Rechercher : dans
Par :

Info sur l'outil d'analyse reseaux eddie

mousse, le 17 oct 2005 à 14:55:47 
 Signaler ce message aux modérateurs

Bjr,
actuellement stagiaire à l'universite de villenetaneuse et debutant sois linux , j'aurais souhaitez que vous puissiez me donner des infos sur l'outil d'analyse reseaux (eddie version 0.33). en effet , apres avoir installer et configurer eddie je n'arrive toujours pas à le faire fonctionner . c'est un outil sans interface graphique qui set juste a donner des messages dalertes ( du moins il me semble). je doit dire que je lutte depuis plus de 2 semaines et je doit dire que je suis à saturation.linux c'est cool mais prenant! au secourrrs!!:! que dois je faire et surtout j'aurais souhaitez savoir comment apres avoir lancer eddie en mode commande l'arreter avec quel commande . pour vous donnez une idee ci dessous:

root@eddy config]# cat eddie.cf
# Eddie Global Config File
#
# $Id: eddie.cf,v 1.13 2004/07/13 11:03:00 chris Exp $
#

# LOGFILE
# Specifies the file that Eddie logs to. Log detail is defined by
# LOGLEVEL. LOGFILE should always be defined first.
# Use: LOGFILE="<filename>"

LOGFILE="/var/log/eddie.log"


# LOGLEVEL
# LOGLEVEL specifies how much detail is logged to the file
# specified by LOGFILE. The value should be between 0 and
# 9. The higher the value, the more detail is logged. Set
# to 0 to not log anything.
# Use: LOGLEVEL=<int 0-9>

LOGLEVEL=6


# ADMIN
# Specifies an email address for logs to be emailed to. The level
# of detail is defined by ADMINLEVEL. The frequency of emails is
# defined by ADMIN_NOTIFY.
# Use: ADMIN="<email address>"

ADMIN="eddie-adm@domain.name"


# ADMINLEVEL
# ADMINLEVEL is similar to LOGLEVEL, it defines how much log detail
# is stored to be emailed periodically (see ADMIN_NOTIFY) to the
# EDDIE administrator (defined by ADMIN). Set to 0 to disable.
# Use: ADMINLEVEL=<int 0-9>

ADMINLEVEL=3


# ADMIN_NOTIFY
# Specifies how often logs are emailed to ADMIN.
# Use: ADMIN_NOTIFY=<int>[smhdwcy]

ADMIN_NOTIFY=1d # Send Admin summaries only once a day


# NUMTHREADS
# Define the maximum number of threads Eddie should attempt to limit itself to
# using. All directives are executed in their own thread so they do not hold
# up other directives scheduled for the same time. A recommended minimum is
# about 5 (although there is no checking yet so be careful). A good setting
# is probably 15 to 20.

NUMTHREADS=20


# SCANPERIOD
# Defines the default scanperiod for every directive. This is the amount of
# time a directive waits between executing. This setting can be overridden
# when defining the directive.
# Use: SCANPERIOD=<int>[smhdwcy]

SCANPERIOD=10m # by default scan every 10 minutes


# CONSOLE_PORT
# Defines the tcp port which the Eddie Console Server thread listens on.
# This provides a read-only interface to the current state of all active
# directives within a running Eddie. The default port is 33343.
# Set to 0 to disable this feature.
# Use: CONSOLE_PORT=<int>
#CONSOLE_PORT=33343


# EMAIL_FROM, EMAIL_REPLYTO
# Define the From: and Reply-To: fields used by the email action.
# If not set, default values will be used.
# Use: EMAIL_FROM='emailaddress'
# EMAIL_REPLYTO='emailaddress'

#EMAIL_FROM='root@my.domain'
#EMAIL_REPLYTO='sysadmins@my.domain'


# SENDMAIL
# Define the location of the sendmail binary, which EDDIE uses to send
# all email. This is usually either '/usr/lib/sendmail' (Solaris) or
# '/usr/sbin/sendmail' (Redhat Linux). Defaults to '/usr/lib/sendmail'.
# If this option is set after the SMTP_SERVERS option, this will be used
# as the method to send email.
# Use: SENDMAIL='/path/to/sendmail'

#SENDMAIL='/usr/sbin/sendmail'


# SMTP_SERVERS
# Define one or more servers to make SMTP connections to for sending
# email. Servers are specified by hostname or IP address, separated
# by commas. The first server will be used, unless the connection
# fails, then each server will be attempted in turn.
# Defaults to 'localhost'.
# If this option is set after the SENDMAIL option, this will be used
# as the method to send email.
# Use: SMTP_SERVERS='smtp0.domain.com,smtp1.domain.com'

#SMTP_SERVERS='localhost'


# ELVINURL, ELVINSCOPE
# Specifies how to connect to an Elvin4 server. See Elvin docs
# at http://elvin.dstc.edu.au/
# These settings (and the use of Elvin) are optional.
# Use: ELVINURL='<elvin server url>'
# ELVINSCOPE='<elvin server scope>'

#ELVINURL='elvin://elvin.dstc.edu.au'
#ELVINSCOPE='Elvin'


# INTERPRETERS
# Defines processes which are "interpreters", where the first argument will be
# the real name of the process when examining the process table. This only
# effects the PROC directive and means you can look for a process called
# "test.py" which looks like "/usr/bin/python /export/util/test.py" in the
# process table. Eddie is smart enough to ignore the first part,
# "/usr/bin/python" and treat the second part as the actual process name
# (which is normally what you want).
# Use: INTERPRETERS='<name>[,<name> ...]'

INTERPRETERS='sh,bash,perl,perl5.001,perl5.003,perl5.004,python,python1.5,python1.5.2'


# CLASS
# Define classes of hosts which share the same Eddie config. The name of the
# class will match the name of a "group" definition. Each host whose hostname
# is listed in the CLASS definition will use the equivalent "group" of the
# same name.
# Use: CLASS <name>=<hostname>[,<hostname> ...]

CLASS news=host1,host2
CLASS dns=host3
CLASS cache=host5,host6,host7


# ALIAS
# Define some aliases which will be substituted during config parsing,
# or, if located within action calls, will be substituted when that
# action is called.
# Use: ALIAS <name>="<string>"

ALIAS ALERT_EMAIL="alert@domain.name"
ALIAS ONCALL_EMAIL="oncall-pager@domain.name"


# INCLUDE
# Continue parsing the file named after INCLUDE. This allows the
# configuration to be split into multiple files. Eddie rules and directives
# are usually defined in separate files to keep things tidy.
# Use: INCLUDE '<filename>'

# These are provided as examples only. Rules need to be customized for your
# environment. Use these as a guide for designing your own rules.
# INCLUDE 'rules/message.rules' # common MSG definitions

# INCLUDE 'rules/common.rules' # common rules for all hosts#
# INCLUDE 'rules/host.rules' # rule specific to certain hosts

# INCLUDE 'rules/cache.rules' # rules specific to proxy caches
# INCLUDE 'rules/dns.rules' # rules specific to DNS servers
# INCLUDE 'rules/news.rules' # rules specific to news servers

# INCLUDE 'rules/rrd.rules' # rules for storing data in RRD dbs via elvinrrd
INCLUDE 'test.rules'
[root@eddy config]#

Configuration: mandrake 10.2

Meilleures réponses pour « info sur l'outil d'analyse reseaux eddie » dans :
Analyseurs réseau (sniffers) Voir L'analyse de réseau Un « analyseur réseau » (appelé également analyseur de trames ou en anglais sniffer, traduisez « renifleur ») est un dispositif permettant d'« écouter » le trafic d'un réseau, c'est-à-dire de capturer les informations qui y...
Commandes IP relatives aux réseaux sous Windows VoirIl est parfois très utile de connaître les commandes IP, pour analyser voire configurer ses réseaux TCP/IP. Voici la liste de ces commandes à utiliser dans une fenêtre DOS...
Télécharger Wireshark [Ethereal] VoirEthereal (désormais nommé WireShark) est un analyseur réseau (sniffer), c'est-à-dire un logiciel capable de capturer les paquets de données circulant sur le réseau et ce, de manière totalement transparente. Logiciel indispensable à tout...
Les scanners de vulnérabilités - Balayage de ports VoirLe balayage de ports Un « scanner de vulnérabilité » (parfois appelé « analyseur de réseaux ») est un utilitaire permettant de réaliser un audit de sécurité d'un réseau en effectuant un balayage des ports ouverts (en anglais port scanning) sur...
Outils réseau VoirIntroduction aux outils réseau Les réseaux informatiques sont par nature complexes car leur administration demande des compétences sur un grand nombre de domaines. Par ailleurs la multiplicité des protocoles, des systèmes d'exploitation et des...
Créer un réseau local VoirPourquoi mettre en place un réseau local? Lorsque vous disposez de plusieurs ordinateurs, il peut être agréable de les connecter afin de créer un réseau local (en anglais LAN, abréviation de Local Area Network). La mise en place d'un tel réseau...