427 Botnet fm qxd

Table 6.3
Ourmon Directory Guide 
directory/filename
notes
INSTALL
install howto file
configure.pl
ourmon configure script—run to build, install
bin
executables including shellscripts—installed by
configure.pl
bin/ourmon
the probe executable
bin/ourmon.sh
the shellscript wrapper that starts/stops the
probe
bin/omupdate.sh
the shellscript wrapper that runs the graphics
engine 
bin/omupdate.pl
the most important back-end script—there are
others
etc/ourmon.conf
probe configuration and input file
logs/*
non-RRDtool ASCII log directories (lots of
them)
logs/portreport
TCP port report logs—will look at this in later
chapter
rrddata
RRDtool log directory
rrddata/ourmon.log
RRDtool error output file—look here if RRD
problems
web.pages
symbolic link to ourmon Web browser data
directory
web.pages/index.html
main ourmon html file—installed by con-
figure.pl
web.pages/info.html
ourmon help—refer to this for detailed info
on output and configuration
src/ourmon
ourmon probe source—note Makefile for
BSD/Linux
src/web.code
ourmon back-end scripts
src/web.pages
ourmon-supplied static html pages—installed
by 
configure.pl
www.syngress.com
Ourmon: Overview and Installation • Chapter 6
233
427_Botnet_06.qxd 1/8/07 3:14 PM Page 233

---

W
ARNING
In addition to the above important files and directories contained
within the ourmon directory subsystem, there are some external direc-
tories. For example, depending on the local Apache Web server setup,
you might have an external directory like /var/www/htdocs/ for
graphics-engine-generated data files to be put on the Web. You need
to know the name of the external data directory for Web files before
you run 
configure.pl
. The system data directory for Apache servers is
different from installation to installation. Refer to the Apache docu-
mentation for more information. You can find Apache at
www.apache.org.
Let us first talk about system dependencies.This means those libraries or
facilities assumed by the underlying ourmon system. Because ourmon is an
open-source system, we don’t install binaries. We give you the source code,
and therefore a C compiler and Perl are understood as system components. In
addition, there are four pieces of software that the open-source ourmon
system assumes are available.Three of them need to be installed 
before
you run
configure.pl
.The important system dependencies are:
■
A Web server. Installation of a Web server is necessary and we recom-
mend Apache (www.apache.org).
■
libpcap.a.This is needed by the probe.Typically, this isn’t a problem,
but if it is, download and install it from www.tcpdump.org.
Unfortunately, some UNIX distributions have an old version of
libpcap. If you run the probe the first time, and it exits and complains
about parsing errors in the supplied ourmon.conf BPF expressions,
then you need to download your own version of libpcap and 
install it.
■
libpcre.a.This is also needed by the probe for pattern-matching tags.
Often libpcre.a is installed in /usr/local/lib (or /usr/lib).The main Web
site for it is: www.pcre.org. A port for it exists on FreeBSD in /usr/
ports/devel/pcre. On ubuntu Linux this command should install it:
# apt-get install libpcre3