diff --git a/pandora_console/extras/mr/62.sql b/pandora_console/extras/mr/62.sql index de8ff4c9d2..f8f611d817 100644 --- a/pandora_console/extras/mr/62.sql +++ b/pandora_console/extras/mr/62.sql @@ -189,6 +189,12 @@ CREATE TABLE IF NOT EXISTS `tfavmenu_user` ( `section` VARCHAR(255) NOT NULL, PRIMARY KEY (`id`)); +ALTER TABLE `tnetflow_filter` ADD COLUMN `netflow_monitoring` TINYINT UNSIGNED NOT NULL default 0; +ALTER TABLE `tnetflow_filter` ADD COLUMN `traffic_max` INTEGER NOT NULL default 0; +ALTER TABLE `tnetflow_filter` ADD COLUMN `traffic_critical` float(20,2) NOT NULL default 0; +ALTER TABLE `tnetflow_filter` ADD COLUMN `traffic_warning` float(20,2) NOT NULL default 0; +ALTER TABLE `tnetflow_filter` ADD COLUMN `utimestamp` INT UNSIGNED NOT NULL DEFAULT 0; +ALTER TABLE `tnetflow_filter` ADD COLUMN `netflow_monitoring_interval` INT UNSIGNED NOT NULL DEFAULT 300; INSERT INTO `tconfig` (`token`, `value`) VALUES ('legacy_database_ha', 1); COMMIT; diff --git a/pandora_console/godmode/netflow/nf_edit_form.php b/pandora_console/godmode/netflow/nf_edit_form.php index 2f9e6bd41d..5ad8923ce1 100644 --- a/pandora_console/godmode/netflow/nf_edit_form.php +++ b/pandora_console/godmode/netflow/nf_edit_form.php @@ -26,6 +26,17 @@ * ============================================================================ */ +// Pandora FMS - http://pandorafms.com +// ================================================== +// Copyright (c) 2005-2021 Artica Soluciones Tecnologicas +// Please see http://pandorafms.org for full contribution list +// This program is free software; you can redistribute it and/or +// modify it under the terms of the GNU General Public License +// as published by the Free Software Foundation; version 2 +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. global $config; require_once $config['homedir'].'/include/functions_ui.php'; @@ -94,6 +105,11 @@ if ($id) { $src_port = $filter['src_port']; $aggregate = $filter['aggregate']; $advanced_filter = $filter['advanced_filter']; + $netflow_monitoring = $filter['netflow_monitoring']; + $traffic_max = $filter['traffic_max']; + $traffic_critical = $filter['traffic_critical']; + $traffic_warning = $filter['traffic_warning']; + $netflow_monitoring_interval = $filter['netflow_monitoring_interval']; } else { $name = ''; $assign_group = ''; @@ -103,6 +119,11 @@ if ($id) { $src_port = ''; $aggregate = 'dstip'; $advanced_filter = ''; + $netflow_monitoring = false; + $traffic_max = 0; + $traffic_critical = 0; + $traffic_warning = 0; + $netflow_monitoring_interval = 300; } if ($update) { @@ -114,20 +135,31 @@ if ($update) { $dst_port = get_parameter('dst_port', ''); $src_port = get_parameter('src_port', ''); $advanced_filter = get_parameter('advanced_filter', ''); + $netflow_monitoring = (bool) get_parameter('netflow_monitoring', false); + $traffic_max = get_parameter('traffic_max', 0); + $traffic_critical = get_parameter('traffic_critical', 0); + $traffic_warning = get_parameter('traffic_warning', 0); + $netflow_monitoring_interval = get_parameter('netflow_monitoring_interval', 300); + if ($name == '') { ui_print_error_message(__('Not updated. Blank name')); } else { $values = [ - 'id_sg' => $id, - 'id_name' => $name, - 'id_group' => $assign_group, - 'aggregate' => $aggregate, - 'ip_dst' => $ip_dst, - 'ip_src' => $ip_src, - 'dst_port' => $dst_port, - 'src_port' => $src_port, - 'advanced_filter' => $advanced_filter, + 'id_sg' => $id, + 'id_name' => $name, + 'id_group' => $assign_group, + 'aggregate' => $aggregate, + 'ip_dst' => $ip_dst, + 'ip_src' => $ip_src, + 'dst_port' => $dst_port, + 'src_port' => $src_port, + 'advanced_filter' => $advanced_filter, + 'netflow_monitoring' => $netflow_monitoring, + 'traffic_max' => $traffic_max, + 'traffic_critical' => $traffic_critical, + 'traffic_warning' => $traffic_warning, + 'netflow_monitoring_interval' => $netflow_monitoring_interval, ]; // Save filter args. @@ -152,16 +184,27 @@ if ($create) { $dst_port = get_parameter('dst_port', ''); $src_port = get_parameter('src_port', ''); $advanced_filter = (string) get_parameter('advanced_filter', ''); + $netflow_monitoring = (bool) get_parameter('netflow_monitoring', false); + $traffic_max = get_parameter('traffic_max', 0); + $traffic_critical = get_parameter('traffic_critical', 0); + $traffic_warning = get_parameter('traffic_warning', 0); + $netflow_monitoring_interval = get_parameter('netflow_monitoring_interval', 300); $values = [ - 'id_name' => $name, - 'id_group' => $assign_group, - 'ip_dst' => $ip_dst, - 'ip_src' => $ip_src, - 'dst_port' => $dst_port, - 'src_port' => $src_port, - 'aggregate' => $aggregate, - 'advanced_filter' => $advanced_filter, + 'id_name' => $name, + 'id_group' => $assign_group, + 'ip_dst' => $ip_dst, + 'ip_src' => $ip_src, + 'dst_port' => $dst_port, + 'src_port' => $src_port, + 'aggregate' => $aggregate, + 'advanced_filter' => $advanced_filter, + 'netflow_monitoring' => $netflow_monitoring, + 'traffic_max' => $traffic_max, + 'traffic_critical' => $traffic_critical, + 'traffic_warning' => $traffic_warning, + 'netflow_monitoring_interval' => $netflow_monitoring_interval, + ]; // Save filter args @@ -203,6 +246,8 @@ $table->data['first_line'][] = html_print_label_input_block( false, 20, 80, + true, + false, true ) ); @@ -329,6 +374,77 @@ $table->data['advanced_filters'][] = html_print_label_input_block( ); +// Netflow server options. +$table->colspan['netflow_monitoring'][] = 2; +$table->data['netflow_monitoring'][] = html_print_label_input_block( + __('Enable Netflow monitoring'), + html_print_checkbox_switch( + 'netflow_monitoring', + 1, + (bool) $netflow_monitoring, + true, + false, + 'displayMonitoringFilter()' + ).ui_print_input_placeholder( + __('Allows you to create an agent that monitors the traffic volume of this filter. It also creates a module that measures if the traffic of any IP of this filter exceeds a certain threshold. A text type module will be created with the traffic rate for each IP within this filter every five minutes (the 10 IP\'s with the most traffic). Only available for Enterprise version.'), + true + ) +); + +$table->data['netflow_server_filters'][] = html_print_label_input_block( + __('Netflow monitoring interval'), + html_print_input_number( + [ + 'step' => 1, + 'name' => 'netflow_monitoring_interval', + 'id' => 'netflow_monitoring_interval', + 'value' => $netflow_monitoring_interval, + ] + ).ui_print_input_placeholder(__('Netflow monitoring interval in secs.'), true) +); + +$table->data['netflow_server_filters'][] = html_print_label_input_block( + __('Maximum traffic value of the filter'), + html_print_input_number( + [ + 'step' => 1, + 'name' => 'traffic_max', + 'id' => 'traffic_max', + 'value' => $traffic_max, + ] + ).ui_print_input_placeholder(__('Specifies the maximum rate (in bytes/sec) of traffic in the filter. It is then used to calculate the % of maximum traffic per IP.'), true) +); + +$table->colspan['netflow_thresholds'][] = 1; + +$table->data['netflow_thresholds'][] = html_print_label_input_block( + __('CRITICAL threshold for the maximum % of traffic for an IP.'), + html_print_input_number( + [ + 'step' => 0.01, + 'name' => 'traffic_critical', + 'id' => 'traffic_critical', + 'value' => $traffic_critical, + 'size' => 40, + 'maxlength' => 80, + ] + ).ui_print_input_placeholder(__('If this % is exceeded by any IP within the filter, a CRITICAL status will be generated.'), true) +); + +$table->data['netflow_thresholds'][] = html_print_label_input_block( + __('WARNING threshold for the maximum % of traffic for an IP.'), + html_print_input_number( + [ + 'step' => 0.01, + 'name' => 'traffic_warning', + 'id' => 'traffic_warning', + 'value' => $traffic_warning, + 'size' => 40, + 'maxlength' => 80, + ] + ).ui_print_input_placeholder(__('If this % is exceeded by any IP within the filter, a WARNING status will be generated.'), true) +); + $hiddens = ''; if ($id) { $buttonTitle = __('Update'); @@ -368,10 +484,10 @@ html_print_action_buttons( else { displayAdvancedFilter (); } + displayMonitoringFilter(); }); function displayAdvancedFilter () { - console.log('papapa advanced filter'); // Erase the normal filter document.getElementById("text-ip_dst").value = ''; document.getElementById("text-ip_src").value = ''; @@ -391,9 +507,9 @@ html_print_action_buttons( }; function displayNormalFilter () { - console.log('papapa normal filter'); // Erase the advanced filter document.getElementById("textarea_advanced_filter").value = ''; + // Hide the advanced filter //document.getElementById("table1-7").style.display = 'none'; $("#table1-advanced_filters").css("display", "none"); @@ -407,4 +523,24 @@ html_print_action_buttons( document.getElementById("table1-6").style.display = ''; */ }; + + function displayMonitoringFilter () { + var checked = $('#checkbox-netflow_monitoring').prop('checked'); + + if(checked == false) { + // Reset values. + $("#netflow_monitoring_interval").val(300); + $("#traffic_max").val(0); + $("#traffic_critical").val(0); + $("#traffic_warning").val(0); + + // Hide filters. + $("#table1-netflow_server_filters").hide(); + $("#table1-netflow_thresholds").hide(); + } else { + // Show filters. + $("#table1-netflow_server_filters").show(); + $("#table1-netflow_thresholds").show(); + } + }; diff --git a/pandora_console/images/netflow@svg.svg b/pandora_console/images/netflow@svg.svg new file mode 100644 index 0000000000..87261e6aa9 --- /dev/null +++ b/pandora_console/images/netflow@svg.svg @@ -0,0 +1,5 @@ + + + + + diff --git a/pandora_console/include/constants.php b/pandora_console/include/constants.php index 6b86c50c6d..1d11aad151 100644 --- a/pandora_console/include/constants.php +++ b/pandora_console/include/constants.php @@ -440,6 +440,7 @@ define('SERVER_TYPE_MIGRATION', 20); define('SERVER_TYPE_ALERT', 21); define('SERVER_TYPE_CORRELATION', 22); define('SERVER_TYPE_NCM', 23); +define('SERVER_TYPE_NETFLOW', 24); // REPORTS. define('REPORT_TOP_N_MAX', 1); diff --git a/pandora_console/include/functions_servers.php b/pandora_console/include/functions_servers.php index a58342dddb..28daa277e7 100644 --- a/pandora_console/include/functions_servers.php +++ b/pandora_console/include/functions_servers.php @@ -860,6 +860,19 @@ function servers_get_info($id_server=-1) $id_modulo = 0; break; + case SERVER_TYPE_NETFLOW: + $server['img'] = html_print_image( + 'images/netflow@svg.svg', + true, + [ + 'title' => __('Netflow server'), + 'class' => 'main_menu_icon invert_filter', + ] + ); + $server['type'] = 'netflow'; + $id_modulo = 0; + break; + default: $server['img'] = ''; $server['type'] = 'unknown'; diff --git a/pandora_console/operation/netflow/nf_live_view.php b/pandora_console/operation/netflow/nf_live_view.php index e9c71e0570..ceaa2249e6 100644 --- a/pandora_console/operation/netflow/nf_live_view.php +++ b/pandora_console/operation/netflow/nf_live_view.php @@ -93,7 +93,12 @@ $filter['ip_src'] = get_parameter('ip_src', ''); $filter['dst_port'] = get_parameter('dst_port', ''); $filter['src_port'] = get_parameter('src_port', ''); $filter['advanced_filter'] = get_parameter('advanced_filter', ''); -$filter['router_ip'] = get_parameter('router_ip'); +$filter['netflow_monitoring'] = (bool) get_parameter('netflow_monitoring'); +$filter['netflow_monitoring_interval'] = (int) get_parameter('netflow_monitoring_interval', 300); +$filter['traffic_max'] = get_parameter('traffic_max', 0); +$filter['traffic_critical'] = get_parameter('traffic_critical', 0); +$filter['traffic_warning'] = get_parameter('traffic_warning', 0); + // Read chart configuration. $chart_type = get_parameter('chart_type', 'netflow_area'); @@ -360,6 +365,67 @@ $advanced_toggle .= ''.$radio_buttons.''; $advanced_toggle .= ''.__('Source ip').''; $advanced_toggle .= ''.html_print_input_text('router_ip', $filter['router_ip'], false, 40, 80, true).''; +$advanced_toggle .= ''; + +// Netflow server options. +$advanced_toggle .= ''; + +$advanced_toggle .= "".__('Enable Netflow monitoring').ui_print_help_tip(__('Allows you to create an agent that monitors the traffic volume of this filter. It also creates a module that measures if the traffic of any IP of this filter exceeds a certain threshold. A text type module will be created with the traffic rate for each IP within this filter every five minutes (the 10 IP\'s with the most traffic). Only available for Enterprise version.'), true).''; +$advanced_toggle .= ''.html_print_checkbox_switch( + 'netflow_monitoring', + 1, + (bool) $filter['netflow_monitoring'], + true, + false, + 'displayMonitoringFilter()', +).''; + +$advanced_toggle .= ''; +$advanced_toggle .= "".__('Netflow monitoring interval').ui_print_help_tip(__('Netflow monitoring interval in secs.'), true).''; +$advanced_toggle .= ''.html_print_input_number( + [ + 'step' => 1, + 'name' => 'netflow_monitoring_interval', + 'id' => 'netflow_monitoring_interval', + 'value' => $filter['netflow_monitoring_interval'], + ] +).''; + +$advanced_toggle .= "".__('Maximum traffic value of the filter').ui_print_help_tip(__('Specifies the maximum rate (in bytes/sec) of traffic in the filter. It is then used to calculate the % of maximum traffic per IP.'), true).''; +$advanced_toggle .= ''.html_print_input_number( + [ + 'step' => 1, + 'name' => 'traffic_max', + 'id' => 'traffic_max', + 'value' => $filter['traffic_max'], + ] +).''; + + +$advanced_toggle .= ''; +$advanced_toggle .= ''; + +$advanced_toggle .= "".__('CRITICAL threshold for the maximum % of traffic for an IP.').ui_print_help_tip(__('If this % is exceeded by any IP within the filter, a CRITICAL status will be generated.'), true).''; +$advanced_toggle .= ''.html_print_input_number( + [ + 'step' => 0.01, + 'name' => 'traffic_critical', + 'id' => 'traffic_critical', + 'value' => $filter['traffic_critical'], + ] +).''; + +$advanced_toggle .= "".__('WARNING threshold for the maximum % of traffic of an IP.').ui_print_help_tip(__('If this % is exceeded by any IP within the filter, a WARNING status will be generated.'), true).''; +$advanced_toggle .= ''.html_print_input_number( + [ + 'step' => 0.01, + 'name' => 'traffic_warning', + 'id' => 'traffic_warning', + 'value' => $filter['traffic_warning'], + ] +).''; + + $advanced_toggle .= ''; $advanced_toggle .= ''; @@ -713,6 +779,26 @@ ui_include_time_picker(); // Show the normal filter $(".filter_normal").show(); }; + + function displayMonitoringFilter () { + var checked = $('#checkbox-netflow_monitoring').prop('checked'); + + if(checked == false) { + // Reset values. + $("#netflow_monitoring_interval").val(300); + $("#traffic_max").val(0); + $("#traffic_critical").val(0); + $("#traffic_warning").val(0); + + // Hide filters. + $("#netlofw_monitoring_filters").hide(); + $("#netlofw_monitoring_thresholds").hide(); + } else { + // Show filters. + $("#netlofw_monitoring_filters").show(); + $("#netlofw_monitoring_thresholds").show(); + } + } // Ask the user to define a name for the filter in order to save it function defineFilterName () { @@ -736,7 +822,6 @@ ui_include_time_picker(); $("#filter_id").change(function () { var filter_type; - // Hide information and name/group row $(".filter_save").hide(); @@ -755,6 +840,12 @@ ui_include_time_picker(); $("#text-router_ip").val(''); $("#textarea_advanced_filter").val(''); $("#aggregate").val(''); + $("#traffic_max").val(''); + $("#traffic_critical").val(''); + $("#traffic_warning").val(''); + $("#netflow_monitoring_interval").val(300); + $('#checkbox-netflow_monitoring').prop('checked', false); + // Hide update filter button $("#submit-update_button").hide(); @@ -824,18 +915,31 @@ ui_include_time_picker(); $("#textarea_advanced_filter").val(val); if (i == 'aggregate') $("#aggregate").val(val); + if (i == 'netflow_monitoring') + $("#checkbox-netflow_monitoring").prop('checked', val == "0" ? false : true); + // Hide or show monitoring filters. + displayMonitoringFilter(); + if (i == 'netflow_monitoring_interval') + $("#netflow_monitoring_interval").val(val); + if (i == 'traffic_max') + $("#traffic_max").val(val); + if (i == 'traffic_critical') + $("#traffic_critical").val(val); + if (i == 'traffic_warning') + $("#traffic_warning").val(val); }); } // Shows update filter button $("#submit-update_button").show(); - + } }); $(document).ready( function() { + displayMonitoringFilter(); // Update visibility of controls. nf_view_click_period(); // Hide update filter button diff --git a/pandora_console/pandoradb.sql b/pandora_console/pandoradb.sql index 643eb6c4b6..981b8a5ded 100644 --- a/pandora_console/pandoradb.sql +++ b/pandora_console/pandoradb.sql @@ -2185,6 +2185,12 @@ CREATE TABLE IF NOT EXISTS `tnetflow_filter` ( `advanced_filter` TEXT, `filter_args` TEXT, `aggregate` VARCHAR(60), + `netflow_monitoring` TINYINT UNSIGNED NOT NULL default 0, + `traffic_max` INTEGER NOT NULL default 0, + `traffic_critical` FLOAT(20,2) NOT NULL default 0, + `traffic_warning` FLOAT(20,2) NOT NULL default 0, + `netflow_monitoring_interval` INT UNSIGNED NOT NULL DEFAULT 300, + `utimestamp` INT UNSIGNED NOT NULL DEFAULT 0, PRIMARY KEY (`id_sg`) ) ENGINE=InnoDB DEFAULT CHARSET=UTF8MB4; diff --git a/pandora_server/conf/pandora_server.conf.new b/pandora_server/conf/pandora_server.conf.new index 5cb51e3283..cdfdce105c 100644 --- a/pandora_server/conf/pandora_server.conf.new +++ b/pandora_server/conf/pandora_server.conf.new @@ -764,3 +764,10 @@ tentacle_service_watchdog 1 # Enable (1) or disable (0) the parameter of mysql ssl certification (mysql_ssl_verify_server_cert) (enabled by default). verify_mysql_ssl_cert 1 + +# Enable (1) or disable (0) the Pandora FMS Netflow Server (PANDORA FMS ENTERPRISE ONLY). +netflowserver 0 + +# Number of threads for the Pandora FMS Netflow Server (PANDORA FMS ENTERPRISE ONLY). +netflowserver_threads 1 + diff --git a/pandora_server/lib/PandoraFMS/Config.pm b/pandora_server/lib/PandoraFMS/Config.pm index 703d28dc37..1c1b0d7181 100644 --- a/pandora_server/lib/PandoraFMS/Config.pm +++ b/pandora_server/lib/PandoraFMS/Config.pm @@ -559,6 +559,8 @@ sub pandora_load_config { $pa_config->{"unknown_block_size"} = 1000; # 7.0.769 + $pa_config->{"netflowserver"} = 0; # 7.0.770 + $pa_config->{"netflowserver_threads"} = 1; # 7.0.770 $pa_config->{"ha_mode"} = "pacemaker"; # 7.0.770 $pa_config->{"ha_file"} = undef; # 7.0.770 $pa_config->{"ha_hosts_file"} = '/var/spool/pandora/data_in/conf/pandora_ha_hosts.conf'; # 7.0.770 @@ -1365,6 +1367,12 @@ sub pandora_load_config { elsif ($parametro =~ m/^dataserver_smart_queue\s([0-1])/i) { $pa_config->{'dataserver_smart_queue'} = clean_blank($1); } + elsif ($parametro =~ m/^netflowserver\s([0-1])/i) { + $pa_config->{'netflowserver'} = clean_blank($1); + } + elsif ($parametro =~ m/^netflowserver_threads\s+([0-9]*)/i) { + $pa_config->{'netflowserver_threads'}= clean_blank($1); + } elsif ($parametro =~ m/^ha_connect_retries\s+([0-9]*)/i) { $pa_config->{'ha_connect_retries'} = clean_blank($1); } diff --git a/pandora_server/lib/PandoraFMS/Core.pm b/pandora_server/lib/PandoraFMS/Core.pm index bcb4ae3cc7..ca6b4991a9 100644 --- a/pandora_server/lib/PandoraFMS/Core.pm +++ b/pandora_server/lib/PandoraFMS/Core.pm @@ -296,7 +296,7 @@ our @ServerTypes = qw ( dataserver networkserver snmpconsole - reconserver + discoveryserver pluginserver predictionserver wmiserver @@ -307,6 +307,7 @@ our @ServerTypes = qw ( icmpserver snmpserver satelliteserver + transactionalserver mfserver syncserver wuxserver @@ -315,6 +316,8 @@ our @ServerTypes = qw ( migrationserver alertserver correlationserver + ncmserver + netflowserver ); our @AlertStatus = ('Execute the alert', 'Do not execute the alert', 'Do not execute the alert, but increment its internal counter', 'Cease the alert', 'Recover the alert', 'Reset internal counter'); diff --git a/pandora_server/lib/PandoraFMS/Tools.pm b/pandora_server/lib/PandoraFMS/Tools.pm index 590fdf2020..fb4b551a3a 100755 --- a/pandora_server/lib/PandoraFMS/Tools.pm +++ b/pandora_server/lib/PandoraFMS/Tools.pm @@ -78,6 +78,7 @@ our @EXPORT = qw( PROVISIONINGSERVER MIGRATIONSERVER NCMSERVER + NETFLOWSERVER METACONSOLE_LICENSE OFFLINE_LICENSE DISCOVERY_HOSTDEVICES @@ -202,6 +203,7 @@ use constant MIGRATIONSERVER => 20; use constant ALERTSERVER => 21; use constant CORRELATIONSERVER => 22; use constant NCMSERVER => 23; +use constant NETFLOWSERVER => 24; # Module status use constant MODULE_NORMAL => 0; @@ -2844,6 +2846,8 @@ sub get_server_name { return "MIGRATIONSERVER" if ($server_type eq MIGRATIONSERVER); return "ALERTSERVER" if ($server_type eq ALERTSERVER); return "CORRELATIONSERVER" if ($server_type eq CORRELATIONSERVER); + return "NCMSERVER" if ($server_type eq NCMSERVER); + return "NETFLOWSERVER" if ($server_type eq NETFLOWSERVER); return "UNKNOWN"; }