Monitoring NetWitness with Nagios

[RSAAdmin]

It's been a month since the RSA Global Summit and I finally got the documentation together on how we implemented Nagios monitoring of Netwitness hardware and services. I've uploaded it to documents and you should be able to find it here:

Monitoring NetWitness with Nagios

I've also attached a copy of the Perl script a cow-orker wrote as a Nagios check specifically for pulling SNMP values from the NetWitness services, which is invaluable for monitoring stats like memory, sessions processed, dropped packets and such.

[Anonymous]

is their any option to monitor them using SNMP traps, with any other third party monitoring tools or SNMP server?

[RSAAdmin]

I'm not sure. The appliances use a stock SNMP agent for Linux, so theoretically you could set something up on the appliance that would locally monitor an attribute via SNMP over the loopback, then send an SNMP trap to a given destination. That's assuming you want to do traps in response to values in the decoder/concentrator/broker services.

Since you can install Nagios plugins locally you can definitely use SNMP traps for the OS-side of things, such as an alert on low disk space or such. We have never implemented such a setup.