Monitor DHCP Discover
peiffer at umn.edu
Thu Jun 18 14:24:58 UTC 2009
> DHCP server doesn't hold a MIB to quer via snmp.
I don't understand your question.
Your statement is correct in that the DHCP server doesn't have a MIB to
query. But if you use the logfiles produced by DHCP syslog traps you
can offload the DHCP server of doing event managment.
Event management was not something that was spec'ed into the DHCP
server, so it is probably unfair to ask it to do so. By using an event
correlator, you can get the job of event managment done. The process is
service agnostic.. Given something to build regular expressions, nearly
any log can be parsed, so you should be able to look at any service
(DHCP, DNS, Radius, ....).
By using an event correlator, you have enough to work with and you can
do what 'Red1' asks. As event correlators go, SEC is fast, SEC is
flexible, SEC is free, SEC is able to monitor nearly *any* log format.
SEC is easy, or as complex as you wish to make it.
> On Tue, Jun 2, 2009 at 4:48 PM, Tim Peiffer <peiffer at umn.edu
> <mailto:peiffer at umn.edu>> wrote:
> red1 red wrote:
> > Dear ISC Members;
> > I'm using ISC DHCP v4.0.0/ OS: Redhat , I'd like to configure DHCP
> > Server to send notification (snmp trap or whatever) if it hasn't
> > received any DHCP DISCOVER since specific time (eg 30 seconde
> ago ) or
> > if DHCP DISCOVER rate go less than a specefic threshold (eg
> Less than
> > 20 Discovers/minute)
> > Is it doable ?? Please advise.
> Please look at the simple event correlator SEC by Risto Virandi.
> It is
> on the sourceforge. It is flexible and can be configured to parse and
> act on nearly any log format. The user forum is pretty active and
> has a
> pretty high signal to noise ratio. I use the tool extensively.
> Also look at John Rouillard and John Brown's white papers. They are
> informative reading.
> SEC - open source and platform independent event correlation tool ->
> <http://www.estpak.ee/%7Eristo/sec/SourceForge.net>: Simple Event
> Correlator ->
> Tim Peiffer
> Network Support Engineer
> Office of Information Technology / OIA
> University of Minnesota / NorthernLights GigaPOP
> > Thanks in advance
> > Red1
> > _______________________________________________
> > dhcp-users mailing list
> > dhcp-users at lists.isc.org <mailto:dhcp-users at lists.isc.org>
> > https://lists.isc.org/mailman/listinfo/dhcp-users
> dhcp-users mailing list
> dhcp-users at lists.isc.org <mailto:dhcp-users at lists.isc.org>
Network Support Engineer
Office of Information Technology
University of Minnesota/NorthernLights GigaPOP
More information about the dhcp-users