PPP / PPPoE User Traffic Graphs

jpingle · Joined: 09 May 2005 Posts: 37

We already monitor the number of PPPoE sessions on our access servers, but in some cases we need more detail.

Has anyone figured out a way to graph a particular user's bandwidth usage? Cisco lists MIBs for getting users and other information (Supposed to be at OID .1.3.6.1.4.1.9.10.19.1.3.1.1.3) but that does not work on any of our routers/access servers.

We can graph the individual Virtual Interfaces, but their dynamic nature makes that impractical, and it's also impractical to tie that data to a particular user. It would be great if we could make a graph for a user "bob" and a script could figure out which interface he's on and graph his traffic, keeping it all straight.

I'm going to keep digging, see if I can find a way, but if anyone else has already figured this out I didn't want to reinvent the wheel.

If there aren't any replies, I'll try to share what I find, if anything.

Thanks!

vanc · Joined: 02 Mar 2006 Posts: 30 Location: Boston MA USA

Hi jpingle,

I like what you are asking about but unfortunately am unable to provide any help but would be very interested in what you come up with. We have a linux box that I would be very interesting in graphing users ppp usage, by usage.

As I write I am thinking a bit... we provide virtual IP's to each user that logs in via PPPoE and may be able to use the correlation between user's and their virtual IP's and graph usage based on that.

I am not sure of how the Cisco PPP works, ie virtual IP etc.

Please post when if you find something.

Thanks

jpingle · Joined: 09 May 2005 Posts: 37

While I haven't made any progress in figuring out how to use this to aid traffic graphing, I have found some SNMP queries that will get logged in users:

jpingle · Joined: 09 May 2005 Posts: 37

I finally had some time to dig into this and I've had some success in getting graphing results based on username.

I'm still testing what I've got so far, but it ended up being a script and a whole set of templates and such.

There's probably a better way to accomplish it, so comments are welcome.

I especially don't like the fact that there's no real way to automatically generate the graph and data source names (that I know of) so I end up copying and pasting the username in all three fields (one for the username, and the data source and graph names).

Attached is the graph template, script, etc. Let me know if it works or if there are any problems...

I know there is at least one bug: Sometimes, when a graph is created, it takes the Interface counter as the first amount of traffic instead of the baseline. Not sure why or how to fix it. I suppose with proper interface max values, it wouldn't be an issue, but it's only a minor annoyance.

jpingle · Joined: 09 May 2005 Posts: 37

Unfortunately I seem to have hit a roadblock. Every time a user signs off/on, they get a different Interface, and its SNMP ifInOctets/ifOutOctets are way different than the previous one, and so the graph spikes.

Unfortunately, there is no way to reset the interface counters so I'm not sure how best to solve this one. Using the maximum values for an interface only goes so far to fix it, but it's probably the best way to handle it I guess.

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

Hello Jim

I am not very good at scripting so I was wondering if I should
replace the following fields with

ROUTER=$1 (here router ip address after$)
ROCOMMUNITY=$2 (here router ro community$)
SNMPVERSION=$3 (here router community after$)
USERNAME=$4 (I dont know what to put in this field$)

The MIB below is for .1.3.6.1.2.1.2.2.1.2 a cisco 7200 router on which I can do the snmp query with success

Thanks

Please Help

#!/bin/sh
#
# Find a user's in/out traffic by username.
# Syntax:
# pppoetraffic.sh <router ip> <snmp community> <snmp version> <username>

ROUTER=$1
ROCOMMUNITY=$2
SNMPVERSION=$3
USERNAME=$4

SNMPWALK="/usr/bin/snmpwalk"
SNMPGET="/usr/bin/snmpget"

VPDNNUM=`$SNMPWALK -On -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER snmpwalk .1.3.6.1.2.1.2.2.1.2 | grep "\"$USERNAME\"" | cut -f1 -d'=' | sed 's/.1.3.6.1.2.1.2.2.1.2.//'`

if [ "$VPDNNUM" != "" ]
then
IFNUM=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER .1.3.6.1.2.1.2.2.1.2.$VPDNNUM`
else
IFNUM=0
fi

if [ "$IFNUM" = "0" ]
then
INOCTETS=0
OUTOCTETS=0
else
INOCTETS=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER ifInOctets.$IFNUM`
OUTOCTETS=`$SNMPGET -Oqv -v $SNMPVERSION -c $ROCOMMUNITY $ROUTER ifOutOctets.$IFNUM`
fi

echo "in_traffic:$INOCTETS out_traffic:$OUTOCTETS"

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

By the way my query on the router returns the following I am guessing maybe the scripts needs to be modified for the virtual access field

.1.3.6.1.2.1.2.2.1.2.332 = STRING: Virtual-Access2.318
.1.3.6.1.2.1.2.2.1.2.333 = STRING: Virtual-Access2.319
.1.3.6.1.2.1.2.2.1.2.334 = STRING: Virtual-Access2.320
.1.3.6.1.2.1.2.2.1.2.335 = STRING: Virtual-Access2.321
.1.3.6.1.2.1.2.2.1.2.336 = STRING: Virtual-Access2.322
.1.3.6.1.2.1.2.2.1.2.337 = STRING: Virtual-Access2.323
.1.3.6.1.2.1.2.2.1.2.338 = STRING: Virtual-Access2.324
.1.3.6.1.2.1.2.2.1.2.339 = STRING: Virtual-Access2.325
.1.3.6.1.2.1.2.2.1.2.340 = STRING: Virtual-Access2.326
.1.3.6.1.2.1.2.2.1.2.341 = STRING: Virtual-Access2.327
.1.3.6.1.2.1.2.2.1.2.342 = STRING: Virtual-Access2.328
.1.3.6.1.2.1.2.2.1.2.343 = STRING: Virtual-Access2.329
.1.3.6.1.2.1.2.2.1.2.344 = STRING: Virtual-Access2.330
.1.3.6.1.2.1.2.2.1.2.345 = STRING: Virtual-Access2.331
.1.3.6.1.2.1.2.2.1.2.346 = STRING: Virtual-Access2.332

jpingle · Joined: 09 May 2005 Posts: 37

The script will only do one username at a time, not every username.

The fields requested in the script are passed by Cacti and are specified in the data source definition. You shouldn't have to edit the script.

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.2.1.2.2.1.2

will return th following

.1.3.6.1.2.1.2.2.1.2.354 = STRING: Virtual-Access2.340
.1.3.6.1.2.1.2.2.1.2.356 = STRING: Virtual-Access2.342
.1.3.6.1.2.1.2.2.1.2.357 = STRING: Virtual-Access2.343
.1.3.6.1.2.1.2.2.1.2.359 = STRING: Virtual-Access2.345
.1.3.6.1.2.1.2.2.1.2.360 = STRING: Virtual-Access2.346
.1.3.6.1.2.1.2.2.1.2.363 = STRING: Virtual-Access2.349
.1.3.6.1.2.1.2.2.1.2.364 = STRING: Virtual-Access2.350
.1.3.6.1.2.1.2.2.1.2.368 = STRING: Virtual-Access2.354
.1.3.6.1.2.1.2.2.1.2.369 = STRING: Virtual-Access2.355
.1.3.6.1.2.1.2.2.1.2.372 = STRING: Virtual-Access2.358
.1.3.6.1.2.1.2.2.1.2.373 = STRING: Virtual-Access2.359
.1.3.6.1.2.1.2.2.1.2.377 = STRING: Virtual-Access2.363
.1.3.6.1.2.1.2.2.1.2.379 = STRING: Virtual-Access2.365
.1.3.6.1.2.1.2.2.1.2.380 = STRING: Virtual-Access2.366
.1.3.6.1.2.1.2.2.1.2.384 = STRING: Virtual-Access2.370

This means that there are 370 PPOE users connected on the router at that time. How would I create a script that would count and return that text string so that it can be graphed

Thanks

jpingle · Joined: 09 May 2005 Posts: 37

I'm still not sure you're looking at the proper OID. When I try your OID on my router, I do get a listing like you get. However, it is only a list of the active Virtual-Access interfaces, which is not an accurate count of the number of logged in users, and there's no easy way to use that to get the information needed for the script I posted.

If you're only looking for a count of signed on pppoe/vpdn users, use this OID:
.1.3.6.1.4.1.9.10.24.1.1.4.1.3.2

What I was wanting you to try, if you're looking for individual traffic graphs, is to step through this. This example assumes you are trying to make a traffic graph for the user someone@myisp.com:
">>>" Is something you type. The other lines are what you should see

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.2.1.2.2.1.2

If you're only looking for a count of signed on pppoe/vpdn users, use this OID:
.1.3.6.1.4.1.9.10.24.1.1.4.1.3.2

This Oid does not work on my routers

How would I put a script that allows me to count the number of vpdn users every 5 minutes?

jpingle · Joined: 09 May 2005 Posts: 37

You don't need to make a script, just use the built-in "SNMP - Generic OID Template" in Cacti. When you create the graph under the host, you'll have a place to type in the OID to query, just enter it and give it a description (i.e. "PPPoE Users currently logged in".)

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

and it returns the numbers of pppoe users connected

snmpwalk -v 2c -c public 10.18.2.5 1.3.6.1.4.1.9.9.194.1.1.1
SNMPv2-SMI::enterprises.9.9.194.1.1.1.0 = Gauge32: 329

You don't need to make a script, just use the built-in "SNMP - Generic OID Template" in Cacti. When you create the graph under the host, you'll have a place to type in the OID to query, just enter it and give it a description (i.e. "PPPoE Users currently logged in".)

I did as you suggested, For the moment the graph is created with no data
I dont know if you have any other suggestions

I dont get why its not being graphed as the poller cache shows

Data Source: BAMAKO5 - Current PPPOE users
RRD: /var/www/cacti/rra/bamako5_snmp_oid_193.rrd
Action: 0, OID: 1.3.6.1.4.1.9.9.194.1.1.1 (Host: 10.18.2.5, Community: public)

In my log file I get
M - CMDPHP: Poller[0] Host[20] DS[194] SNMP: v2: 10.18.2.5, dsname: snmp_oid, oid: 1.3.6.1.4.1.9.9.194.1.1.1, output: U

abdulcc · Cacti User Joined: 14 Jul 2006 Posts: 52

For some reason I polled the device and used the

snmpwalk -On -v 2c -c public 1.2.3.4 .1.3.6.1.4.1.9.9.194.1.1.
.1.3.6.1.4.1.9.9.194.1.1.1.0 = Gauge32: 301

Then I used the oid it returned
.1.3.6.1.4.1.9.9.194.1.1.1.0

Its graphing and returning data sources

Thank you

dsmooth · Joined: 17 Mar 2006 Posts: 8

...