tripwire: Tripwire system consistency check
  - bbscript: for re-using Big Brother monitoring scripts
  - statusfile: as a simple interface to simple monitors
  - cpuload: CPU load as reported by uptime
  - eventlog: monitoring NT EventLog
  - logfile: generic log file monitor
  - procs: checking running processes
  - ping: checking reachability of a host
  - fs: checking file system usage
  - rpc_ping: checking RPC responses
  - tcp: generic TCP monitor
  - sar: checks sar output against limits
  - snmp: does snmp polling
  - dumpdates: check for last dump/ufsdump backup
  - syslog: check system log files
  - OV: HP Openview trap monitor
  - metastat: check Solstice DiskSuite RAID-Systems
  - dns: check DNS servers
  - radius: Radius
  - http/realhttp: Web Server
  - ... many more (see CONFIG)



	Sean McGuire		author of Big Brother

	Sylvio Svensson		he suggested the name Big Sister and is THE
				HP Openview crack

	Bernhard Stalder	for always being there when I needed an
				experienced system administrator to talk to

	Peter Stevens		for some suggestions, e.g. dynamic grouping

	Russell Mosemann	from whom I have borrowed parts of Monitor::ping.pm

	Philip Nyffenegger	for his support
	Rudolf Meyer		for sharing his NT know how
				and offering connectivity for the
				Big Sister web server

	(just some person)	who unfortunately did not want me to quit the 
				project :-)

	Andreas Disteli		for finding more bugs than I ever wrote :-)

	Peter Sorensen		for many good suggestions

	Roland Roberts		for his contributions

	Torben Sorensen		for his contributions

	Joseph Gooch		for many contributions

	Pius Sabathy		for his support and willingness to
				test new patches/releases

	Kevin O'Donnell		for his contributions

	Tim Powell		for his contributions

	Markus Boss		for his work on the prototype RRDTool support

	Tobi Oetiker		for RRDTool

	Philip Markwalder	for his contributions

	Boris Bellorini		for his contributions

	Eduardo Tarasiuk	for his contributions and support

	Steve Chan		for his contributions

	Manuel de Vega Barreiro	for his contributions

	Richard Ward		for his contributions

	Richard Cross		for his contributions

	Brandon S. Allbery	for his contributions

	brendanb@mission.data	for his contributions

	Neal Rigney		for his contributions

	Simon Clift		for his contributions

	Derek Douville		for his contributions

	T. Taguchi		for his contributions 

	everyone else who contributed and is not listed here