Software Review: The Hobbit Monitor

When looking for server and network device monitoring, there are quite a few options, ranging from very expensive to free. Today I focus on a free solution that I use, The Hobbit Monitor.

Hobbit is a system based on a plug-in for the Big Brother Monitoring software. Big Brother has been around for quite some time and was bought by Quest Software a few years ago. Hobbit is very comparable the Big Brother system, keeping most of the same general interface and functionality but adding many new features and overall speed improvements.

Hobbit is a monitoring solution for servers and network devices and allows you to write or use extensions to monitor just about anything that responds over a network connection. A central server controls and collects the monitoring and displays the results via a fairly easy to use web interface. It will track history and trends (via rrd) and provides a built-in reporting tool. If there is an issue (that you've defined), such as a down host, the interface will turn red and will performs any alerting actions that you've defined, such as sending an email or sms message.

A member of the Hobbit team provides a live demo here: http://www.hswn.dk/hobbit/

The alerting function has some great features and is very customizable, but is less than straight forward in its setup. An example the configuration file:

$PHONE=MAIL mycell@acme.com SERVICE=conn REPEAT=2h FORMAT=sms DURATION>10m
$SYSADMIN=MAIL admin@acme.com REPEAT=2h DURATION>10m TIME=*:0600:2300

PAGE=servers/siteone TIME=*:0700:2100
MAIL a_sysadmin@acme.com SERVICE=conn REPEAT=50h FORMAT=plain

HOST=%^win.*
$PHONE
$SYSADMIN

Breaking it down a bit, the configuration is in two parts, the definition and rules of the targets and definitions of the monitoring rules.

The $PHONE definition will email mycell@acme.com only if the conn test (ping test) fails, will repeat the alert every two hours, send the alert in sms format. It will also only trigger if the system has been in alert status for more than ten minutes. The $SYSADMIN definition will email admin@acme.com every two hours on ANY failed test lasting over ten minutes and only between the hours of 6am and 11pm. Those two lines define the targets (whom to email) and the conditions at which to email those addresses.

The PAGE=servers/siteone definition will monitor all the hosts on a page on the server. If your server is http://hobbit.acme.com, then it will monitor all the hosts on http://hobbit.acme.com/servers/siteone. Continuing on that line, the section TIME=*:0700:2100 will only trigger the alert if a host is in alert status between the hours of 7am and 9pm. The next line specifies a target, in this case an email address with some extra rules. The HOST=%^win.* will monitor any hosts that has win. in the name. For example, if you name several servers inside Hobbit win.server, like win.mailserver, win.fileserver, win.appserver. No matter where in Hobbit you have these servers, they will be monitored under this rule. The next two lines, $PHONE and $SYSADMIN just call the predefined targets and use the rules defined there.

As you can see, the alerting functionality is very customizable and, even if the setup isn't point and click, not that hard to set up once you have a little understanding about it. Hobbit also features an easy way to pause or stop alerts via it's web interface. You can stop alerts by test type (like ping test, telnet test, etc), set a duration for the stopage (like no alerts for this host for the next two hours, or until the test turns ok), or even schedule a stopage when you are scheduling some downtime for a host.

As I mentioned before, Hobbit can be extended and customized for greater functionality. You can add more tests either by enabling those built in (refernce the help file for details), by writing your own port tests (also in the help), or by adding extensions. See deadcat.net for a lot of extensions and additional tests. Although the majority of these are geared towards Big Brother, with a little bit of code tweaking they can be easily adapted to Hobbit.

Although this system seems to be Linux/Unix oriented at a quick glance, it provides a lot of functionality for Windows systems utiliziing an agent called BBWin. With BBWin, you can monitor resources such as CPU usage, disk usage, memory usage, running processes and services, uptime, and netstat results. You can also add additional extensions (called externals in BBWin) to test for other things. Configuration is done in an XML file on each server and is very customizable.

You can customize the default warn and panic levels for the CPU usage:



Disk monitoring can be configured with a default warning and panic levels:



Or you can specify specific levels per drive based on a percentage or just an amout of space left:



Remote drives and optical drives can be monitored as well:



Services can be monitored wheter they are running or not. You can also automatically restart the service if you so configure it. You can specify any process running on the server just by adding another line with it's service name. Processes are configured similarily:



Example of the Hobbit overview of some Windows servers utilizing BBWin:



Example of the CPU usage monitoring:



Example of the OpenManage extension I use for my Dell servers:



As you can see, Hobbit is a very powerful and customizable alternative to the other server and network monitoring products out there. With a little bit of reading and some work, you can get this system up and monitoring your systems without too much hassle. Hobbit is definately worth a try if you need a solution and don't have the funds to drop for a commercial solution.