Back to files

Hi!

Welcome to brick accounting. This software helps you account even large amounts of log files which your favourite bintec router might spew out. As another option it can scan mail log files to bill according to mail address. This feature is beta and not thoroughly tested though. It's disabled by default. And you won't find much docs about it, read the bugs section for more!

COPYRIGHT

This software was written by John and Kevin Read (<john.read@newnet-marketing.de> and <kevin.read@innnet.de>). It is licensed under the GPL. See the file COPYING in this distribution for more information on this subject.

DISTRIBUTION AND CONTACT

The main distribution site for this package is http://www.obsidian.de/software, but you can always look for brickacct on freshmeat for more.
The primary contact for this software is me, Kevin Read <kread@innnet.de>. You can pester John if you like but he's very busy, so he'll let you wait. :-)

REQUIREMENTS

If you only want Brick logfile accounting and the Web and plaintext output backends, you only need a C++ compiler, g++ or egcs will do nicely. If you want to use mail accounting or the MySQL output backend, you will need MySQL installed. See the file INSTALL for more. You'll need some memory. If you can come up with figures of how much logfile needs how much memory, I'd be glad.
Disk space requirements are small.

BUGS

I'm no pessimist but I'll start with the bugs section anyhow :-) This software is released as-is and was developed to suit specific needs the firm I work for (InnNet GmbH in Germany). As a result of this you'll have to live with some restrictions until I get around to fix them.

*The limitation of the previous version which dictated that an internal network and a proxy always have to be defined is gone. But I'm not totally sure whats happending now if theys aren't configured. I took an address of 0.0.0.0 with a netmask of 255.255.255.255 as default, actually it should not mess up your accounting :-)
Please try it and tell me how it behaves!

*the syntax of the config file is somewhat strange. This could be easily updated. I made it a bit more sane as it complains a bit smarter now :-) Mail me your comments and wishes...

*mail accounting is considered beta. I hope I get around to fix this, it is highly interesting code that I couldn't find anywhere on the web for free. If you want to use it, I recommend reading the code, it is well documented.

*even worse than its beta state is the lack of documentation with mail accounting... HELP! (This is a bit better now)

*I should decide which language to use real soon now :-)

DISCLAIMER

I don't guarantee anything. Your boss might decide to learn Win-Tsung to screw your head of if you use this and it pukes. But OTOH we used it here quite successfully to run the accounting at our ISP for about one year.

BEGINNERS GUIDE :-)

Brickacct takes the raw log file (I hope you redirected the logging of your bintec router into syslog and then configured syslog to save it to a seperate file - see below for more) and scans it according to rules you give it in a config file, commonly named brickacct.cfg (it searches for this file in the current working dir).
There is a sample brickacct.cfg included which you can use to start.

You can account for IPs or nets (groups of IPs conforming to CIR). Every IP address belongs to an owner, though multiple IPs can share one owner or PPP dialins, which are accounted automagically. Lets take an example:

user coocoo ip 192.168.1.1

user bigcustomer ip 192.168.2.1
user bigcustomer ip 192.168.2.2
user bigcustomer ip 192.168.2.3

Now you can differentiate between services on these machines too:

user coocoo ip 192.168.1.1
user coocoo port 80 name coocoo-webserver user coocoo port 53 name coocoo-dns

and so so.

Now come the real specials:

*You can specify internal IPs/networks that should not be accounted. Ie: you only want to take money from customers if they produce traffic that goes out to the Internet, not for going on to your internal networks. Syntax:

network domain myprovider.com mask 192.168.3.0

The netmask has to be specified on an extra line:

network bitmask 255.255.255.0

*You can specify special IP/port combinations that should be accounted even if they lie in the network you specified above as not-accountable. Good if you have proxies which your customers can use and you want to account that traffic. Syntax:

network server web-proxy.myprovider.com address 192.168.3.1

And the port goes on the next line:

network proxy 8080

PS: I know that syntax distributing stuff over many line makes combinations somehow strange. I'll fix it someday :-)

SO WHAT DOES IT DO?

It takes source and destination IP adresses from the brick log file and accounts them on these entries you specify in the config file. You can tell it to start or end the accountin on specific months, so you bill your customers for every month!

This data can be written to several backends. On is plain text, which just outputs a nice plain text file which you can then enjoy on your term. Or it can write a HTML page which your customers can view online. The third possibility is to let it write to a SQL db (limited to MySQL atm) which will give you nice possibilities to account with kinky spreadsheets and the like.

The layout of this db is as follows:

DB
|
+ table transfer
|
+-login (char 40) = username. ppp login name or the name you specified | in the config file for this IP/network. |
+-transferl (int) = internal transfer for this user in octets |
+-transere (int) = external (=pay) transfer for this user in octets |
+-zeit (int) = online time in seconds |
+-fertig (bool) = if this month is closed. Used for accounting between | months to get a first picture of the situation :-) |
+-transferg (int) = internal + external transfer |
+-monat (int) = number of month
|
+-jahr (int) = number of year

A script to create this db is included. The db is usually called ispacct. To use this script to create the tables just do a:

cat create_db.dump | mysql DBNAME

where DBNAME is the name of your db. If you have to use a passwd (which usually is the case, I guess) you rather use:

cat create_db.dump | mysql --password=YOURPASSWORDHERE DBNAME

I advise you to logout then, log back in and then rm the .bash_history in your home dir. Then log back out and in again and double check that this line containing your passwd doesn't come back when you scroll back in your history...

CALLING THE PROGRAM

For the german readers:
Fuer die deutschen Leser: die englische Syntax weiter unten ist besser dokumentiert. Sorry, Zeitmangel!

(the Mail and SQL functionality might not appear if you compiled the stuff without the flags)...

innacct [-s nnn] [-e nnn] [-v] [-V] [-c xxxx] [-f xxxx] -m -b

-s 1(Jan) bis 12(Dez). Default: 0
-e 1(Jan) bis 12(Dez). Default: 0
-p Zeile pro Blatt. Default: 72
-d xxxx Liste alle Records von Benutzer xxxx, stderr -v Logging-Information: stderr
-V Noch mehr Logging-Informationen: stderr -S Ergebnisse in Tabelle einfuegen
-w Report im WWW-Format (html-Format) -b Brick-Logfile NICHT bearbeiten
-m Mail-Logfile NICHT bearbeiten
-x xxxxx Nodename für SQL-Benutzerdaten -c Konfigurationsdatei. Default: innacct.cfg -f Accounting-Datei. Default: brick
-M für SQL; gibt Moant an, der in Tabelle soll.

Web-Report hat gegenueber dem SQL-Report Vorrang

English translation:

innacct [-s nnn] [-e nnn] [-v] [-V] [-c xxxx] [-f xxxx] -m -b

-s 1(Jan) to 12(Dec). Default: 0 Starting month -e 1(Jan) to 12(Dec). Default: 0 Ending month -p rows per page. Default: 72 (only for text accounting?) -d xxxx List all records for user xxxx on stderr (debugging) -v Logging informations on stderr (debugging) -V Still more logging informations on stderr (HUGE debugging output) -S Write data into SQL table
-w Output data as HTML
-b Don't account brick log file, only mail (if activated with -m) -m Account mail log file (BETA atm). Looks for a file named mail -x xxxxx Hostname to contact to MySQL for accounting output (if activated with -S) or for mail accounting -c Configuration file to read. Default: brickacct.cfg -f File to open to get to logging from the router. Default: brick -M xxx gives the numerical month to write in the SQL table, as this doesn't work automagically atm

If you don't specify any output flags, textual output will be generated. If you specify both SQL and web output, web output will be generated

Example

./brickacct

will look for a file called brick, account this data according to configuration directives given in brickacct.conf in the current working directory and provide textual output on standard output.

./brickacct -s Jan -e Mar -c /etc/brickconfig -f /var/log/brick -w > acct.html

will look in /etc/brickconfig for configuration data, open the file /var/log/brick and account the log data therein (but only entries from January, February and March) and output this info in html which will be dumped to acct.html

./brickacct -s Dec -e Dec -S -x sqlserver.mycompany.com -M 12

will account data from December only and output this stuff into the db called acct on host sqlserver.mycompany.com (using the credentials supplied in brickacct.cc on line 600 - HACK WARNING). It will write the month number 12 in the db (=december), as this isn't automatically detected by the program atm.

STRUCTURING THE LOGFILES COMING FROM THE ROUTER

I suggest putting the following into your /etc/syslog.conf

local7.* -/var/log/brick

You have to specify local7 (or any other local* facilty you want to use) in the System/External System Logging entry in your brick setup. This will cause all log entries coming from the brick to disappear in the file /var/log/brick (the - symbol causes the syslogd to buffer output to this file, increasing performance).

CODE OVERVIEW

There are only 3 parts ATM:

brickacct.cc: The main file. The output backends sit here, and the brick input

backend is located here, too.

brickdbase.cc: Internal data handling functions. Here all data that is

                accumulated while processing logs is managed. There are
                functions that look up stuff for mail accounting in here,
                too.

mailacct.cc: The still-beta mail accounting functions.

ENJOY

Just do it :-)

Greetings to John, the big master coder. Cudos to de.comp.internet.routing, where on can learn all one needs to know to become involved in IPv* by lurking :-)

ANY SUGGESTIONS AND UPDATES ARE WELCOME!!!

Kevin Read <kread@innnet.de>