Monitoring with Raspberry Pi

Pandora FMS Satellite Server can be installed on devices with ARM architecture and an operating system equivalent to or higher than Debian 12.

Download the ARM installation package from here and upload it to the ARM device (we will use the /tmp directory as an example for installation).

Go to the directory where you uploaded the package:

cd /tmp

Uncompress the installation package:

tar zxvf pandorafms_satellite_server-latest.arm.tar.gz

Go to the directory generated by the decompression:

cd satellite_server

Run the installation script:

./satellite_server_installer --install

If you want to install it in a custom path other than the default one, you can indicate that path with this command instead of the previous one. For example, to install in /opt/pandorafms:

./satellite_server_installer --install --destdir /opt/pandorafms

Its operation is based on the use of several components:

• A NetFlow compatible device, usually network hardware like a switch or router, that generates information packets or a NetFlow probe.
• A NetFlow collector, which receives the packets generated by the previous device, storing and processing them. It is usually a tool or server with these capabilities.

Pandora FMS uses an OpenSource tool called nfcapd to process all NetFlow traffic. This daemon is automatically started by the Pandora FMS Server. This system stores data in binary files in a specific location. nfcapd must be installed on the system before being able to work with NetFlow in Pandora FMS. The default nfcapd daemon listens on port 9995/UDP, so it must be taken into account if you have firewalls to open this port and configure NetFlow probes.

If you do not have a router with built-in NetFlow but traffic “passes” through a Linux® system, you can install software that acts as a probe and sends NetFlow traffic information to the collector. In Linux, there is a program called fprobe that captures traffic and forwards it to a NetFlow server. With it, NetFlow traffic can be generated from all network traffic passing through its interfaces.

First, fprobe must be installed:

apt-get install fprobe

At the time of installation, it will ask which interface you need to monitor and to which IP address and port number to send the collected information. It can be reconfigured at any time with:

/usr/sbin/fprobe -i <interface_to_watch> -fip <ip_address_collector>:<port>

In the following model, all traffic from the eth0 interface will be sent to the NetFlow collector listening on port 9995 of the IP address 192.168.70.185:

/usr/sbin/fprobe -i eth0 -fip 192.168.70.185:9995

Once traffic is generated, you can see statistics of this traffic in the NetFlow collector with the command:

nfdump -R /var/spool/pandora/data_in/netflow

NetFlow must be enabled to be accessible from the Operation and Administration menus: Enable NetFlow.

Once NetFlow is configured, Pandora FMS Server must be restarted to start the nfcapd server. This must be correctly installed before attempting to start it. Check the server logs if you have any doubts.

←Back to Pandora FMS documentation index