XLog用戶行為審計(jì)系統(tǒng)典型配置舉例

1、目錄 TOC o 1-5 h z HYPERLINK l bookmark4 o Current Document 1 介紹 1 HYPERLINK l bookmark6 o Current Document 特性簡(jiǎn)介 1 HYPERLINK l bookmark8 o Current Document 注意事項(xiàng) 1 HYPERLINK l bookmark10 o Current Document 配置舉例 1 HYPERLINK l bookmark12 o Current Document 2.1 組網(wǎng)需求 1 HYPERLINK l bookmark14 o Current Docu

2、ment 配置步驟 2配置前檢查 2 HYPERLINK l bookmark16 o Current Document 安裝FreeBSD系統(tǒng)2 HYPERLINK l bookmark128 o Current Document 安裝采集器28 HYPERLINK l bookmark172 o Current Document 配置Quidway S3952P-EI32 HYPERLINK l bookmark194 o Current Document 2.2.5配置FTP服務(wù)器33 HYPERLINK l bookmark196 o Current Document 配置XLog U

3、BAS軟件33 HYPERLINK l bookmark204 o Current Document 驗(yàn)證結(jié)果39 HYPERLINK l bookmark206 o Current Document 故障排除舉例 39 HYPERLINK l bookmark208 o Current Document 2.3.1 故障現(xiàn)象39 HYPERLINK l bookmark220 o Current Document 相關(guān)資料 41相關(guān)協(xié)議和標(biāo)準(zhǔn)41其它相關(guān)資料 41XLog 用戶行為審計(jì)系統(tǒng)配置舉例關(guān)鍵詞：XLog、UBAS、DIG日志、DIG摘要日志摘 要：XLog用戶行為審計(jì)系統(tǒng)和設(shè)備以及

4、采集器配合可以對(duì)產(chǎn)生的NAT、Flow、NetStream、DIG以及DIG摘要日志進(jìn)行統(tǒng)計(jì)；本文主要闡述了 XLog用戶行為審計(jì)系統(tǒng)和采集器配 合產(chǎn)生DIG日志和DIG摘要日志的組網(wǎng)、安裝和配置過程。縮略語：XLog、UBAS、DIG日志、DIG摘要日志縮略語英文全名中文解釋XLogXLog Network Analysis SystemXLog網(wǎng)絡(luò)分析系統(tǒng)UBASUser Behavior Audit System用戶行為審計(jì)系統(tǒng)DIG日志DIG Log華為3Com公司的一種日志格式，用于記錄網(wǎng)絡(luò)流量信息DIG摘要日志DIGEST Log華為3Com公司的一種日志格式，用于記錄網(wǎng)絡(luò)數(shù)據(jù)的摘

5、 要信息1 介紹1.1 特性簡(jiǎn)介XLog 用戶行為審計(jì)系統(tǒng)通過和設(shè)備以及采集器配合，接收并統(tǒng)計(jì)網(wǎng)絡(luò)日志信 息，可以采集到網(wǎng)絡(luò)中的流量信息，同時(shí)也支持HTTP、SMTP以及FTP的內(nèi)容摘要 信息的采集，為用戶提供直觀詳細(xì)的網(wǎng)絡(luò)流量審計(jì)功能，從而掌握用戶的網(wǎng)絡(luò)行為。1.2 注意事項(xiàng)XLog服務(wù)器的操作系統(tǒng)為 Windows Server 2003 + SP1 或 Windows 2000 Server + SP4），數(shù)據(jù)庫(kù)為 SQL Server2000+SP3（或 SP4），客戶端 IE 的版本應(yīng)在 5.5 版本以上；另外本文僅闡述了 FreeBSD系統(tǒng)的安裝，XLog的安裝請(qǐng)參考XLog用 戶

6、行為審計(jì)系統(tǒng)安裝指導(dǎo)， Windows Server 2003 的安裝請(qǐng)另行查閱資料。2 配置舉例以采集器的DIG日志和DIG摘要日志與XLog的用戶行為審計(jì)系統(tǒng)配合為例，說 明FreeBSD和采集器的安裝以及設(shè)備和XLog用戶行為審計(jì)系統(tǒng)的配置。2.1 組網(wǎng)需求Internet0鏡像戈網(wǎng)卡 I ncl:2Internet0鏡像戈網(wǎng)卡 I ncl:2網(wǎng)卡 IncO: 536圖 1 XLog UBAS 系統(tǒng)采集 DIG 日志典型組網(wǎng)圖圖1為XLog UBAS系統(tǒng)配合采集器采集網(wǎng)絡(luò)中的流量及摘要信息的組網(wǎng)圖。 其中采集器的網(wǎng)卡VR1的IP地址不需要和局域網(wǎng)路由可達(dá)；其他所有網(wǎng)卡的地 址都需要和網(wǎng)絡(luò)

7、路由可達(dá)。局域網(wǎng)用戶通過交換機(jī)上網(wǎng)，產(chǎn)生的流量都鏡像到一個(gè)以太網(wǎng)口上，采集器的 網(wǎng)卡VR1就連接在這個(gè)以太網(wǎng)口上，從而可以采集到本局域網(wǎng)所有用戶的流量信息 和部分應(yīng)用的摘要信息；采集器再利用另一塊網(wǎng)卡VR0將生成的日志文件通過交換 機(jī)傳給XLog服務(wù)器192.168 4 50供XLog管理員進(jìn)行日志審計(jì)。2.2 配置步驟2.2.1 配置前檢查檢查項(xiàng)檢查項(xiàng)說明操作系統(tǒng)版本W(wǎng)indows Server 2003 SP1 版本操作系統(tǒng)版本FreeBSD 5.4數(shù)據(jù)庫(kù)版本SQL Server 2000 SP3 或 SP4 版本XLog UBAS版 本XLog2.10-R0120 版本設(shè)備版本Quidw

8、ay S3952P-EI VRP software, Version 3.10, ESS 1510客戶端IEIE版本5.5以上（推薦使用IE6.0）XLog運(yùn)行狀態(tài)采集器和處理器進(jìn)程運(yùn)行正常2.2.2 安裝FreeBSD系統(tǒng)1.光盤引導(dǎo)FreeBSD系統(tǒng)FreeBSD的光盤放入光驅(qū)，啟動(dòng)計(jì)算機(jī)，并選擇啟動(dòng)設(shè)備為光驅(qū)CD Loader 1.2Building the boot loader arguMents Looking up /BOOT/LORDER. Found Re localing the loader and the BTXStart ing the BTX loaderBTX l

9、oader 1.00 BTX version is 1.01Console: interna 1 uideo/keyboardBIOS CD is cd0BIOS drive A： is disk0BIOS drive C： is disklBIOS 638kB/260032kB aua ilable MeMoryFreeBSD/1386 bootstrap loader, Reuis ion 1.1( HYPERLINK mailto:root root, Sun May 8 05：59：07 UTC 2005) Loading /boot/defaults/loader.confZboot

10、/kerne1/kerne1 text =0 x444168 圖 2 光盤引導(dǎo)選擇引導(dǎo)方式使用數(shù)字鍵選擇引導(dǎo)方式，默認(rèn)引導(dǎo)方式是第一種；回車選擇第一種引導(dǎo)方式進(jìn)入下一步UeIcoMeto FreeBSD!12345678BootBootBootBootBootFreeBSD FreeBSD FreeBSD FreeBSD FreeBSDdefaultwith ACPI disabled in Safe Mode in single user Mode with verbose loggingEscape to loader proMptBoot FreeBSD with USB keyboar

11、d RebootSelect opt ion, Enter for defan It or Space 1 to pause t iMer 9 _圖 3 選擇啟動(dòng)項(xiàng)回車后，計(jì)算機(jī)將會(huì)自動(dòng)從光盤引導(dǎo)FreeBSD系統(tǒng)1234567812345678圖 4 引導(dǎo) FreeBSD選擇安裝模式使用上下鍵進(jìn)行選擇操作，回車或空格即進(jìn)入此選項(xiàng)；選擇Sta ndard 方式進(jìn)行安裝圖 5 圖 5 選擇安裝模式4. 劃分分區(qū)下圖的信息是對(duì)將要進(jìn)行的分區(qū)操作的說明；直接回車進(jìn)入分區(qū)編輯界面Message In the next Menu, you hi 11 need to set up a DOS-sty l

12、e (fd isk11) part it ion ing scheMe for your hard disk. I f you s iMply wish to devote all disk space to FreeBSD (overwr it ing anything else that Might be on the d isk(s) selected) then use the (A ) 11 coMMand to se lect the defan It part it ion ing scheMe folloued by a (Q)li it. I f you Hish to a

13、1 locate oil ly free space to FreeBSD, Move to a part it ion Marked LiiiLised and use the (C Jreate coMMand.Message 圖 6 提示分區(qū)的幫助信息編輯分區(qū)使用的工具類似DOS下常用的Fdisk工具；如果計(jì)算機(jī)上沒有其它操作系 統(tǒng)，并且允許整個(gè)硬盤都用作安裝FreeBSD，則直接點(diǎn)擊鍵A自動(dòng)劃分分區(qū)； 注意：此操作將會(huì)改變磁盤的分區(qū)，可能會(huì)導(dǎo)致其它分區(qū)數(shù)據(jù)的全部丟失D isk naMe:DISK GeoMetr:JDISK Partition EditorOffset8322 cy l

14、s/16 lieads/63 sec tors8388576 sectors (4095MB)Size(ST)EndNaMe PTypeD isk naMe:DISK GeoMetr:JDISK Partition EditorOffset8322 cy ls/16 lieads/63 sec tors8388576 sectors (4095MB)Size(ST)EndNaMe PType083886088388607-12Desc Subtype F lagsunused0The fo1louing coMMands are supported (in upper or louer cas

15、e):A Use Ent ire DiskGset Drive GeoMetryC Create S1 iceF 15 DDJ ModeD Delete Slice2=Toggle Size UnitsS = Set Bootable! = Wizard m.T Change TypeUUndo All ChangesQ FinishUseFl or ? to getMorehelp, arrow kejs tose lect.圖 7 編輯分區(qū)點(diǎn)擊鍵A 后，分區(qū)工具自動(dòng)將整個(gè)磁盤劃分出一個(gè)分區(qū)（下圖中有三條記錄，第二 個(gè)是新劃分出的分區(qū)，第一個(gè)和第三個(gè)是預(yù)留未使用的空間）；再點(diǎn)擊鍵Q即可完 成

16、分區(qū)操作圖 8 自動(dòng)分區(qū)5. 安裝引導(dǎo)管理器分區(qū)完成后，進(jìn)行分區(qū)管理器的安裝；默認(rèn)選擇BootMgr回車即可FreeBSD coMes with a boot selector that a 1 lows you to easi ly se lect between FreeBSD andother operat ing systeMS on your Machineat boot t iMe. If ou have More than one drive and want to boot ftom the second one, the boot selector Hill also Mak

17、e it poss ib le to do so (1iMitat ions in the PC BIOS usua11 prevent this otherwise). If you do not want a boot selector, or Hish to replace an exist ing one, se lect standard. If you houId prefer our Master BootRecord to reMa in untouched then select None11.Insta 11 the FreeBSD Boot ManagerpootMgrB

18、t andard oneInsta 11 the FreeBSD Boot ManagerpootMgrBt andard oneInsta 11 a standard MBR (no boot Manager) Leave the Master Boot Record LintouchedK Press Fl to read about driue setup圖 9 安裝 Boot Manager6.劃分FreeBSD分區(qū)圖的信息是對(duì)將要進(jìn)行的分區(qū)操作的說明；直接回車進(jìn)入分區(qū)編輯界面Noh you need to create BSD par titi 011s inside of the

19、f d isk part i t ion (s) just created.and don J t have anj spec ia 1 requ ireMents , s inply use the (A )uto coMMand a 1 locate space autoMat ica11.are for the layout chosen by (A)uto, press Fl for More inforMat ion onIf ymi have a reasonab le amount of disk space (200MB orIf you haue More spec i f

20、ic needs or justMore) to don tManna 1 layout.圖10提示劃分FreeBSD分區(qū)劃分FreeBSD分區(qū)是在之前劃分的分區(qū)基礎(chǔ)上進(jìn)行的操作；直接點(diǎn)擊鍵A使用自動(dòng) 分區(qū)功能，程序會(huì)根據(jù)系統(tǒng)的硬件配置自動(dòng)劃分出最佳的分區(qū)方案圖11編輯FreeBSD的分區(qū)點(diǎn)擊鍵A后，程序會(huì)顯示出劃分分區(qū)的結(jié)果，如下圖; 再點(diǎn)擊鍵Q即可完成FreeBSD分區(qū)的劃分圖12自動(dòng)劃分FreeBSD分區(qū)7. 選擇安裝的內(nèi)容 劃分完FreeBSD分區(qū)后，需要選擇將要安裝的內(nèi)容；默認(rèn)最小安裝就可以，直接選擇Exit然后回車進(jìn)入下一步圖 13 選擇安裝內(nèi)容接下來選擇FreeBSD的安裝內(nèi)容的

21、位置，因?yàn)槲覀兪褂玫氖荂D,因此默認(rèn)選擇1CD/DVD，回車進(jìn)入下一步ChooseInsta1lat ionFreeBSD can be insta1 led ftom a variety of d i f ferent insta1lat ion Media, rang ing ftom f lopp ies to ail Internet FTP server. If jou ! re insta 11 ing FreeBSD ftom a supported CD/DUD dr iue then this is genera 1 ly the best Media to use i f

22、you have no overriding reason for using other Media.Insta1lat ionInstal1 froM a FreeBSD CD/DUDTPInsta11Instai 1ftom ail ftom ailei pta p N F F T oInsta11Insta11Insta11Insta11TPInsta11Instai 1ftom ail ftom ailei pta p N F F T oInsta11Insta11Insta11Insta11Insta11FTP server throughFTP server throughfro

23、M a DOS part it ion over NFSaf tom ail exist ing f i lesysteM ftom a floppy disk set ftom SCSI or QIC tapeGo to the Opt ions screenf irewa11 http prox】 Press Fl for More J.nforMation on the various Media types圖 14 選擇安裝介質(zhì)以上的安裝配置到這里就結(jié)束了，下面將進(jìn)行真正的安裝過程；此處程序給出了一User ConfirMaticm Requested個(gè)提示確認(rèn)，選擇Yes 回車后將進(jìn)

24、行文件拷貝和配置等操作系統(tǒng)的安裝操作User ConfirMaticm RequestedLast Chance! Are you SURE ycni want cont inue the insta1lat ion?If oli Jre running this on a disk with data you uish to save then HE STRONGLY ENCOURAGE YOU TO MAKE PROPER BACKUPS before proceeding!Ue can take no respons ib i 1 ity for lost disk contents!r

25、MYSEWlNo圖 15 提示安裝的配置完畢8. FreeBSD的安裝過程下圖為操作系統(tǒng)自動(dòng)安裝過程的進(jìn)度提示；需等待數(shù)分鐘圖 16 安裝過程Message安裝完畢后，系統(tǒng)會(huì)給出成功的提示信息，直接回車進(jìn)入系統(tǒng)配置頁(yè)面MessageCongratu lat ions! You non have FreeBSD insta lied oil ycnir systeM.Ue uill nou Move oil to the final conf igurat ion quest ions.For any opt ion you do not uish to conf igure, simply s

26、elect No.If yoLi wish to re-enter this utility after the systeM is up, you nny do so by typ ing : /usr/sb in/sys insta11.(100.)J K 1Press enter or space 1圖 17 提示安裝完畢9. 網(wǎng)絡(luò)的配置提示是否進(jìn)行網(wǎng)絡(luò)設(shè)備（網(wǎng)卡）的配置；選擇Yes 回車進(jìn)入下一步圖 18 提示是否配置網(wǎng)絡(luò)設(shè)備選擇需要配置的網(wǎng)卡，回車進(jìn)入下一步；一般情況下以太網(wǎng)卡列在最上面的位置，從每條記錄的描述信息最后的類型也可判斷出網(wǎng)卡的類型圖 19 選擇需要配置的網(wǎng)卡詢問是否啟用

27、IPv6；我們現(xiàn)有的網(wǎng)絡(luò)對(duì)IPv6的支持比較少，因此我們選擇默認(rèn)的No回車進(jìn)入下一步圖 20 詢問是否開啟 IPV6詢問是否在此網(wǎng)卡上開啟DHCP自動(dòng)獲取地址功能；因?yàn)椴杉骱蚗Log配合工作需要一個(gè)固定的IP,因此選擇No回車進(jìn)入下一步圖 21 詢問是否開啟 DHCP接著填寫網(wǎng)卡的相關(guān)配置信息；注意：網(wǎng)關(guān)和IP不要填寫反了，否則會(huì)導(dǎo)致網(wǎng)絡(luò)不通Host :1Interface lncBNetMask:Network Conf igurat ion DoMa in:IPv4 Gateway:Conf igurat ion forIPv4 Address:NaMe server:Extra opt

28、 ions to i fconf ig (usua 1 ly eMptu):圖 22 配置網(wǎng)卡信息詢問是否立即啟動(dòng)網(wǎng)卡；選擇Yes回車進(jìn)入下一步圖 23 詢問是否啟動(dòng)網(wǎng)卡詢問是否將本計(jì)算機(jī)作為網(wǎng)關(guān)；選擇No回車進(jìn)入下一步圖 24 詢問是否將本機(jī)器作為網(wǎng)關(guān)詢問是否配置inet和網(wǎng)絡(luò)服務(wù)；選擇No回車進(jìn)入下一步圖 25 詢問是否配置 inet 和網(wǎng)絡(luò)服務(wù)詢問是否使能SSH登錄功能；選擇No回車進(jìn)入下一步圖26詢問是否使能SSH登錄功能詢問是否允許FTP匿名訪問；選擇No回車進(jìn)入下一步圖27詢問是否允許FTP匿名訪問詢問是否將本機(jī)配置為NFS；選擇No回車進(jìn)入下一步圖 28 詢問是否將本機(jī)配置為 N

29、FS詢問是否將本機(jī)配置為NFS Clie nt；選擇No回車進(jìn)入下一步圖 29 詢問是否將本機(jī)配置為 NFS Client詢問是否自定義控制臺(tái)設(shè)置；選擇No回車進(jìn)入下一步圖 30 詢問是否自定義控制臺(tái)設(shè)置10. 時(shí)區(qū)的配置接下來配置計(jì)算機(jī)的時(shí)區(qū)；選擇Yes 回車進(jìn)入下一步圖 31 詢問是否設(shè)置本機(jī)時(shí)區(qū)詢問計(jì)算機(jī)時(shí)鐘是否為UTC時(shí)間；選擇No回車進(jìn)入下一步圖 32 詢問計(jì)算機(jī)時(shí)鐘是否為 UTC 時(shí)間首先選擇計(jì)算機(jī)所在時(shí)區(qū)所在的地區(qū)；因?yàn)橛?jì)算機(jī)所在的的時(shí)區(qū)是北京東八區(qū)，因此選擇5 Asia 回車進(jìn)入下一步圖 33 選擇地區(qū)接著選擇計(jì)算機(jī)所在時(shí)區(qū)所在的國(guó)家或地區(qū)；選擇9 China回車進(jìn)入下一步81

30、28123456-ina Countries in Asia Select a country or regionAfghan istanOrMen ia Azerba ijan BahrainBangladeshBhutanBrunei DarussalaMCaMbod iaCyprus Georgia Hong Kong India Indones ia IranIraqCancel團(tuán)圖 34 選擇國(guó)家或地區(qū)然后選擇計(jì)算機(jī)所在的時(shí)區(qū);選擇1 east China -Beijing,Guangdong, Shanghai,etc.回車進(jìn)入下一步圖 35 選擇時(shí)區(qū)詢問CST時(shí)區(qū)是否合理；選擇Y

31、es回車進(jìn)入下一步圖36詢問CST時(shí)區(qū)是否合理11.使能Linux兼容功能詢問是否使能與Linux兼容；選擇Yes安裝Linux兼容包圖37詢問是否使能與Linux兼容安裝Lin ux兼容包；需等待一到兩分鐘Adding packages/A11/1inux_base-8-8.0_6.tbz ftom acdB16107520 bytes read froM package 1inux_base-8-8.0_6 1239.0es/second圖38安裝Linux兼容包12. 安裝鼠標(biāo)詢問本系統(tǒng)是否安裝有鼠標(biāo)；本系統(tǒng)沒有安裝圖形界面，因此安裝鼠標(biāo)沒有太大意義，選擇No回車進(jìn)入下一步圖 39 詢問

32、是否安裝鼠標(biāo)13. 安裝其他包詢問是否安裝其他包；采集器的運(yùn)行不需要這些包的支持，直接選擇No進(jìn)入下 一步User Conf irMat ion RequestedThe FreeBSD package co 1lect ion is a co 1lect ion of thousands of ready-to-run app 1 icat ions, ftom text ed itors to gaMes to NEB servers and More. Nou Id you 1 ike to browse the co 1 lect ion now?User Conf irMat ion

33、 RequestedYes圖 40 詢問是否安裝其它包14. 用戶和密碼等的配置詢問是否增加初始的用戶；選擇Yes 回車進(jìn)入下一步圖 41 詢問是否增加用戶選擇User選項(xiàng)回車進(jìn)入下一步圖 42 增加用戶填寫用戶信息，完畢后回車進(jìn)入下一步Group:Login she 11:Full naMe:Login ID:MeMber groups:HoMe directory:Group:Login she 11:Full naMe:Login ID:MeMber groups:HoMe directory: you are happy kiith these sett ings圖 43 填寫用戶信息

34、提示必須設(shè)置系統(tǒng)管理員的密碼；回車進(jìn)入下一步圖 44 提示必須設(shè)置系統(tǒng)管理員的密碼設(shè)置系統(tǒng)管理員的密碼；回車進(jìn)入下一步New Password:I圖 45 設(shè)置系統(tǒng)管理員的密碼再次重復(fù)輸入系統(tǒng)管理員的密碼；回車進(jìn)入下一步Password:Retype Neu Password:|圖 46 確認(rèn)系統(tǒng)管理員的密碼15. 最后確認(rèn)提示是否查看并修改配置；選擇No回車進(jìn)入下一步圖 47 提示是否查看配置安裝完畢回到初始安裝界面；選擇Exit In stall回車退出安裝程序圖 48 安裝完畢回到初始安裝界面提示是否退出；選擇Yes 回車，系統(tǒng)會(huì)自動(dòng)重新引導(dǎo)；至此FreeBSD操作系統(tǒng)的安裝成功完成圖

35、49 提示是否退出16.啟動(dòng)FreeBSD系統(tǒng)自動(dòng)引導(dǎo)到下圖界面；直接回車進(jìn)入下一步Fl FreeBSDDefault: Fl圖 50 引導(dǎo) FreeBSD界面上顯示了八種啟動(dòng)方式；默認(rèn)回車即會(huì)開始啟動(dòng)FreeBSDIcoMeto FreeBSD!12345678BootBootBootBootBootIcoMeto FreeBSD!12345678BootBootBootBootBootFreeBSD FreeBSD FreeBSD FreeBSD FreeBSDdefault with ACPI disabled in Safe Mode in single user Mode with

36、verbose loggingEscape to loader proMptBoot FreeBSD with USB keyboard RebootSelect opt ion, Enter for defau It or Space to pause t iMer 5圖 51 選擇啟動(dòng)方式顯示登錄界面時(shí)表示FreeBSD系統(tǒng)啟動(dòng)成功inetB :1 pref ixlen 128inetG f e80 : : 1. Io0 pref ixlen 64 scope id 0 x3add net default: gateway Add it iona1 rout ing opt ions:.S

37、tart ing devd.Mount ing NFS file sstEns：.Start ing syslogd.ELF ldconf ig path: /lib /usr/1ib /usr/1ib/coMpat /usr/loca1/1ib a.out ldconf ig path: /usr/ 1 ib/aout /usr/1ib/coMpat/aout Start ing usbd.Start ing loca1 daeMons:.Updat ing Motd.Conf igur ing sysblankt iMe.Initial 1386 initializat ionRdd it

38、 iona1 AB I support: 1inux.Start ing cron.Loca1 package initializat ion：.fiddit ional TCP opt ions:.Start ing background file systeM checks in 60 seconds.Tue Oct 31 20:27:03 CST 2006FreeBSD/1386 (Probe.XLog)log in :.圖 52 FreeBSD 啟動(dòng)成功輸入正確的用戶名和密碼回車后登錄系統(tǒng)FreeBSD 5.4RELEASE (GENERIC) #0： Sun8 10:21:06 UT

39、C 2005UeIcomg to FreeBSD!Before seeking techn ica1 support, please use the fo1louing resources:o Security advisories and updated errata inforMat ion for all releases are at http：/hhh. FreeBSD.org/releases/ - aluajs consuIt the ERRATA sect ion for ycjLir release f irst as it !s updated frequent ly.o

40、The Handbook and FAQ docuMents are at http：/hhw. FreeBSD. org/ and, a long with the Mailing 1ists, can be searched by go ing to http：/hhh.FreeBSD.org/search/. If the doc d istr ibut ion has been insta1 led, they!re also aualiable forMatted in /usr/share/doc.If you still haue a quest ion or probleM,

41、p lease take the output of uiiaMe -aJ , along with any re leuant error Messages, and eMail it as a quest ion to the quest HYPERLINK mailto:ionsFreeBSD.org ionsFreeBSD.org Mailing list. If yuii are LinfaMiliar with FreeBSD 5 s d irector layout, p lease refer to the h ier(7 ) Manua 1 page. I f you are

42、 not faMi 1 iar with Manua 1 pages, type 11 Man Man J .Youalso use sys insta 11(8) to re-enter the insta1 lat ion andconf igurat ion utility. Edit /etc/Motd to change this login announceMent.Probe# K圖 53 成功登錄 FreeBSD2.2.3 安裝采集器掛載光盤驅(qū)動(dòng)器將采集器的光盤放入光驅(qū)，然后使用“mount /cdrom”命令掛載上光驅(qū)peIcoMe to FreeBSD!Before see

43、k ing teclni ica1 support, please use the fo1loHing resources :0 SecLir ity advisor ies and updated errata inforMat ion for all re leases are at http：/hhh.FreeBSD.org/releases/ - always consult the ERRRTR sect ion for your re lease f irst as its updated frequently.0 The Handbook and FAQ docuMents ar

44、e at HYPERLINK http:/hhh.FreeBSD.org/ http:/hhh.FreeBSD.org/ and, a long with the Mailing lists, can be searched by go ing to http：/hhh.FreeBSD.org/search/. If the doc d istr ibut ion has been i lista lied, they ! re also aualiable forMatted in /usr/share/doc.If you still have a quest ion or probleM

45、, p lease take the output of r LinaMe -a! , along with any relevant error Messages, and EMail it a quest ion to the quest HYPERLINK mailto:ionsFreeBSD.org ionsFreeBSD.org Mailing list. If you are .inf aMi liar with FreeBSD ! s d irectory layout, p lease refer to the h ier (7 ) aiiLia 1 page. I f you

46、 are not f aMi 1 iar with Manna 1 pages, type 11 Mail MailJ .Y(ni May also use sys i list a 11(8) to re-enter the i list a 1 lat ion and conf igurat ion utility. Ed it /etc/Motd to change this login aniioLiiiceMeiit.robe# Mount /cdroMProbE圖 54 掛載光盤驅(qū)動(dòng)器進(jìn)入采集器程序目錄使用“cd /cdrom/h3cprobe”命令進(jìn)入采集器程序所在的目錄；并用“

47、Is”命令列出文件列表Before seek ing teclni ica 1 support, p lease use the fo1loHing resources :o SecLir ity advisor ies and updated errata inforMat ion for all re leases are at http：/hhh.FreeBSD.org/releases/ - always consult the ERRRTR sect ion for your re lease f irst as its updated frequent ly.o The Handb

48、ook and FAQ docuMents are at HYPERLINK http:/hhh.FreeBSD.org/ http:/hhh.FreeBSD.org/ and, along with the Mailing lists, can be searched by going to http ： /hhh. FreeBSD, org/searcli/. I f the doc d istr ibut ion lias been instalied, they!re also aualiable forMatted in /usr/share/doc.If you still hau

49、e a quest ion or probleM, p lease take the output of(LinaMe -a5 , along with any relevant error Messages, and EMail it as a quest ion to the quest HYPERLINK mailto:ionsFreeBSD.org ionsFreeBSD.org Mailing list. If you are LinfaMiliar with FreeBSD!s d irectory layout, p lease refer to the h ier(7 ) Ma

50、nna 1 page. I f you are not f aMi 1 iar with Manna 1 pages, type 11 Mail MailJ .You May also use sys insta11(8) to re-enter the insta1lat ion andconf igurat ion utility. Ed it /etc/Motd to change this login aniioLiiiceMeiit.Probe# Mount /cdroM/Probe# cd /cdroM/h3cprobe/Probe# Isprobe . tar . gzprobe

51、_installer.siProbe# 圖 55 進(jìn)入采集器程序目錄查看網(wǎng)卡的信息使用“ ifco nfig ”查看FreeBSD系統(tǒng)下網(wǎng)卡的名字，后面安裝采集器時(shí)會(huì)用到Manua 1 page. I f you are not faMi liar with Manna 1 pages, type Mail Man .You Mey also use spsinsta11(8) to re-enter the insta1lat ion andconf igurat ion utility. Edit /etc/Motd to change this login announceMent.Yo

52、u haue neu Mail.Probe# Mount /cdroM/Probe# cd /cdroM/h3cprobe/Probe# Isprobe. tar . gzprobe_installer.sliProbe# i fconf ig111C0： flags=128943 Mtu 1500 inet 5 netMask 0 xffffff00 broadcast 55 inetG fe80:20c：29f f：fe9d:5920%lnc0 pref ixlen 64 scope id 0 x1 ether 00：0c：29：9d：59：20lncl： flags=108843 Mtu

53、 1500inet 2 lietMask 0 xffffff00 broadcast 55 inet6 fe80 : : 20c ： 29f f ： fe9d : 592a. lncl pref ixlen 64 scope id 0 x2 ether 00：0c：29：9d：59：2aplip0: flags = 108810 Mtu 1500 lo0： flags=8049 Mtu 16384 inet lietMask 0 xff000000inet6 :1 pref ixlen 128 iiietB f e80 : : 1. Io0 pref ixlen 64 scope id 0 x

54、4Probe# I圖 56 確認(rèn)網(wǎng)卡信息4. 安裝采集器使用命令“./probenstaller.sh ”執(zhí)行采集器程序的安裝腳本，進(jìn)入下圖界面；需要輸入采集器的安裝路徑，直接回車默認(rèn)即可You have new Mail.Probe# Mount /cdroM/Probe# cd ZcdroM/h3cprobe/Probe# Isprobe.tar.gzprobe_insta1ler.shProbe# ifconfiglnc0： flags-128943 Mtu 1500 inet 5 netMask 0 xffffff00 broadcast 55 inetB fe80 : ：20c ：2

55、9f f ： fe9d ：5920.1nc0 pref ixlen 64 scope id 0 x1 ether 00：0c：29：9d：59：20lncl： flags=108843 Mtu 1500inet 2 netMask 0 xffffff00 broadcast 55 inet6 fe80 : ：20c ：29f f ： fe9d ：592a.lncl pref ixlen 64 scopeid 0 x2 ether 00：0c：29：9d：59：2aplipQ： flags=108810 Mtu 1500 lo0： flags=8049 Mtu 16384 inet lietMa

56、sk 0 xf f000000inetB :1 pref ixlen 128inetB f e80 : : 1. Io0 pref ixlen B4 scopeid 0 x4Probe# /probe_insta1ler.shTh is script ui11 insta11 probe,beginningPlease input insta 11 path default:Zusr/loca1/xlog/1：|圖 57 執(zhí)行安裝腳本文件拷貝完畢后，需輸入上面步驟查詢到的網(wǎng)卡名稱；注意：網(wǎng)卡名必須輸入正確，否則可能會(huì)導(dǎo)致采集器采集不到數(shù)據(jù)1O0: flags=8049 Mtu 16384 in

57、et lietMask 0 xf f000000inetB :1 pref ixlen 128 inetB f e80 : : 1. Io0 pref ixlen B4 scope id 0 x4 Probe# ./probe_insta1ler.shTh is script ui11 insta11 probe,beginningPlease input insta11 path default:Zusr/loca1/xlog/1:x binx b in/Mon itorx bin/probex b in/prbkern.kox confx conf/spsprobe.xmIx conf/s

58、ysMonitor.xmIx 1 ibx 1 ib/1ibACEXML_Parser.so.5.4.0 x 1 ib/1ibACEXML_Parser.sox lib/libACEXML.so.5.4.0 x lib/libACEXML.sox 1 ib/1ibRCE.so.5.4.0 x lib/libACE.soP lease input network interface naMe for rece iuing package:|圖 58 拷貝文件并等待輸入網(wǎng)卡名輸入監(jiān)聽網(wǎng)卡名，根據(jù)提示可以輸入多個(gè)（性能關(guān)系，最多可輸入四個(gè)網(wǎng)卡名）inet lietMask 0 xf f000000in

59、etB :1 pref ixlen 128inetb f e80 : : 1. Io0 pref ixlen B4 scope id 0 x4Probe# ./probe_insta1ler.shTh is script ui11 insta 11 probe,beginningPlease input insta11 path default:Zusr/loca1/xlog/1:x binx b in/Mon itorx b in/probex b in/prbkern.kox confx conf/sysprobe.xmIx confZssMonitor.xmIx 1 ibx 1 ib/1

60、ibRCEXML_Parser.so.5.4.0 x 1 ib/1ibACEXML_Parser.sox lib/libACEXML.so.5.4.0 x lib/libACEXML.sox 1ib/1ibACE.so.5.4.0 x lib/libACE.soPlease input network interface naMe for receiving package:Incl Do you want to input another interface naMe?J : |圖 59 輸入監(jiān)聽網(wǎng)卡名輸入完網(wǎng)卡名后，在提示是否輸入其他網(wǎng)卡名時(shí)輸入“n”即完成了采集器的安裝This scri