You may remember a while back we reviewed the latest update of GFI LANguard 9, another powerful product developed by GFI is EventsManager.

Managing, archiving and monitoring logs and SNMP traps for a whole network can be a bit of a logistical nightmare, that’s where products like this come in. Commonly they are known under the umbrella term Business Intelligence Systems or more specifically Log/Event Management.

Installation is easy enough as per usual with GFI software, configuration will be a little more complex depending on the architecture of your network. If you have any problems however you can download the user manual here – esm8manual.pdf [PDF]. Do note you will require a local or remote instance of MS-SQL for events archiving. You can download and use MS-SQL 2005 Express Edition (which is free).

You can find an overview of the software here and a full features list here.

Once you get started you’ll need to setup the MS-SQL database before you can do anything else, so either put the details for your remote server or install the free express edition then set up the database.

After that you can select if you wish to process local computer events, selected machines or setup custom config (snmp traps/syslog). There are a lot of options in the configuration management and allows you to easily aggregate the logs/SNMP output from a whole network. It allows logging from a plethora of devices including Windows and Linux servers, Cisco devices, Juniper devices, laptops, desktops and databases.

The main screen gives you a very simple overview that the services are running correctly and the global events count with a break-down by type.

The graphing view allows you to visually see by source or globally by event classification and volume flow by hour.

The Event Browser allows you to view individual events, drill down to the details captured and sort them by status allowing you to track down problems easily and diagnose which application is causing the problem.

You can also add the free GFI EventsManager ReportPack, which enables you to generate graphical IT-level, technical and management reports based on the hardware and software events processed by GFI EventsManager.

Pricing runs as low as $45.00 per node for Servers and $4.50 per node for Workstations if you buy in bulk.

You can download the free trial here:

http://www.gfi.com/downloads/register.aspx?pid=esm

You can find the full details on GFI EventsManager here:

http://www.gfi.com/eventsmanager

The SNMP protocol is a stateless, datagram oriented protocol. An SNMP scanner is a program that sends SNMP requests to multiple IP addresses, trying different community strings and waiting for a reply. Unfortunately SNMP servers don’t respond to requests with invalid community strings and the underlying UDP protocol does not reliably report closed UDP ports. This means that ‘no response’ from the probed IP address can mean either of the following:

• machine unreachable
• SNMP server not running
• invalid community string
• the response datagram has not yet arrived

The approach taken by most SNMP scanners is to send the request, wait for n seconds and assume that the community string is invalid. If only 1 of every hundred scanned IP addresses responds to the SNMP request, the scanner will spend 99*n seconds waiting for replies that will never come.

This makes traditional SNMP scanners very inefficient.

onesixtyone takes a different approach to SNMP scanning. It takes advantage of the fact that SNMP is a connectionless protocol and sends all SNMP requests as fast as it can. Then the scanner waits for responses to come back and logs them, in a fashion similar to Nmap ping sweeps. By default onesixtyone waits for 10 milliseconds between sending packets, which is adequate for 100Mbs switched networks. The user can adjust this value via the -w command line option. If set to 0, the scanner will send packets as fast as the kernel would accept them, which may lead to packet drop.

Running onesixtyone on a class B network (switched 100Mbs with 1Gbs backbone) with -w 10 gives us a performance of 3 seconds per class C, with no dropped packets. All 65536 IP addresses were scanned in less than 13 minutes.

You can download onesixtyone here:

onesixtyone-0.3.2.tar.gz

Or read more here.