Security Basics For Linux and Unix Installations - Part 2

Hey there,

Following up on our first two posts on basic Linux and Unix installation security and even more installation security measures, we're going to move on to the next section. Today, we'll be focusing more specifically on user, and group, accounts, and modifications that we want to make in that arena.

Again, this series of posts is based mostly on Solaris Unix and RedHat Linux, so it can't possibly apply to everything. I welcome any comments regarding it, especially as they pertain to additional security and other Operating Systems. Just to be clear, also, we won't be touching on more advanced stuff like setting up firewalls, etc. The summary of this 5-part post should end up being a bullet list that you can run through and take care of without having to go too crazy ;)

And, of course, my suggestion, to everyone who has the rights and means, is to script out as much of this method as possible. However you end up securifying your system, once you have your routine down, having Jumpstart or Kickstart do it for you from then on out is much less of a hassle (usually :)

See you tomorrow for section 3!

Cheers,

OS Installation Guidelines, Part 2: Users and Accounts

1. Add accounts for all necessary users. Require valid reasons for all accounts created.

2. You can ignore this step if you're using Solaris or RedHat's OpenSSH pkg or rpm, since it will be complete already: Be sure to add a user account for sshd. This will be required for our OpenSSH to run correctly. Should be as simple as

host # useradd –m –d /users/sshd sshd
host # passwd –l sshd <--- (The passwd –l just locks the password so no one can login to the account. This is okay, since the sshd account is only necessary for privilege separation.

IMPORTANT NOTE FOR POINTS 3 THROUGH 6 REGARDING USER REMOVAL: Please note that for point three, we specify "userdel -r," because these users have home directories that are NOT "/" - If there is any doubt in your mind that an account you want to remove has the root filesystem as its home directory, use "userdel" without the -r, as use of that flag may effectively destroy your system. An easy way to find out what a user's home directory is involves simply grepping the username out of /etc/passwd and checking out the second to last field.

3. userdel –r lp, uucp, nuucp, some, all or more if possible (the nobody account should be removed, too, unless it’s used by a web server or some other application). Note that your list will be larger on RedHat since they generally have a user for every service and you should remove every user for every service you're not using if it wasn't removed by rpm -e. Also, on Redhat, be sure to check for matching entries for the user in /etc/group

4. userdel nobody (This should not be removed if it’s used by a web server or some other application)

5. userdel smtp (Non-existent in Solaris9).

6. userdel mail (Non-existent in Solaris9).

7. chmod 700 all user directories.

8. Comment out gsscred and nfsfind from root cron on Solaris. Delete sys, lp, adm, root.au, uucp and all unnecessary crontabs, if possible.

9. Add “0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/lib/sa/sa1” and “59 23 * * * /usr/lib/sa/sa2 -b -g -r –u” to root's cron. On RedHat you'll need to have the sysstat RPM installed in order to use sar. If it "is" installed on Redhat, check out /etc/cron.d to make sure that it is being run in cron and modify the setup per above, to increase or decrease the number of times it runs, if you need to.

10. Create the directory /var/adm/sa (/var/log/sa on RedHat) if it doesn't exist, and chown it to root:yourAdministratorsGroup. Then chmod the directory to 660.

11. Add “/usr/lib/acct/ckpacct” to root's cron on Solaris, if the machine does not have high user activity and has adequate disk space for logging. Remove any other /usr/lib/acct lines in the Solaris root crontab. For RedHat users, make sure that you have the psacct RPM installed. The default settings should be okay and you can use chkconfig or ntsysv to ensure that process accounting is set to run at boot time.

12. Remove user directories for users who no longer have accounts on the machine.

13. Remove crontab entries in /usr/spool/cron/crontabs (Solaris) or /var/spool/cron (RedHat) for users that no longer have accounts on the machine.

14. Add empty .rhosts, .netrc and .exrc files in all user home directories.

15. chmod 0 and chown root all user .rhosts, .netrc and .exrc files.

16. userdel (–r, if their home directory isn’t "/" ) all users, aside from root, with uid 0.

17. Change the group for any user (other than root) that has a gid of 0, if possible.

18. Be sure to include a umask of 022 in any user’s .profile if their account will require their home directory to be somewhat publicly available. Examples of such an accounts include development or group-based accounts. These kind of accounts are used to ease the ability of a group to work together. Of course, the standard 027 umask would make this impossible. Please use discretion and do this only for accounts where the need is real.

19. For all generic accounts, make them su-only. You can find detailed instructions on how to do this, including some pitfalls and stumbling blocks you may encounter, in our post on making generic accounts su only. As luck would have it, it's still aptly named ;)

to be continued...

, Mike

Sar, Vmstat, Free Memory And Swap On Linux or Unix

Hey There,

Today's post will, hopefully, help out folks in the future, since I see questions about this a lot on the boards (and am happy to keep reposting my original answers :) Actually, if you have the time and any of this seems nutty, you might check out an earlier post we did on dealing with simple arithmetic in the shell or our post on floating point arithmetic and percentages if you're feeling frisky ;)

Linux is actually quite a bit better with this diagnostic issue, at least when it comes to reporting free memory, than Unix is. My heaviest bias on Unix is toward Solaris, since I use it the most. I'm not saying that the way they handle it is bad, incorrect or in any other way improper. I'm just saying that, on its face, it can be bit confusing. So we'll tackle both free memory, and free swap, reporting on vmstat and sar, one by one:

1. Free memory: Generally, like I said, on most Linux distro's, "sar -r"'s "kbmemfree" column and vmstat's "memory/free" sections use the same standard of measurement. You can easily compare the two and see that they match, since they're both reported in kilobytes.

Solaris' implementation is somewhat different, however. While vmstat's "memory/free" output is displayed in kilobytes, the output of "sar -r" is in displayed in the "number of pages" (???) Okay, so right off the bat you can be sure that the numbers won't agree. For instance, if vmstat's output showed 4840496 on Solaris, the output from "sar -r" would be 605367 (from a semi-concurrent run of both commands). Those numbers aren't even close, which is good since you'll at least notice that something is off and not necessarily think you have a huge problem ;)

So, now you'll need to calculate how many pages it takes to equal the amount of kilobytes reported by vmstat. First you'll want to run a simple command to find out the default size of memory pages on your Solaris Unix system:

host # pagesize
8192

In this case, the page size is 8192 (which is reported in bytes), which gives us an 8 kilobyte page. Then, we'll take that number and multiply it by the number of pages being reported by "sar -r":

host # let a=605367*8 <--- Since vmstat reports in kilobytes, we want to multiply the number of pages shown in "sar -r" by the number of kilobytes in our default page (8 kilobytes, composed of 8192 bytes)

host # echo $a
4842936

Now the numbers are pretty much the same. A slight skew is probable, since we didn't run the commands at the "exact same time," memory gets thrown around between processes a lot and a kilobyte (especially these days) is a very small unit of measurement. Still, 4840496 and 4842936 are too eerily close enough for this to have been an accident ;) In short; all is well. The numbers agree.

2. Free Swap is a little bit different on most Linux distro's. In vmstat, it shows up under "memory/swpd" which really means the memory that is currently swapped out, not what's free. But that's okay, because it's reported in the same unit of measurement (kilobytes), and in the same way, that it is in "sar -r" under the "kbswpused" column.

Again, you'll need to make allowances for Solaris Unix, but (before you go cursing it up and down the figurative block) remember that the techniques used to derive the free memory above (and the almost-inverse that we're going to do to figure out if the swap numbers are okay) sometimes show up elsewhere, on other Linux and Unix distributions, so this is actually a good thing :) Really...

Anyway. When you check for how much swap you have free on Solaris, you'll notice that the numbers don't match, again! For example, if "vmstat" is showing 8993040 (in kilobytes, again) for "memory/swap," you'll note that "sar -r" is showing the much larger number, 17993811, in its "freeswap" column. Now we have a situation approximately the opposite of when we tried to make the free physical memory numbers agree.

This time the answer's a little simpler. On Solaris, "sar -r" reports free swap in blocks (which are 512 bytes, of course ;) Two of these equal 1024 bytes which is exactly the size of a kilobyte. Simple. Just divide "sar -r"'s number by 2, and you have the size in kilobytes instead of blocks, so 17993811 (divided by 2) becomes 8996905 (kilobytes), which is pretty close to the 8993040 kilobytes reported by vmstat.

Hopefully this has been more helpful than confusing :)

Best wishes,

, Mike

linux unix internet technology

Linux Perl Script To Graph Out Paging, Memory and CPU

Hey there,

Yesterday's post has finally arrived. I've converted as much as I could from our previous posts into this one comprehensive script for RedHat Linux. I'm not going to overstuff this post with pictures, since the results you'll get here will look exactly like the ones in our previous posts for CPU, Paging and Memory graphing, except our Perl script today will create all 3 at once!

You may notice that the disk buffer reads and writes Graph has not been included here. This is on purpose and due to the fact that I couldn't find much more than opinion about what constituted the equivalent of Solaris cache reads/writes on Linux. The native sar didn't produce the exact same type of statistics, so I didn't want to throw out some garbage just for the sake of filling the page. As we look into this further, it seems that an entire post on how to determine and track Linux's buffer cache would be helpful, informative and quite lengthy all on it's own. I look forward to scripting that out in the near future :)

Today's script was put through its paces on a machine running RedHat AS2.1 (Pensacola) with sar from the sysstat RPM version 5.0.5-12.21as. I mention these specifics because its been my experience, in the past (when RedHat was free) that the column order would occasionally change when the sysstat RPM was updated. With that in mind, I've commented this script with the header notation for the column that I'm grabbing at each point in the script. This way, if it changes for you, all you'll need to do is change the array number to the one matching the data column we're graphing to keep this script pertinent.

These column notation comments (and all the other lines that varied enough from the Solaris script to necessitate changing) are noted in the script with:

# <-----

Again, this script can be run at any time, simply by calling it, since it interprets the sar data and creates the GIF Graphs when you run it, like so:

./linuxcpupagememgraph.pl <--- Worst script name ever? ;)

Over the weekend, we'll post on using these sorts of scripts in CGI and the security implications that go along with automating processes through the web browser (convenient, but sometimes dangerous!).

I hope you find this script helpful and flexible enough to use across however many different versions or flavors of Linux you run at your site.

Cheers,





This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

#
# linuxcpupagememgraph.pl
# Graph CPU, Paging and Memory
# statistics at will!
# Written specifically for Linux
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#

&graphsarB; # sar -g on Solaris # <-----
&graphsarr;
&graphsaru;

sub graphsarB { # <-----
use GIFgraph::bars;
open(SARG, "/usr/bin/sar -B|"); # <-----
@sarg = <SARG>;
close(SARG);
$my_graph = new GIFgraph::bars(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'Number',
 y2_label => 'Number',
 title => 'Paging Activity by Server - host',
 two_axes => 1,
 y_min_value => 0,
 y1_max_value => 20,
 y2_max_value => 20,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green blue black) ],
);
$my_graph->set_legend( qw( Pages_Paged_Out Minor_Page_Faults-Buffer_Access Major_Page_Faults ) ); # <-----
$a = $b = $c = $d = 0;
foreach $line (@sarg) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = "$line[0] $line[1]"; # <-----
 }
 if ( $line[3] == 0 ) { # <-----
  $pandata1[$b] = 0;
 } else {
  $pandata1[$b] = $line[3]; # <----- pgpgout/s
 }
 if ( $line[3] == 0 ) { # <-----
  $pandata2[$c] = 0;
 } else {
  $pandata2[$c] = $line[4]; # <----- fault/s
 }
 if ( $line[3] == 0 ) { # <-----
  $pandata3[$d] = 0;
 } else {
  $pandata3[$d] = $line[5]; # <----- majflt/s
 }
 $a++;
 $b++;
 $c++;
 $d++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[0] = 0;
 @pandata2[0] = 0;
 @pandata3[0] = 0;
}
@data = (\@pandata0, \@pandata1, \@pandata2, \@pandata3);
$my_graph->plot_to_gif( "/your/data/dir/lsarB.gif", \@data ); # <-----
}

sub graphsarr {
use GIFgraph::lines;
open(SARR, "/usr/bin/sar -r|"); # <-----
@sarr = <SARR>;
close(SARR);
$my_graph = new GIFgraph::lines(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'MegaBytes',
 y2_label => 'MegaBytes',
 title => 'Free Memory By Server - host',
 y_min_value => 0,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green blue ) ],
);
$my_graph->set_legend( qw( Real_Memory_Available Swap_Memory_Available ) ); # <-----
$a = $b = $c = 0;
foreach $line (@sarr) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = "$line[0] $line[1]"; # <-----
 }
 $pandata1[$b] = ($line[2]*8)/1000; # <----- kbmemfree
 $pandata2[$c] = ($line[7]/2)/1000; # <----- kbswpfree
 $a++;
 $b++;
 $c++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[1] = 0;
 @pandata2[2] = 0;
}
@data = (\@pandata0, \@pandata1, \@pandata2);
$my_graph->plot_to_gif( "/your/data/dir/lsarr.gif", \@data ); # <-----
}

sub graphsaru {
use GIFgraph::lines;
open(SARU, "/usr/bin/sar -u|"); # <-----
@saru = <SARU>;
close(SARU);
$my_graph = new GIFgraph::lines(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'Percentage',
 y2_label => 'Percentage',
 title => 'CPU Usage By Server - host',
 y1_max_value => 100,
 y2_max_value => 100,
 y_min_value => 0,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green ) ],
);
$my_graph->set_legend( qw( CPU_Utilization ) );
$a = $b = 0;
foreach $line (@saru) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = "$line[0] $line[1]"; # <-----
 }
 $pandata1[$b] = 100-$line[7]; # <----- %idle
 $a++;
 $b++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[1] = 0;
}
@data = (\@pandata0, \@pandata1);
$my_graph->plot_to_gif( "/your/data/dir/lsaru.gif", \@data ); # <-----
}

, Mike

linux unix internet technology

Perl Script To Graph Sar Cached Disk Reads and Writes

Note: Click the above picture to see it at 800x600.

Hey again,

For today's post, we're finally finishing up our four part series on graphing out sar in real time, that we last looked at yesterday. Today we'll be scripting out cached disk reads and writes on a server. This script goes in a little bit of a different direction than the previous three, as we're finally going to go hog-nuts and use bars and lines at the same time (not for the faint of heart ;)

This script was tested on Solaris, and the output from "sar -b" on RedHat is laid out in different order (so the array elements I use to plot the Graph values in this script may not give you the results you desire if you just run it straight-up in Linux). The script below is, again, written in Perl and will, run on Solaris Unix and RedHat Linux (Linux, again, with slight modification)

In our next post, we'll look at the modifications necessary to make all 4 of these scripts work on RedHat Linux. We'll also look at the basic concepts and what we're actually looking for, just in case the next version of the sysstat RPM changes the order of output again!

This script should be run on the host that you're doing the measuring on (since it runs sar at the time you invoke it), like so:

./sarcachegraph.pl

This graph is probably the most annoying out of the 4, which is why I saved it for last. Having cached reads at 100% is pretty much normal on Solaris, so I chose red to make it stand out even more than it would normally. My hope is that none of my superiors will want to look at this ever, and, if they do, they'll never want to again ;)

Remember, click on the picture above to see it at its actual resolution :)

Cheers,





This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

#
# Sarcachegraph.pl
#
# Graph Cached Disk Reads and Writes
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/us/">Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License</a>
#

use GIFgraph::mixed;
open(SARB, "/usr/sbin/sar -b|");
@sarb = <SARB>;
close(SARB);
$my_graph = new GIFgraph::mixed(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'Percentage',
 y2_label => 'Percentage',
 title => 'Cache Reads and Writes by Server - host',
 two_axes => 1,
 y1_max_value => 100,
 y2_max_value => 100,
 y_min_value => 0,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green blue ) ],
 types => [ qw( bars lines ) ],
);
$my_graph->set_legend( qw( Cache_Reads Cache_Writes ) );
$a = $b = $c = 0;
foreach $line (@sarb) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = $line[0];
 }
 $pandata1[$b] = $line[3];
 $pandata2[$c] = $line[6];
 $a++;
 $b++;
 $c++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[1] = 0;
 @pandata2[2] = 0;
}
@data = (\@pandata0, \@pandata1, \@pandata2);
$my_graph->plot_to_gif( "/your/data/dir/sarb.gif", \@data );

, Mike

linux unix internet technology

Graphing System Paging Activity With Perl And Sar

Note: Click the above picture to see it at 800x600.

Hey There,

For today's post, we're following in the footsteps of yesterday's activity, but moving on to scripting out system paging activity on a server. This script goes in a little bit of a different direction than the previous two, as we'll be charting out these values with bars. There are only so many wavy lines a guy can take ;)

This script was written on a Solaris box, and the output from "sar -g" on RedHat is distributed slightly differently (so the array elements I use to plot the Graph values in this script wouldn't give you precise results if you just ran this on Linux. They might be interesting, though ;). The script below is, again, written in Perl and will, run on Solaris Unix and RedHat Linux (Linux, again, with slight modification - but we'll definitely hit on that in a follow-up post when we've covered all 4 major bases).

This script is written to be run on the host it's measuring, since it runs sar at the time you invoke it, like so:

./sarpagegraph.pl

This Graph didn't turn out to look very visually striking, but the use of bars to represent triplicate y values seemed appropriate. Charts like these cause eyestrain, and resulting headaches, commensurate with the amount of sampled data crammed into the picture ;)

Again, click on the picture above to see it at its actual resolution :)

Cheers,





This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

#
# Sarpagegraph.pl
#
# Graph Paging Activity In Almost Real Time
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/us/">Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License</a>
#

use GIFgraph::bars;
open(SARG, "/usr/sbin/sar -g|");
@sarg = <SARG>;
close(SARG);
$my_graph = new GIFgraph::bars(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'Number',
 y2_label => 'Number',
 title => 'Paging Activity by Server - host',
 two_axes => 1,
 y_min_value => 0,
 y1_max_value => 20,
 y2_max_value => 20,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green blue black) ],
);
$my_graph->set_legend( qw( Pages_Paged_Out Pages_Added_To_Free_List Pages_Scanned ) );
$a = $b = $c = $d = 0;
foreach $line (@sarg) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = $line[0];
 }
 if ( $line[2] == 0 ) {
  $pandata1[$b] = 0;
 } else {
  $pandata1[$b] = $line[2];
 }
 if ( $line[2] == 0 ) {
  $pandata2[$c] = 0;
 } else {
  $pandata2[$c] = $line[3];
 }
 if ( $line[2] == 0 ) {
  $pandata3[$d] = 0;
 } else {
  $pandata3[$d] = $line[4];
 }
 $a++;
 $b++;
 $c++;
 $d++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[0] = 0;
 @pandata2[0] = 0;
 @pandata3[0] = 0;
}
@data = (\@pandata0, \@pandata1, \@pandata2, \@pandata3);
$my_graph->plot_to_gif( "/your/data/storage/dir/sarg.gif", \@data );

, Mike

linux unix internet technology

Free Memory Graph Generation With Perl And Sar

Note: Click the above picture to see it at 800x600.

Hey There,

For today's post, we're continuing from yesterday, but moving on to scripting out a graphological representation of the free memory usage on a server. Over the next few days I'll be posting the only other two variations I find that people really want to see all the time (and by people, I mean my managers). Then we'll go over setting them all up to run interactively in CGI so "people" will never bother you again. At least, not for that ;)

We'll also take a quick look, in retrospect, on how to "fix" all four scripts to run using Linux sar from the sysstat RPM. Maybe we'll just make this a graph generation script week. It won't compete with the Oscars, but it might resemble the closest thing we've ever come to a theme amongst a group of consecutive posts on this blog ;)

The script below is, again, written in Perl and will, run on Solaris Unix and RedHat Linux. The script was written specifically to run on Solaris and the output from "sar -r" on RedHat is in slightly different order (so the array elements I use to seed the Graph values in this script won't translate without some modification).

You can run it easily by just invoking it (as it is, it should be run on the host it's measuring, since it runs sar at the time you invoke it):

./sarmemgraph.pl

Note that there are some significant differences in this graph, compared to yesterday's post, including the use of multiple y values. Yay :)

Again, click on the picture above to see it at its actual resolution and enjoy :)

Enjoy,





This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

#
# sarmemgraph.pl
# Graph Free Memory in Pictorial Form
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/us/">Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License</a>
#

use GIFgraph::lines;
open(SARR, "/usr/sbin/sar -r|");
@sarr = <SARR>;
close(SARR);
$my_graph = new GIFgraph::lines(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'MegaBytes',
 y2_label => 'MegaBytes',
 title => 'Free Memory By Server - host',
 y_min_value => 0,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green blue ) ],
);
$my_graph->set_legend( qw( Real_Memory_Pages_Available Swap_Memory_Available ) );
$a = $b = $c = 0;
foreach $line (@sarr) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = $line[0];
 }
 $pandata1[$b] = ($line[1]*8)/1000;
 $pandata2[$c] = ($line[2]/2)/1000;
 $a++;
 $b++;
 $c++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[1] = 0;
 @pandata2[2] = 0;
}
@data = (\@pandata0, \@pandata1, \@pandata2);
$my_graph->plot_to_gif( "/my/stats/directory/sarr.gif", \@data );

, Mike

linux unix internet technology

Script to Generate CPU Graphs With Perl And Sar

Hey There, - Quick Note: Click on the above image to see it in its actual 800x600 resolution.

For today's post, I'll keep it short and sweet (due to the sleep deprivation suffered from my Friday/Saturday overnight work. We all need to sleep sometime. Anytime is good for me at this point ;)

Hope you enjoy the script below. It's written in Perl and will, theoretically, run on Solaris Unix and RedHat Linux.

Why only theoretically? Actually, it will work on both, but I wrote this script to run on Solaris and the output from "sar -u" on RedHat is in slightly different order (so the array elements I use to seed the Graph values in this script won't directly translate, but can be easily modified). You can run it easily by just invoking it (as it is, it should be run on the host it's measuring, since it runs sar at the time you invoke it):

./sarcpugraph.pl

Hope you enjoy this and can use the basic concept to help you generate all sorts of different graphs and charts from sar. I prefer the numbers, straight up, but some folks like to look at lines and bars and strangely colored pies. It's a free world ;)

The sample gif attached above is what your typical output will look like. Blogspot has trimmed it from the 800x600 resolution it was generated at. If you want to see it at that size, just click on it and the link should take you to the full version!

Enjoy,







This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

#
# Sarcpugraph.pl
# Make Fun CPU Graphs For People Who 
# Like To See That Sort Of Thing
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#

use GIFgraph::lines;
open(SARU, "/usr/sbin/sar -u|");
@saru = <SARU>;
close(SARU);
$my_graph = new GIFgraph::lines(800,600);
$my_graph->set( 
 x_label => 'Time',
 y1_label => 'Percentage',
 y2_label => 'Percentage',
 title => 'CPU Usage By Server - host',
 y1_max_value => 100,
 y2_max_value => 100,
 y_min_value => 0,
 y_tick_number => 5,
 long_ticks => 1,
 x_ticks => 0,
 legend_marker_width => 24,
 line_width => 10,
 bar_spacing => 0,
 gifx => 800,
 gify => 600,
 transparent => 1,
 dclrs => [ qw( red green ) ],
);
$my_graph->set_legend( qw( CPU_Utilization ) );
$a = $b = 0;
foreach $line (@saru) {
 next if ( ($line !~ /:/) || ($line =~ /\//));
 @line=split(" ", $line);
 if ( ( $a % 12 ) != 0 ) {
  $pandata0[$a] = undef;
 } else {
  $line[0] =~ s/:00$//;
  $pandata0[$a] = $line[0];
 }
 $pandata1[$b] = 100-$line[4];
 $a++;
 $b++;
}
if ( ! $c ) {
 @pandata0[0] = `date "+%H:%M"`;
 @pandata1[1] = 0;
}
@data = (\@pandata0, \@pandata1);
$my_graph->plot_to_gif( "/my/stats/directory/saru.gif", \@data );

, Mike

linux unix internet technology