7) Observabilité & Monitoring

! Cisco IOS-XE — SNMPv3 (extrait)
snmp-server group NETOPS v3 priv read CORE write CORE
snmp-server user ops NETOPS v3 auth sha MonSecret priv aes 128 MonSecret2
snmp-server view CORE iso included
snmp-server host 10.0.0.10 version 3 priv ops
! ACL source (mngt only)
snmp-server community public RO 99
access-list 99 permit 10.0.0.0 0.0.0.255

# net-snmp (Linux) — /etc/snmp/snmpd.conf
agentAddress udp:161
createUser ops SHA "MonSecret" AES "MonSecret2"
rouser ops authPriv
view all included .1

# Prometheus — snmp_exporter (profil minimal)
modules:
  if_mib:
    walk: [ sysUpTime, ifName, ifHCInOctets, ifHCOutOctets, ifOperStatus ]
    version: 2

! Cisco IOS — NetFlow v9
ip flow-export destination 10.0.0.20 2055
ip flow-export version 9
interface TenGig1/0/1
 ip flow ingress
 ip flow egress

# Arista — sFlow (extrait)
sflow enable
sflow agent-ip 10.0.0.11
sflow destination 10.0.0.20 6343
sflow sample 1 out of 1000
sflow polling-interval 30

# nfdump (NetFlow/IPFIX)
nfcapd -D -l /var/log/flows -p 2055
nfdump -r /var/log/flows/nfcapd.* -s ip/bytes -n 20
nfdump -r ... 'port 443 and dst net 10.10.0.0/16'

# pmacct -> Influx/TSDB
plugins: nfprobe, print
aggregate: src_host, dst_host, src_port, dst_port, proto, tos
influxdb_db: flows

• Top talkers/ports, latéralité (east-west), détection DDoS (volumétrie & SYN flood).
• Cartographie applicative (5-tuples) : dépendances & chemins réseau.

# Débit NIC (bits/s)
rate(node_network_receive_bytes_total{device!="lo"}[5m]) * 8
# Pertes p95 HTTP
histogram_quantile(0.95, sum by (le) (rate(http_request_duration_seconds_bucket[5m])))
# Erreurs interface (top 10)
topk(10, rate(node_network_receive_errs_total[5m]) + rate(node_network_transmit_errs_total[5m]))
# Taux de succès blackbox
avg_over_time(probe_success[10m]) * 100

# prometheus.yml — remote_write (ex: Thanos/Victoria)
remote_write:
- url: http://thanos-receive:19291/api/v1/receive
  send_exemplars: true
# Federation : agréger métriques globales + garder locaux pour détail

# alert_rules.yml — burn rate (multi-window)
groups:
- name: slo
  rules:
  - alert: ErrorBudgetBurnFast
    expr: (rate(http_requests_errors_total[5m]) / rate(http_requests_total[5m])) > (14.4 * 0.001)
    for: 10m
    labels: {severity: "critical"}
    annotations: {summary: "Burn rate élevé (5m) pour SLO 99.9%"}

# Alerting unifié (concept)
- Contact points: Slack, PagerDuty, Email
- Policies: severity routes + Mute Times (maintenance)
- Silences avec tags (env=preprod)

# promtail (→ Loki)
server: { http_listen_port: 9080 }
clients: [{ url: http://loki:3100/loki/api/v1/push }]
scrape_configs:
- job_name: syslog
  syslog:
    listen_address: 0.0.0.0:1514
    labels: { job: "syslog" }

# OpenTelemetry Collector (extrait)
receivers: { otlp: { protocols: { http:, grpc: } } }
exporters: { otlp: { endpoint: tempo:4317 }, prometheus: { endpoint: 0.0.0.0:9464 } }
service:
  pipelines:
    traces: { receivers: [otlp], exporters: [otlp] }
    metrics:{ receivers: [otlp], exporters: [prometheus] }

• Indices « chaud/tiède/froid » + ILM (rollover, delete) pour coûts.
• Réduction cardinalité labels; compresser JSON; sampling traces.

# tcpdump ciblé + capture
tcpdump -ni any tcp port 443 -w ssl.pcap
tcpdump -i eth0 -vvv -s 0 -XX "tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack = 0"
# tshark extraire colonnes
tshark -r trace.pcap -Y "http.response" -T fields -e ip.src -e ip.dst -e http.response.code | head

# tcptrack — flux live (en root)
tcptrack -i eth0

# bpftrace — exemples
bpftrace -e 'kprobe:tcp_v4_connect { @[comm] = count(); }'
bpftrace -e 'tracepoint:net:netif_receive_skb { @[cpu] = count(); }'

// k6 — dispo & latence
import http from "k6/http"; import { sleep } from "k6";
export default function(){ const r=http.get("https://www.example.com/"); if(r.status!==200) throw new Error("KO"); sleep(1); }

<script>
// RUM Core Web Vitals minimal
new PerformanceObserver((list)=>{
  for (const e of list.getEntries()) navigator.sendBeacon("/rum", JSON.stringify({name:e.name,value:e.value}));
}).observe({type:"largest-contentful-paint", buffered:true});
</script>

# mtr — traceroute continu
mtr -rwzc 100 www.example.com

# SLO 99.9% → budget d'erreur ≈ 43 min / 30j
# Alerte multi-fenêtres : 5m & 1h (rapide), 6h & 24h (lente)

# Runbook — « Site lent »
1) Vérifier probes (HTTP/ICMP) multi-sites & PoPs CDN
2) TTFB / p95 en hausse ? vérifier origin/LB/WAF
3) Saturation NIC/CPU sur LB/origin (Prometheus)
4) Règles WAF/bot récentes ? (Grafana + logs)
5) Rollback dernier déploiement; post-mortem (5 whys)

# Nagios — check simple
define host{ use linux-server; host_name edge1; address 10.0.0.11 }
define service{ use generic-service; host_name edge1; service_description PING; check_command check_ping!100.0,20%!500.0,60% }

# Zabbix — auto-discovery réseau (idée)
- Découvrir équipements via SNMPv3 + appliquer templates (interfaces, CPU, Temp)
- Cartes dynamiques + dépendances services

# LibreNMS — découverte
./discovery.php -h all
./poller.php -h all
# Alertes via règles + templates de notification (Slack/Email)

# NetBox — modéliser sites/racks/équipements/liaisons
# API pour alimenter monitoring & discovery (source de vérité)

# Oxidized/RANCID — backup & diff config
oxidized
# Règles de conformité (ban IP publics sur mgmt, bannir telnet, bannir SNMPv2c prod)

# 95e percentile: trier les samples 5min, enlever 5% plus hauts, prendre max restant
# Lissage: moving average 7j; saisonnalité: week-ends vs jours ouvrés

# Coûts: transit, interconnexions, stockage logs/metrics
# Optimisations: sampling flows, ILM indices logs, recording rules (Prometheus)

# Zeek — logs riches (conn, dns, http, ssl)
# Couplage avec Grafana/Loki pour requêtes rapides

# Corréler: Flow volumétrique + alert IDS + logs firewall
# Détection lateral movement: spikes SMB/RDP, authent échecs, DNS anormal

# Pipeline type
[Network Device] --gNMI--> [Collector] --Kafka--> [Processors] --> [TSDB/OLAP/SIEM]

# eBPF — compteurs précis & hooks kernel
bpftool prog show
bpftrace -e 'kprobe:ip_rcv { @[pid] = count(); }'
# xDP — drop/redirect très basse latence (driver)