Multiple sniffer instancies: Difference between revisions

From VoIPmonitor.org
(Add use case: Multiple receiver instances for preventing CDR merging)
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
=How to start more sniffer instancies in a single host=
=How to Run Multiple Sniffer Instances on a Single Host=
is can be necessary to distinct between calls when these came via more network interfaces (via which network interface the call arrived by)
[[Category:Configuration]]


If a single instance is runing ok there - you can add manually second instance by a following way:  
Running multiple VoIPmonitor sniffer instances on a single host allows you to:
== copy of a binary==
* Monitor multiple PBX systems via separate network interfaces
cp -a /usr/local/sbin/voipmonitor /usr/local/sbin/voipmon2
* Assign different <code>id_sensor</code> values for licensing or organizational purposes
* Use separate storage paths (<code>spooldir</code>) for each instance
* '''Prevent CDR merging from multiple sensors in packet mirroring mode''' (see below)


== copy the init script and modify it to control voipmon2==
<kroki lang="mermaid">
cp /etc/init.d/voipmonitor /etc/init.d/voipmonitor/voipmon2
%%{init: {'flowchart': {'nodeSpacing': 15, 'rankSpacing': 30}}}%%
vim /etc/init.d/voipmonitor/voipmon2
flowchart TB
In vim you can use ":%s/voipmonitor/voipmon2/gcc" as a command to change all '''voipmonitor''' words in the script with the '''voipmon2''' word.
    subgraph HOST["Single Host"]
        I1[Instance 1<br/>eth0, id_sensor=1<br/>port 5029]
        I2[Instance 2<br/>eth1, id_sensor=2<br/>port 5030]
    end


== copy the config file==
    PBX1[PBX A] -->|SPAN| I1
and modify inside '''id_sensor,interface,managerport,spooldir,maxpoolsize''' options at least (id_sensor and manager_port needs to be unique numbers)
    PBX2[PBX B] -->|SPAN| I2
cp -a /etc/voipmonitor.conf /etc/voipmon2.conf
    I1 --> DB[(MySQL)]
    I2 --> DB
    DB --> GUI[GUI]
</kroki>


== make sure that RAM and storage fits==
{{Warning|1=Do NOT use the GUI wrench icon to configure interfaces when running multiple instances. Interface settings must be configured in local configuration files only.}}
the sum of '''ringbuffer''' and sum of '''max_buffer_mem''' from all instancies not exceeds available free RAM
same applies for '''spooldir''' option and its '''maxpoolsize''' (to not exceeds the available space on the partition where the spooldir of each instance is set)


== systemd that new service is ready for use and start it==
== Use Case: Multiple Receivers Preventing CDR Merging ==
systemctl daemon-reload
systemctl enable voipmon2
systemctl start voipmon2


= verify service messages =
When multiple sensors send packets to a '''single receiver instance''' in packet mirroring mode (<code>packetbuffer_sender=yes</code>), calls may be merged into single CDRs, preventing per-sensor concurrent call monitoring.
in /var/log/syslog or by  
 
journalctl -u voipmon2 --since="2024-12-20"|less
'''Solution:''' Run multiple voipmonitor receiver instances on the same host, one per sensor. Each instance binds to a dedicated <code>server_bind_port</code> and processes only that sensor's traffic.
verify that there are no errors reported when sniffer service started.
 
= add new instance into a GUI =
<syntaxhighlight lang="ini">
open the GUI->settings->sensors and add the new instance by setting an api port configured by '''managerport''' option in config file
# /etc/voipmonitor-sensor1.conf
id_sensor          = 1
server_bind        = 0.0.0.0:60024
server_bind_port  = 60024
server_password    = password1
 
# /etc/voipmonitor-sensor2.conf 
id_sensor          = 2
server_bind        = 0.0.0.0:60025
server_bind_port  = 60025
server_password    = password2
</syntaxhighlight>
 
Configure each remote sensor to send to its dedicated port:
<syntaxhighlight lang="ini">
# On Sensor 1
server_destination      = receiver.host.ip
server_destination_port = 60024
 
# On Sensor 2
server_destination      = receiver.host.ip
server_destination_port = 60025
</syntaxhighlight>
 
'''Note:''' Configuration options like <code>id_sensor</code> or <code>cdr_check_unique_callid_in_sensors</code> '''do not''' prevent CDR merging in packet mirroring mode. The only solution is separate receiver instances.
 
== Configuration Requirements ==
 
Each instance requires unique values for these parameters:
 
{| class="wikitable"
|-
! Option !! Purpose !! Example (Instance 2)
|-
| <code>id_sensor</code> || Sensor ID for licensing/GUI || <code>2</code>
|-
| <code>interface</code> || Network interface to capture || <code>eth1</code>
|-
| <code>managerport</code> || API port for GUI communication || <code>5030</code>
|-
| <code>server_bind</code> || Server mode bind address:port || <code>127.0.0.1:60025</code>
|-
| <code>mirror_bind</code> || Mirror mode bind address:port || <code>127.0.0.1:60026</code>
|-
| <code>spooldir</code> || PCAP/audio storage directory || <code>/var/spool/voipmonitor2</code>
|}
 
== Step-by-Step Setup ==
 
=== Step 1: Copy configuration file ===
 
<syntaxhighlight lang="bash">
cp -a /etc/voipmonitor.conf /etc/voipmon2.conf
</syntaxhighlight>
 
=== Step 2: Edit the new configuration ===
 
Edit <code>/etc/voipmon2.conf</code> and set unique values:
 
<syntaxhighlight lang="ini">
id_sensor = 2
interface = eth1
managerport = 5030
server_bind = 127.0.0.1:60025
mirror_bind = 127.0.0.1:60026
spooldir = /var/spool/voipmonitor2
</syntaxhighlight>
 
=== Step 3: Create systemd service ===
 
Create <code>/etc/systemd/system/voipmon2.service</code>:
 
<syntaxhighlight lang="ini">
[Unit]
Description=VoIPmonitor Instance 2
After=network.target mysql.service
 
[Service]
Type=forking
ExecStart=/usr/local/sbin/voipmonitor --config-file=/etc/voipmon2.conf
Restart=on-failure
 
[Install]
WantedBy=multi-user.target
</syntaxhighlight>
 
=== Step 4: Create spooldir and start service ===
 
<syntaxhighlight lang="bash">
mkdir -p /var/spool/voipmonitor2
systemctl daemon-reload
systemctl enable --now voipmon2
</syntaxhighlight>
 
=== Step 5: Verify startup ===
 
<syntaxhighlight lang="bash">
journalctl -u voipmon2 -n 50
</syntaxhighlight>
 
{{Warning|Verify there are NO errors in the logs before proceeding.}}
 
=== Step 6: Register in GUI ===
 
# Navigate to '''Settings > Sensors > Add Sensor'''
# Configure:
#* '''Sensor ID''': <code>2</code> (matches <code>id_sensor</code>)
#* '''Manager IP''': IP address of the host
#* '''Manager Port''': <code>5030</code> (matches <code>managerport</code>)
 
== Troubleshooting ==
 
=== Duplicate Calls in GUI ===
 
If both interfaces see the same traffic (overlapping SPAN), add to '''both''' config files:
 
<syntaxhighlight lang="ini">
auto_enable_use_blocks = yes
</syntaxhighlight>
 
See [[Sniffing_modes#Multiple_Mirrored_Interfaces_Issue]] for details.
 
=== GUI Overwrites Configuration ===
 
Prevent GUI from overwriting local config settings:
 
<syntaxhighlight lang="ini">
mysqlloadconfig = no
</syntaxhighlight>
 
=== Service Won't Start ===
 
* Check port conflicts: <code>ss -tulpn | grep -E '502[0-9]|6002[0-9]'</code>
* Verify <code>spooldir</code> exists and is writable
* Check logs: <code>journalctl -u voipmon2 -e</code>
 
== See Also ==
 
* [[Sniffer_configuration]] - Configuration file reference
* [[Systemd_for_voipmonitor_service_management]] - Systemd service details
* [[Sniffing_modes]] - Traffic capture methods and SPAN setup
* [[Sniffer_distributed_architecture]] - Client-server mode and packet mirroring
 
 
== AI Summary for RAG ==
 
'''Summary:''' Guide for running multiple independent VoIPmonitor sniffer instances on a single host. Each instance requires unique values for <code>id_sensor</code>, <code>interface</code>, <code>managerport</code>, and bind options (<code>server_bind</code>, <code>mirror_bind</code>). Setup involves copying the config file, creating a systemd service unit with <code>--config-file</code> parameter, and registering the sensor in GUI. For duplicate calls when interfaces see overlapping traffic, use <code>auto_enable_use_blocks = yes</code>. To prevent GUI from overwriting local settings, use <code>mysqlloadconfig = no</code>.
 
'''Keywords:''' multiple instances, single host, separate interfaces, id_sensor, managerport, server_bind, mirror_bind, dual PBX, systemd service, auto_enable_use_blocks, mysqlloadconfig, packet deduplication
 
'''Key Questions:'''
* How to monitor two PBX systems on a single VoIPmonitor host?
* Why are calls duplicated when using multiple sniffer instances?
* How to configure unique ports for each sniffer instance?
* How to prevent configuration conflicts between multiple instances?
* How to create a systemd service for additional sniffer instance?

Latest revision as of 17:32, 10 January 2026

How to Run Multiple Sniffer Instances on a Single Host

Running multiple VoIPmonitor sniffer instances on a single host allows you to:

  • Monitor multiple PBX systems via separate network interfaces
  • Assign different id_sensor values for licensing or organizational purposes
  • Use separate storage paths (spooldir) for each instance
  • Prevent CDR merging from multiple sensors in packet mirroring mode (see below)

⚠️ Warning: Do NOT use the GUI wrench icon to configure interfaces when running multiple instances. Interface settings must be configured in local configuration files only.

Use Case: Multiple Receivers Preventing CDR Merging

When multiple sensors send packets to a single receiver instance in packet mirroring mode (packetbuffer_sender=yes), calls may be merged into single CDRs, preventing per-sensor concurrent call monitoring.

Solution: Run multiple voipmonitor receiver instances on the same host, one per sensor. Each instance binds to a dedicated server_bind_port and processes only that sensor's traffic. 

# /etc/voipmonitor-sensor1.conf
id_sensor          = 1
server_bind        = 0.0.0.0:60024
server_bind_port   = 60024
server_password    = password1

# /etc/voipmonitor-sensor2.conf  
id_sensor          = 2
server_bind        = 0.0.0.0:60025
server_bind_port   = 60025
server_password    = password2

Configure each remote sensor to send to its dedicated port: 

# On Sensor 1
server_destination      = receiver.host.ip
server_destination_port = 60024

# On Sensor 2
server_destination      = receiver.host.ip
server_destination_port = 60025

Note: Configuration options like id_sensor or cdr_check_unique_callid_in_sensors do not prevent CDR merging in packet mirroring mode. The only solution is separate receiver instances.

Configuration Requirements

Each instance requires unique values for these parameters:

Option Purpose Example (Instance 2)
id_sensor Sensor ID for licensing/GUI 2
interface Network interface to capture eth1
managerport API port for GUI communication 5030
server_bind Server mode bind address:port 127.0.0.1:60025
mirror_bind Mirror mode bind address:port 127.0.0.1:60026
spooldir PCAP/audio storage directory /var/spool/voipmonitor2

Step-by-Step Setup

Step 1: Copy configuration file

cp -a /etc/voipmonitor.conf /etc/voipmon2.conf

Step 2: Edit the new configuration

Edit /etc/voipmon2.conf and set unique values: 

id_sensor = 2
interface = eth1
managerport = 5030
server_bind = 127.0.0.1:60025
mirror_bind = 127.0.0.1:60026
spooldir = /var/spool/voipmonitor2

Step 3: Create systemd service

Create /etc/systemd/system/voipmon2.service: 

[Unit]
Description=VoIPmonitor Instance 2
After=network.target mysql.service

[Service]
Type=forking
ExecStart=/usr/local/sbin/voipmonitor --config-file=/etc/voipmon2.conf
Restart=on-failure

[Install]
WantedBy=multi-user.target

Step 4: Create spooldir and start service

mkdir -p /var/spool/voipmonitor2
systemctl daemon-reload
systemctl enable --now voipmon2

Step 5: Verify startup

journalctl -u voipmon2 -n 50

⚠️ Warning: Verify there are NO errors in the logs before proceeding.

Step 6: Register in GUI

  1. Navigate to Settings > Sensors > Add Sensor
  2. Configure:
    • Sensor ID: 2 (matches id_sensor)
    • Manager IP: IP address of the host
    • Manager Port: 5030 (matches managerport)

Troubleshooting

Duplicate Calls in GUI

If both interfaces see the same traffic (overlapping SPAN), add to both config files: 

auto_enable_use_blocks = yes

See Sniffing_modes#Multiple_Mirrored_Interfaces_Issue for details.

GUI Overwrites Configuration

Prevent GUI from overwriting local config settings: 

mysqlloadconfig = no

Service Won't Start

  • Check port conflicts: ss -tulpn | grep -E '502[0-9]|6002[0-9]'
  • Verify spooldir exists and is writable
  • Check logs: journalctl -u voipmon2 -e

See Also


AI Summary for RAG

Summary: Guide for running multiple independent VoIPmonitor sniffer instances on a single host. Each instance requires unique values for id_sensor, interface, managerport, and bind options (server_bind, mirror_bind). Setup involves copying the config file, creating a systemd service unit with --config-file parameter, and registering the sensor in GUI. For duplicate calls when interfaces see overlapping traffic, use auto_enable_use_blocks = yes. To prevent GUI from overwriting local settings, use mysqlloadconfig = no.

Keywords: multiple instances, single host, separate interfaces, id_sensor, managerport, server_bind, mirror_bind, dual PBX, systemd service, auto_enable_use_blocks, mysqlloadconfig, packet deduplication

Key Questions:

  • How to monitor two PBX systems on a single VoIPmonitor host?
  • Why are calls duplicated when using multiple sniffer instances?
  • How to configure unique ports for each sniffer instance?
  • How to prevent configuration conflicts between multiple instances?
  • How to create a systemd service for additional sniffer instance?
Retrieved from "https://www.voipmonitor.org/doc/index.php?title=Multiple_sniffer_instancies&oldid=10624"