Automate the Monitoring of System Capacity for Inbound IronPort SMA

[anotthak8]

Is it possible to automate the process of monitoring the reports and system capacity details in the Iron Port Security Management Appliance (SMA) and receive an alert when messages exceeds the maximum threshold in the work queue?

Any assistance or information will be greatly appreciated. Thank you.

[Robert Sherwin · Accepted solution]

Only on ESA... you could setup a message filter on the ESA to alert you when workqueue goes higher than what you'd like --->

wq_alert:
if workqueue-count > 500 { notify ('robert@domain.com', 'Workqueue is over 500');
}
.

-Robert

[anotthak8]

Robert,

If it's not too much trouble, could you please provide the steps to implement this?

Also, would this provide real time monitoring. If not, is there a way to do so?

Thank you

[Robert Sherwin]

Sure - this would be real-time, as similar to watching the workqueue via CLI: workqueue rate 10

In order to implement, have CLI access, run similar to the following:

(Machine 9_7_1_066A.local)> filters

NOTICE: This configuration command has not yet been configured for the current cluster mode (Machine 9_7_1_066A.local).

What would you like to do?
1. Switch modes to edit at mode "Cluster =-_9_7_-=".
2. Start a new, empty configuration at the current mode (Machine 9_7_1_066A.local).
3. Copy settings from another cluster mode to the current mode (Machine 9_7_1_066A.local).
[1]>

Choose the operation you want to perform:
- NEW - Create a new filter.
- IMPORT - Import a filter script from a file.
- CLUSTERSET - Set how filters are configured in a cluster.
- CLUSTERSHOW - Display how filters are configured in a cluster.
[]> new

Enter filter script. Enter '.' on its own line to end.
wq_alert:
if workqueue-count > 500 { notify ('robert@domain.com', 'Workqueue is over 500');
}
.
1 filters added.

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
- CLUSTERSET - Set how filters are configured in a cluster.
- CLUSTERSHOW - Display how filters are configured in a cluster.
[]>

(Cluster =-_9_7_-=)> commit

Please enter some comments describing your changes:
[]>

Changes committed: Wed Mar 09 22:53:05 2016 EST

Now when your workqueue goes over 500, you'll get an administrator email.  You could set to lower value if you wish to test and assure proper thresholds.  You may wish to up/down the value, based on overall mail volume or work queue tipping point concerns.

-Robert

[SumitChaturvedi3481]

Hello Robert, 

Thank you for your inputs. Is it possible to tweak this script in such a way that everytime the queue goes beyond the threshold, it gets suspended automatically and resumes back when below the threshold.

Regards,

Sumit Chaturvedi

[Notes Administrator]

Hi Robert,

One of the aspects we miss out on is not the Workqueue, but messages building up in the Tophosts queue.   Is there a monitor for the tophosts, possibly by total or preferably by domain.

Yes, the problem is there are loads of misspelt domains that accumulate, but we have some really important specific domains we route mail in high volume and when we had a DDoS and lost the outbound connectivity there were no alerts as the CPU / Workqueue were low, but the Tophosts went sky high.

Currently we have an external email routing check, sending an email and calculating round trip.

Thanks

[Notes Administrator · Accepted solution]

System Administration > System Health (ASyncOS 9.6+ may have come in earlier)

Also using SNMP as our monitoring system will graph each appliance onto the same graph

Neither perfect...

SMA too much of a collection delay and not granular enough in last hour. So only good for historical analysis.

SNMP consolidated graph saves logging onto each box to get last hour granular details.

Still revert to CLI > Status when you know there are queues to manage