Ssm
The following scenario shows how to configure different SSM (System Service Monitoring) operations. SSM operations can be used to monitor several system states (e.g., CPU, memory, storage and temperature), activating or deactivating previously defined alarms when the monitored states reach certain threshold values.
Monitoring Storage
Description
In this scenario an SSM operation is configured in DUT0 to monitor the storage state of the system and activate or deactivate an alarm when said state reaches a defined threshold value. First, the alarm is activated when a new file is downloaded. Then the alarm is deactivated when the downloaded file is deleted.
Scenario
Step 1: Run command show system storage
at DUT0
and expect this output:
Show output
Total: 8144384 Free: 7850144 Used: 294240
Step 2: Set the following configuration in DUT0
:
set service ssm log-level notice set service ssm operation OPER_STO interval 0.05 set service ssm operation OPER_STO description 'OPER_STO operation description' set service ssm operation OPER_STO type storage set service ssm operation OPER_STO alarm ALARM_STO activate value 586080 set service ssm operation OPER_STO alarm ALARM_STO deactivate value 498528.0 set system alarm ALARM_STO
Note
To emulate an increase in storage usage, a file with a known size could be downloaded. To activate the alarm with this increase in storage used, the alarm activation threshold must be adjusted with the value resulting from adding the current used storage and the size of the new file to be downloaded. In this example, the value set as the activation threshold is 586080K, since the value of the current used storage is 294240K and the size of the new file to be downloaded is 291840K. Also, to emulate a decrease in storage used, the previously downloaded file could be deleted. To deactivate the alarm with this decrease in storage used, the alarm deactivation threshold must be adjusted with the value of the storage used before downloading the new file. In this example, the value set as the deactivation threshold is 498528.0K.
Step 3: Run command service ssm operation show
at DUT0
and check if output contains the following tokens:
OPER_STO
Show output
----------------------------------------------------------------------------------------------- Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled ----------------------------------------------------------------------------------------------- OPER_STO storage 294240.00 ALARM_STO 586080.00 498528.00 false
Step 4: Run command system alarm ALARM_STO show
at DUT0
and check if output matches the following regular expressions:
(ALARM_STO)\s+(false)Show output
------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) ------------------------------------------------------------------- ALARM_STO false 0 0.00
Step 5: Run command service ssm operation OPER_STO show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(false)Show output
----------------------------------------------------------------------------------------------- Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled ----------------------------------------------------------------------------------------------- OPER_STO storage 294240.00 ALARM_STO 586080.00 498528.00 false
Step 6: Run command service ssm operation show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(false)Show output
----------------------------------------------------------------------------------------------- Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled ----------------------------------------------------------------------------------------------- OPER_STO storage 294240.00 ALARM_STO 586080.00 498528.00 false
Note
The previous command output should show that the operation has been created successfully and that the alarm is desactivated, since the storage used has not yet increased.
Step 7: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 10.215.168.50/24
Step 8: Ping IP address 10.215.168.1
from DUT0
:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.330 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.330/0.330/0.330/0.000 ms
Step 9: Run command file copy http://10.215.168.1/~robot/os_iso_v3.3.1.2.iso running:// force
at DUT0
and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 285M 100 285M 0 0 472M 0 --:--:-- --:--:-- --:--:-- 471M
Step 10: Run command file show running://
at DUT0
and check if output contains the following tokens:
os_iso_v3.3.1.2.isoShow output
------------------------------------------------------------------------------------ Name Type Size Last modified ------------------------------------------------------------------------------------ auth/ directory 12KB 2024 Apr 3 19:34 base-enc.diff1 application/octet-stream 256B 2024 Apr 3 21:14 base-enc.rules application/octet-stream 208B 2024 Apr 3 21:14 base.diff1 text/plain 238B 2024 Apr 3 21:14 base.diff2 text/plain 510B 2024 Apr 3 21:12 base.diff2-aes256 application/octet-stream 528B 2024 Apr 3 21:17 base.rules text/plain 176B 2024 Apr 3 21:12 config.boot regular file, no read permission 268B 2024 Apr 3 19:37 coredump/ directory 4.0KB 2024 Apr 3 21:30 dos.rules text/plain 62KB 2024 Apr 3 21:20 drop-performance.rules text/plain 200B 2024 Apr 3 21:18 firewall/ directory 4.0KB 2024 Apr 3 21:30 kerneldump/ directory 4.4KB 2024 Apr 3 19:34 local.rules text/plain 357B 2024 Apr 3 21:19 log/ directory 260KB 2024 Apr 3 21:32 os_iso_v3.3.1.2.iso application/x-iso9660-image 285MB 2024 Apr 3 21:33 ruleset.tar.gz application/octet-stream 336B 2024 Apr 3 21:17 save-hist/ directory 4.0KB 2024 Apr 3 19:34 scripts/ directory 4.0KB 2024 Mar 26 14:58 support/ directory 4.2KB 2024 Apr 3 19:56 suricata.minimal.rules text/plain 3.7MB 2024 Apr 3 21:12 test-performance.rules text/plain 129B 2024 Apr 3 21:16 tor.rules text/plain 714KB 2024 Apr 3 21:20 uid text/html 220B 2024 Apr 3 21:18 user-data/ directory 4.0KB 2024 Apr 3 20:42
Note
With the previous command, a file with a known size is downloaded, thus causing an increase in the storage used.
Step 11: Run command show system storage
at DUT0
and expect this output:
Show output
Total: 8144384 Free: 7558304 Used: 586080
Step 12: Run command system alarm ALARM_STO show
at DUT0
and check if output matches the following regular expressions:
(ALARM_STO)\s+(true)Show output
-------------------------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) -------------------------------------------------------------------------------------- ALARM_STO true 2024-04-03 21:33:07.089433 1 2.42
Step 13: Run command service ssm operation OPER_STO show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(true)Show output
------------------------------------------------------------------------------------------------------------------ Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled ------------------------------------------------------------------------------------------------------------------ OPER_STO storage 586080.00 ALARM_STO 586080.00 498528.00 true 2024-04-03 21:33:07.089433
Step 14: Run command service ssm operation show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(true)Show output
------------------------------------------------------------------------------------------------------------------ Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled ------------------------------------------------------------------------------------------------------------------ OPER_STO storage 586080.00 ALARM_STO 586080.00 498528.00 true 2024-04-03 21:33:07.089433
Note
The previous command output should show that the alarm is activated, since the storage used has increased after downloading the new file.
Step 15: Delete a file by running file delete running://os_iso_v3.3.1.2.iso
.
Note
With the previous command, the downloaded file is deleted, thus causing a decrease in the storage used.
Step 16: Run command show system storage
at DUT0
and expect this output:
Show output
Total: 8144384 Free: 7558304 Used: 586080
Step 17: Run command show system storage
at DUT0
and expect this output:
Show output
Total: 8144384 Free: 7850144 Used: 294240
Step 18: Run command system alarm ALARM_STO show
at DUT0
and check if output matches the following regular expressions:
(ALARM_STO)\s+(false)Show output
---------------------------------------------------------------------------------------------------- Alarm Status Toggled Prev-toggled Toggle-count Time up (%) ---------------------------------------------------------------------------------------------------- ALARM_STO false 2024-04-03 21:33:08.121432 2024-04-03 21:33:07.089433 2 19.45
Step 19: Run command service ssm operation OPER_STO show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(false)Show output
-------------------------------------------------------------------------------------------------------------------------------- Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled -------------------------------------------------------------------------------------------------------------------------------- OPER_STO storage 294240.00 ALARM_STO 586080.00 498528.00 false 2024-04-03 21:33:08.121432 2024-04-03 21:33:07.089433
Step 20: Run command service ssm operation show
at DUT0
and check if output matches the following regular expressions:
(OPER_STO)\s+(storage)[\s\d.]+(ALARM_STO)[\s\d.]+(false)Show output
-------------------------------------------------------------------------------------------------------------------------------- Operation Type Last-Value Alarm Activate Deactivate Status Toggled Prev-toggled -------------------------------------------------------------------------------------------------------------------------------- OPER_STO storage 294240.00 ALARM_STO 586080.00 498528.00 false 2024-04-03 21:33:08.121432 2024-04-03 21:33:07.089433
Note
The previous command output should show that the alarm is deactivated, since the storage used has decreased after the deletion of the downloaded file.