Stuart's Semi-Professional Blog: Automating NFA Parser Reports

UPDATE: CA Support has endorsed the NAST tool as the replacement for the NFAParser. I haven't tested it, but if it's like the other updated tools it will run faster. The nice thing is that the syntax for running the NAST tool silently is the same as the NFAParser. So, it doesn't take much to update this tool to use the new tool.

A while back I was tasked with making it possible to view NFA Parser output inside NPC. It was actually easier than I thought. I came up with something that isn't as optimal as I would like it (I'll explain why later), but it works for now.

The first thing you have to do is to download the NFA Parser which is part of CA's Support Tools 6 and copy it to each harvester. If you don't want to use all the tools, you can just download the parser and put it on each harvester. The output of the parser is an HTML file which is ready to be published to a web service so you can link to it from NPC. The easiest way to do this is to call the parser with a working directory of C:\inetpub\wwwroot on the harvester. That way the output will be put in that directory, ready to be viewed in a browser. However, every time you run the parser, the output file's name contains a date/time stamp, so that makes it a little difficult to link to. The solution is to wrap it all in a batch file that clears the old output, calls the new output, then renames the new output to some static name. Here's what that batch script would look like:

"D:\SupportTools6\NetQoS Utilities\ReporterAnalyzer\NFAParserv9.exe" batch %1
del nfaout.htm
ren nfasum*.htm nfaout.htm

This could be tweaked a bit to keep the last X files using the following batch script:

del /q nfaout%2.htm
for /L %%A in (1 1 %2) do (
ren nfaout%%A.htm nfaoutC.htm
ren nfaoutB.htm nfaout%%A.htm
ren nfaoutC.htm nfaoutB.htm
)
"D:\SupportTools6\NetQoS Utilities\ReporterAnalyzer\NFAParserv9.exe" batch %1
ren nfasum*.htm nfaout1.htm

This second option moves the existing files up in a queue by renaming them with a higher name, except for the highest one that gets deleted. So, if I created a scheduled task like this: C:\inetpub\wwwroot\nfa.bat 1 5, I would eventually end up with 5 files, each one representing one of the last 5 runs with nfaout1.htm being the most recent, each spanning 1 minute. This second method is the option I'm using in production and it seems to work just fine. In order to easily give access to the files, I create an HTML table with a column for the servers then a column for each of the retained reports. Then I put in a row for each harvester. I put that HTML in my custom content directory and load it into a browser view.

<head>
<script>
function whendiditrun(dayoffset,prepost){
var d = new Date();
d.setHours(prepost,0,0,0);
d.setDate(d.getDate()-dayoffset);
var seconds = new Date();
seconds = (seconds - d) / 1000;
interval = Math.floor(seconds / 8640) / 10;
if (interval >= 1) {return interval + " days ago";}
interval = Math.floor(seconds / 360) / 10;
if (interval >= 1) {return interval + " hours ago";}
interval = Math.floor(seconds / 6) / 10;
if (interval >= 1) {return interval + " minutes ago";}
return Math.floor(seconds) + " seconds ago"; }
</script>
</head>
The NFA parser interprets the raw NetFlow data coming into the harvester, generates a report, and runs every 12 hours on each harvester (local time to the harvester). The resulting report for each harvester shows what flows have been received in the 1 minute preceeding the execution of the script. The output of the last 5 reports can be displayed using the links below.
<table border="1">
<tr><td rowspan="2"><center>
Server</center>
</td>
<td colspan="5"><center>
Last Run</center>
</td></tr>
<tr>
<td><script>document.write(whendiditrun(0,0));</script></td>
<td><script>document.write(whendiditrun(1,12));</script></td>
<td><script>document.write(whendiditrun(1,0));</script></td>
<td><script>document.write(whendiditrun(2,12));</script></td>
<td><script>document.write(whendiditrun(2,0));</script></td></tr>
<tr>
<td>Harvester 1</td>
<td><a href="http://harvester1/nfaout1.htm">View</a>
</td>
<td><a href="http://harvester1/nfaout2.htm">View</a>
</td>
<td><a href="http://harvester1/nfaout3.htm">View</a>
</td>
<td><a href="http://harvester1/nfaout4.htm">View</a>
</td>
<td><a href="http://harvester1/nfaout5.htm">View</a>
</td>
</tr>
</table>

Obviously running the report more frequently and with a longer timespan will increase load on the harvester, so don't turn it on to run for 1 minute every minute.

Stuart's Semi-Professional Blog

Pages

Wednesday, January 16, 2013

Automating NFA Parser Reports

No comments:

Post a Comment

Total Pageviews