3rd Party Tools

[lslocum_ironport]

Empowering IPN Citizens through tools! IronPort’s Top 10 3rd Party Tools are listed below. Reply to this post to share your favorite 3rd party tools.

For IronPort Unsupported Contributed Tools visit the Support Portal.: http://tinyurl.com/3c5l8r


IRONPORT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, WITH RESPECT TO THE PACKAGES, POSTS OR THIRD PARTY TOOLS, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. IRONPORT DOES NOT PROVIDE ANY SUPPORT SERVICES FOR THE PACKAGES, POSTS OR THIRD PARTY TOOLS.

1. Remote access - connect to an appliance from a PC. Putty, Free Telnet/SSH.
   http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
2. Log Analysis - Freeware Kiwi Syslog
   http://www.kiwisyslog.com/products/
3. Tcpdump - tcp capture via command line
   http://www.tcpdump.org/
4. Softerra freeware LDAP browser
   http://www.ldapbrowser.com or http://download.softerra.com/files/ldapbrowser26.msi)
5. SimpleCom Tools has a fantastic suite of tools: SMTP Test tools, TCP and UDP test tools etc.
   http://www.simplecomtools.com/downloads.html
6. WinSCP is a great tool to move log or config files, SCP for Windows
   http://winscp.net/eng/download.php
7. SolarWinds has a couple of useful free tools at the bottom of this page like a free TFTP Server
   http://www.solarwinds.net/downloads/index.aspx
8. Relay Test Pro allows you to check for open relays, it’s a trial, but fully functional
   http://www.digiarch.org/relaytest.html
9. Edit any kind of text file including xml, html, perl, php etc.
   http://www.editpadpro.com/download.html
10. DNS Goodies pickups where DNS stuff left off and lets you search for free without commercial info
    http://www.dnsgoodies.com/

[steven_geerts]

We use Nagios (http://www.nagios.org) for monitoring our Ironports.
Nagios support several plugins and has an active community developing plugins to check a variety of systems.
We use the check_ironport plugin to retrieve useful info then the HTTP(s) XML pages and the standard check_snmp plugin for the additional stuff like the hardware status.

With these two we have setup a quite robust monitoring system for our Ironports, including event forwarding to the corporate TE/C monitoring environment.

If anyone wants to have a copy of our Nagios checks, just send me a reply.


Besides this we use syslog-ng http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/ (on our syslog host).
This tool allows us to filter several types of info’s from the Ironport logfiles and store those into separate logfiles. We have for example a logfile that logs all the “commit” actions and the supplied comments, a logfile that displays all the AV actions, a logfile that records all spoofed messages (by logging a custom X-header we add for spoofing) etc.
And the best of all: it supports syslog traffic over TCP (just like Ironport does)

(now we need to find someone who can convert the findevent command to a useful version on our syslog host) :)



Steven

[RYAN KIM]

steven_geerts wrote:
If anyone wants to have a copy of our Nagios checks, just send me a reply.

Steven

Hi Steven, we're looking into the possiblity of using Nagios to monitor some of our IronPorts.  I'd be interested to see what your checking.

Thanks,

Ryan