How do you monitor your systems?

[ian_ironport]

I'd like to be able to monitor my Ironport systems to be able to see
* SMTP up/down on each interface
* active recipient queue size
* CPU/RAM/Disk use (as a %)
* number of connections in last 5 minutes
* ...In fact some of the data from the system status and system overview screens in the GUI.

But I don't want to manually log in to the GUI/CLI to manually check this.

I was hoping the SNMP interface would expose these counters then I can easily bolt the Ironports into my existing monitor system, set some thresholds and get alerted when something might be wrong.

Do you have automatic monitoring of the systems?
How have you set it up?

Right now all I have in place is checking via ping and that the SMTP port is open on the exposed interfaces. No monitoring of the system counters.

[tminchin_ironport]

If you get an automated script to login to the Ironport via the GUI you could probably grab a lot of that info from one or two of the monitoring screens.

[MikeK_ironport]

We use the XML pages provided (like ironportip/xml/status).

We also have extensive perl scripts running through the logs and pulling out SBRS info and stuff. We graph it all using drraw (it's kinda like MRTG).

[ian_ironport]

Thanks for the XML hint. I've got a code monkey to pull the XML status from the gateways and generate a web page with the counters from all on 1 screen. Updates every minute (pulling small XML file over WAN is not a big deal, and server it runs on doesn't notice). Then I've put the web page on my active desktop.

We've hardcoded some thresholds and get colour coding for warning and error states if queues/counters get too big.

[tminchin_ironport]

is there any xml page that shows Brightmail stats?

[Erich_ironport]

Is there anything that shows Brightmail, Sophos, or LDAP stats?

[MikeK_ironport]

The XML pages that I know of are:

ironportip/xml/
status
topin
tophosts

We get all our brightmail and virus info from parsing the logs.

[tminchin_ironport]

We could do that, but we'd prefer the Ironport just tell us the number each 10 minutes since it already "knows" it. Then it's easily popped into our statistics monitoring package.

[eparsons_ironport]

For the people who do XML monitoring, do you occassionally get SSL read timeouts? We are using PERL to download the XML over HTTPS, and just about daily we get:

An Error Occurred 500 SSL read timeout:

I've tried adjusting the timeout parameter for the PERL user agent, but that hasnt made much of a differance.

[Corey_ironport]

There are a couple of other things that we're looking at:
We already have an application checking the XML page.
SiteScope to check port 25 connectivity from time to time.
Hypersoft is working on an add-in to their reporting software that basically does the same thing as MFC but from what I've seen the reports are much better than MFC's. It will also allow us to track a message from mailbox to gateway. In the past, we had to use Exchange message tracking to the point where the bridgeheads hand off to the IronPorts then check MFC or create a debug log to track the message over the IronPorts.

[Micke_ironport]

Corey, are your company using Hypersoft for mail tracking and reporting for the complete mailflow from IronPort-Internal Mail system-users mailboxes? We are using HyperSoft Omni Analyser for internal mailtracking and reporting (our e-mail system is based on Lotus Domino).

It would be great to have a solution that covers the complete mailflow. I have had a lot of phonecalls the last week with our salesrep from HyperSoft to find out what HyperSoft can offer. The salesrep seems to have a tight connection with HyperSoft development here in Europe and the IronPort add-on to their existing reporting sw is still under development and they need input for what functions and features we customers need. The MFC mail tracking is great, the reports are ok but IronPort has no soulution for monitoring system status.

I told Hypersoft that it would be nice to have a one tool for mail tracking, reporting and system status monitoring. I have sent HyperSoft mail logs from our IronPort for mail tracking and reporting and the demo reports look promising. In order to get systems status HyperSoft could either use the status logs for historical reports or use the XML pages provided (like ironportip/xml/status) or both.

Are there other interfaces IronPort provides in order to get system status, except for snmp? I look forward to feedback/ideas

Thanks /Micke

[Corey_ironport]

We've been using Hypersoft for Exchange for a while. We just bought the IronPort add-on, though, and will be implementing it over the next couple of months. I'm hoping that it will take the place of MFC.

Frankly, I'm not at all impressed with MFC.
- The product has been out for quite a while, but it still feels like BETA.
- The reports aren't flexible enough. I can't create an ad-hoc report with a date range.
- There aren't enough reports.
- There's no way for me to create my own reports.
- From time to time, our reports are blank. I restart the services, and the subsequent reports are fine, but I can't re-run old reports.
- I'm also not a fan of the direction that they're taking it. (Since I'm under a NDA, I can't say what, but I can say that I'm not pleased with the direction).

[mgraci_ironport]

Corey,

Does Hypersoft actually monitor SMTP for delays?

I have been looking for a product to monitor SMTP roundtrip messages to/from Internet to know if I there are any delays.

Also, how is the product licensed? Cost?

-Matt

[Corey_ironport]

I haven't really looked at it yet. Someone else on my team is setting it up and he's been in Redmond for the past couple of week. I don't believe that it does any "monitoring" though. I believe that it is only for reporting. We use MoM, some home-grown stuff, and some other 3rd party apps for monitoring. We've never found anything that does a good job of round-trip monitoring.

[unix_group_ironport]

We use cacti.

With it we monitor and graph the following:

Interface Traffic
Ambient Temp
Cpu Temp
Cpu usage
Disk I/O
DNS Requests
Mail Transfer Threads
Memory Usage
Work Queue Size
Open Files/Sockets
Queue Utilization
Ping

Using the ironport provided mibs we can do more, however most of the above are part of the default templete provided on cacti's site.


Its also been months since I looked at the template on their site. It might have been upgraded since 5.0 came out recently.