Brand new Nagios install and SNMP Walk error

[JakeHatMacys]

Getting an error when trying to monitor a server via SNMP:

Capture.JPG

Unix admin ran this from target server:

Code: Select all

[************** ~]$ snmpwalk -v 3 -u ******** -a SHA -A ************* -x AES -X *********** -l AuthPriv ************* SNMPv2-MIB::sysDescr.0 = STRING: Linux ******************3.10.0-514.10.2.el7.x86_64 #1 SMP Thu Mar 2 11:35:29 PST 2017 x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (17461618) 2 days, 0:30:16.18
SNMPv2-MIB::sysContact.0 = STRING: Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
SNMPv2-MIB::sysName.0 = STRING: ***************
SNMPv2-MIB::sysLocation.0 = STRING: Unknown (edit /etc/snmp/snmpd.conf)
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (49) 0:00:00.49
SNMPv2-MIB::sysORID.1 = OID: SNMP-MPD-MIB::snmpMPDCompliance
SNMPv2-MIB::sysORID.2 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance
SNMPv2-MIB::sysORID.3 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance
SNMPv2-MIB::sysORID.4 = OID: SNMPv2-MIB::snmpMIB
SNMPv2-MIB::sysORID.5 = OID: TCP-MIB::tcpMIB
SNMPv2-MIB::sysORID.6 = OID: IP-MIB::ip
SNMPv2-MIB::sysORID.7 = OID: UDP-MIB::udpMIB
SNMPv2-MIB::sysORID.8 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup
SNMPv2-MIB::sysORID.9 = OID: SNMP-NOTIFICATION-MIB::snmpNotifyFullCompliance
SNMPv2-MIB::sysORID.10 = OID: NOTIFICATION-LOG-MIB::notificationLogMIB
SNMPv2-MIB::sysORDescr.1 = STRING: The MIB for Message Processing and Dispatching.
SNMPv2-MIB::sysORDescr.2 = STRING: The management information definitions for the SNMP User-based Security Model.
SNMPv2-MIB::sysORDescr.3 = STRING: The SNMP Management Architecture MIB.
SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for SNMPv2 entities
SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing TCP implementations
SNMPv2-MIB::sysORDescr.6 = STRING: The MIB module for managing IP and ICMP implementations
SNMPv2-MIB::sysORDescr.7 = STRING: The MIB module for managing UDP implementations
SNMPv2-MIB::sysORDescr.8 = STRING: View-based Access Control Model for SNMP.
SNMPv2-MIB::sysORDescr.9 = STRING: The MIB modules for managing SNMP Notification, plus filtering.
SNMPv2-MIB::sysORDescr.10 = STRING: The MIB module for logging SNMP Notifications.
SNMPv2-MIB::sysORUpTime.1 = Timeticks: (47) 0:00:00.47
SNMPv2-MIB::sysORUpTime.2 = Timeticks: (47) 0:00:00.47
SNMPv2-MIB::sysORUpTime.3 = Timeticks: (47) 0:00:00.47
SNMPv2-MIB::sysORUpTime.4 = Timeticks: (47) 0:00:00.47
SNMPv2-MIB::sysORUpTime.5 = Timeticks: (48) 0:00:00.48
SNMPv2-MIB::sysORUpTime.6 = Timeticks: (48) 0:00:00.48
SNMPv2-MIB::sysORUpTime.7 = Timeticks: (48) 0:00:00.48
SNMPv2-MIB::sysORUpTime.8 = Timeticks: (48) 0:00:00.48
SNMPv2-MIB::sysORUpTime.9 = Timeticks: (49) 0:00:00.49
SNMPv2-MIB::sysORUpTime.10 = Timeticks: (49) 0:00:00.49
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (17462938) 2 days, 0:30:29.38
HOST-RESOURCES-MIB::hrSystemUptime.0 = No more variables left in this MIB View (It is past the end of the MIB tree) 

Last time this happened we updated our SNMP Walk Wizard I believe and it fixed it. But that was on an older server, this server is brand new and everything says it's up to date. Using the Linux SNMP wizard.

Thoughts?

Linux SNMP wizard is:
1.5.2
SNMP Walk wizard is:
1.3.5
Nagios XI Version : 5.4.3

[dwhitfield]

from the nagios server, what is the output of the following:

Code: Select all

traceroute REMOTEIP
nmap REMOTEIP -p 161
telnet REMOTEIP 161

Also, if you run the same snmpwalk command from the nagios server (directed at the target server), what is the output?

[JakeHatMacys]

from the nagios server, what is the output of the following:

Code: Select all

traceroute REMOTEIP
nmap REMOTEIP -p 161
telnet REMOTEIP 161

Also, if you run the same snmpwalk command from the nagios server (directed at the target server), what is the output?

NMAP:

Code: Select all

nmap ************ -p 161

Starting Nmap 6.40 ( http://nmap.org ) at 2017-04-13 15:01 EDT
Nmap scan report for **********.********** (****************)
Host is up (0.025s latency).
PORT    STATE    SERVICE
161/tcp filtered snmp

Nmap done: 1 IP address (1 host up) scanned in 1.57 seconds

Trace Route:

Code: Select all

 
traceroute to ********* (*************), 30 hops max, 60 byte packets
 1  ************ (***************)  0.579 ms  0.666 ms  0.758 ms
[b].... environment IPs to 8:[/b]
 8  *********** (********)  21.951 ms  22.931 ms  22.500 ms
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *]

SNMPWALK:
snmpwalk **************:161
snmpwalk: Timeout

just snmpwalk *JustIP* with the same message... time out.

The firewall was supposed to be opened but perhaps it's not? Odd that nmap came back okay though....

[JakeHatMacys]

[root@********** ~]# nmap -sU -p 161 ************

Starting Nmap 6.40 ( http://nmap.org ) at 2017-04-13 15:26 EDT
Nmap scan report for ************** (************)
Host is up (0.022s latency).
rDNS record for **************: **************************
PORT STATE SERVICE
161/udp open|filtered snmp

Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

I had a unix admin run nmap -sU -p 161 *hostname* as I didn't have privilege and the above was the result.

[tgriep]

Do you have any special characters in the user name or the password?

[JakeHatMacys]

Do you have any special characters in the user name or the password?

yes the password has _ and !'s in it.

[WillemDH]

Nagios configs don't like !

Can you change the password and test without it?

[tgriep]

There is a work around that you can do is your username or passwords have special characters.
Edit the following file

Code: Select all

/usr/local/nagios/etc/resource.cfg

Add 2 entries like the example below. (Replace the Username and Password! with the correct information)

Code: Select all

$USER10$=Username
$USER11$=Password!

Save the file and restart the nagios and apache daemons by running

Code: Select all

service nagios restart
service httpd restart

Then, when you run the SNMP Walk wizard, put $USER10$ in the username field and $USER11$ in the password fields.
When the wizard runs and it sees a macro in one of the fields, it substitutes the macro for the actual value and the wizard should be able to login to the remote device.
Try that and let us know if it works.

[JakeHatMacys]

There is a work around that you can do is your username or passwords have special characters.
Edit the following file

Code: Select all

/usr/local/nagios/etc/resource.cfg

Add 2 entries like the example below. (Replace the Username and Password! with the correct information)

Code: Select all

$USER10$=Username
$USER11$=Password!

Save the file and restart the nagios and apache daemons by running

Code: Select all

service nagios restart
service httpd restart

Then, when you run the SNMP Walk wizard, put $USER10$ in the username field and $USER11$ in the password fields.
When the wizard runs and it sees a macro in one of the fields, it substitutes the macro for the actual value and the wizard should be able to login to the remote device.
Try that and let us know if it works.

There's the AUTH PW & the PRIV PW though when going through the wizard. Do I need a 3rd entry in that file?

Err nm I think I just put 2 in 2 together:

capture.JPG

Like that right? (I added 12 too)

[JakeHatMacys]

If what I did above was right... no dice:

capture.JPG