Open-AudIT

I'm not sure if this is something that Mark had ever considered including in Open-Audit or if anyone is even interested in but since most of the components to make it happen are already in place it might be a great feature to add. Most of you (I assume) are familiar with the Big Brother network monitor and what it does. If not go check here [url]http://bb4.com/[/url].

I've been using a Big Brother clone called Big Sister ever since they started insisting on licensing fees (big ones) for use of the formerly free software. Big Sister development seems to have stagnated but the product is open source and free. I like it because it uses the Big brother like "idiot light" approach to the status screen and I can set up a monitor in my data center that can be glanced at for quick status. The "free" part helps too. Big Sister is built around PERL scripts so like open-Audit it's easily edited.

Could that type of display be easily integrated into the Open-Audit server? The two products would compliment each other well. They both do regular scans and display the results. The status scan could be augmented to run a full Open-Audit scan at a set interval or after x number of status scan cycles.

And yes, before anyone states the obvious, I simply run them in parallel, but an integrated system would be very nice.

Thoughts?

I have been looking at something similar, I am sure I posted code a while back, but never had a chance to enhance it. All it did was check to see if the ports discovered by OA were currently live, auto-refreshing the page every 20 seconds.

Applications like BB (and Big Sis) do a lot more, but this would do for a quick glance.

I use this method to do my morning system check.I have coded a custom page with critical services on it from various sites, so I can tell at a glance if anything has died in the night.

The basic idea is fairly simple, but we would need to code a few pages to allow us to select and group the necessary items..

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

The basics are actually already in Open-AudIT.
You can schedule a check every xx minutes on xx port.
Call "scan_list.php" in the browser, and setup some scans.
Then, you need a cron task to run (as root) scan.php each minute.

** At the moment, this is a Linux only option. This will change.

Many more options will be added, when I focus on this part of OA.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

Why don't you just use Hobbit Monitor? It's a fork of BB anyway, with improvements: [url]http://hobbitmon.sourceforge.net/[/url]

You can still use the old BB Windows client, or you can use the open source BBWin client, which isn't graphical, but offers more stats when used with a Hobbit backend: [url]http://sourceforge.net/projects/bbwin/[/url]

Very interesting, I had not heard about that product. It looks like it would be worthy of a look though. I've been running "Big Sister" [url]http://bigsister.graeff.com/[/url] which is another BB clone but has no licensing requirements. Development has been slow and it's a bit clumsy to maintain but it does work and is compatible with the BB and it's clients.

I don't want to get too far away from the point of this thread. I'd still like to see at least some minimal monitoring availability in Open-Audit as a selectable option even if that was just a recurring ping check. From what Mark and Andrew said it looks like the idea is being worked on. The components are all there already, it just needs a page coded to display the results, and maybe another recurring script just for the health checks. I'll work on it a little in my spare time (spare time, I think I remember what that is...) if I get a chance.