Get SNMPv3 via Nagios Web Interface

[page]

I am having an issue with setting up SNMP v3 checks with check_snmp on NagiosXI 2012R2.9. When I attempt to run snmpget from the command line using SNMP v3 I have no issue and it returns the proper value so I know that is working properly. When I trying to add a check using the Nagios SNMP Get wizard, it set the command as follows:

check_xi_service_snmp! -o <OID> -P 3 --seclevel=authPriv --secname=<UserName> --authproto=md5 --authpasswd='<AuthenticationPassword>' --privpasswd='<PrivacyPassword>' --protocols=md5,des -m RFC1155-SMI

The error messsage that is displayed is:

Usage:check_snmp -H <ip_address> -o <OID> [-w warn_range] [-c crit_range]
[-C community] [-s string] [-r regex] [-R regexi] [-t timeout] [-e retries]
[-l label] [-u units] [-p port-number] [-d delimiter] [-D output-delimiter]
[-m miblist] [-P snmp version] [-L seclevel] [-U secname] [-a authproto]
[-A authpasswd] [-X privpasswd]

I did read on another forum message (http://support.nagios.com/forum/viewtop ... 06&p=31298) that upgrading the version of check_snmp could resolve this (grasping at straws here). I have the following:
/usr/local/nagios/libexec/check_snmp -V
check_snmp v2021 (nagios-plugins 1.4.13)

I know that 2.0 was just released. I have tried running yum install nagios-plugins and it did stay that it was successful but it never updated the check_snmp plugin version. Is there another way of doing this (preferably without having to compile)? Ultimately, I just want to do a SNMP v3 get through the Nagios web interface. Any help is greatly appreciated!

[sreinhardt]

Unfortunately 1.4.13 is the latest that yum currently provides, are you running on an x86 or x64 system? 1.5 should fix the issue, otherwise 2.0 definitely does, at least last time I checked. If we need to, I can provide instructions on how to update to 1.5 or 2.0, whichever you would prefer, although I would probably suggest 2.0 as there are several snmpv3 patches there.

[page]

Thank you for the response. It is an x64 systme and I would prefer to go to version 2.0. If you could provide some documentation that would be great!

Thank you!

[sreinhardt]

OK, you will want to do the following:

Code: Select all

cd /tmp
wget http://assets.nagios.com/downloads/nagiosxi/xi-latest.tar.gz
tar xzf xi-latest.tar.gz
cd /tmp/nagiosxi/subcomponents/nagiosplugins/
rm -rf ./nagios-plugins*
wget https://github.com/nagios-plugins/nagios-plugins/archive/release-2.0.tar.gz
mv release-2.0.tar.gz nagios-plugins-release-2.0.tar.gz

Modify ./install so that the pkgname="nagios-plugins-release-2.0" and add "time ./tools/setup" above "time ./configure" so that it looks like:

        cd "./$pkgname"
        time ./tools/setup
        time ./configure

./install

done! Provided that returns "Nagios Plugins installed OK"

[page]

I have tried this a few times and unfortunately it is not working. To recap what I have done, first I had to install automake via yum. Also I had one change to the commands that you provided. After the download of release-2.0.tar.gz, I had to rename it from release-2.0.tar.gz to nagios-plugins-release-2.0.tar.gz. The following is what is returned at the end of running ./install running as root:

Code: Select all

libtool: link: gcc -DNP_VERSION=\"2.0.git\" -g -O2 -o check_dhcp check_dhcp.o ../plugins/netutils.o ../plugins/utils.o  -L. ../lib/libnagiosplug.a ../gl/libgnu.a -lnsl -lresolv -lpthread -ldl
gcc -DLOCALEDIR=\"/usr/local/nagios/share/locale\" -DHAVE_CONFIG_H -I. -I..  -I.. -I../lib -I../gl -I../intl -I../plugins -I/usr/include  -DNP_VERSION='"2.0.git"' -g -O2 -MT check_icmp.o -MD -MP -MF .deps/check_icmp.Tpo -c -o check_icmp.o check_icmp.c
mv -f .deps/check_icmp.Tpo .deps/check_icmp.Po
/bin/sh ../libtool --tag=CC   --mode=link gcc -DNP_VERSION='"2.0.git"' -g -O2  -L. -o check_icmp check_icmp.o ../plugins/netutils.o ../plugins/utils.o ../lib/libnagiosplug.a ../gl/libgnu.a  -lnsl -lresolv -lnsl -lresolv -lpthread -ldl 
libtool: link: gcc -DNP_VERSION=\"2.0.git\" -g -O2 -o check_icmp check_icmp.o ../plugins/netutils.o ../plugins/utils.o  -L. ../lib/libnagiosplug.a ../gl/libgnu.a -lnsl -lresolv -lpthread -ldl
make[2]: Leaving directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0/plugins-root'
Making all in po
make[2]: Entering directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0/po'
test ! -f ./nagios-plugins.pot || \
  test -z "fr.gmo de.gmo" || make fr.gmo de.gmo
make[3]: Entering directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0/po'
rm -f fr.gmo && : -c --statistics -o fr.gmo fr.po
mv: cannot stat `t-fr.gmo': No such file or directory
make[3]: *** [fr.gmo] Error 1
make[3]: Leaving directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0/po'
make[2]: *** [stamp-po] Error 2
make[2]: Leaving directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0/po'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/tmp/nagiosxi/subcomponents/nagiosplugins/nagios-plugins-release-2.0'
make: *** [all] Error 2

I am trying to debug this but unfortunately I am not getting far. Any thoughts? I may try this with 1.5 to see if that works, but would prefer to have the latest version.

[sreinhardt]

Could you post the Makefile that is generated on your system please.

[page]

Okay, I think I have resolved this just a few minutes ago. I found another forum (http://support.nagios.com/forum/viewtop ... 0&start=10) with the same SSL errors:

Code: Select all

NP_VERSION = 1.5.git
sslutils.c: In function ânp_net_ssl_init_with_hostname_version_and_certâ:
sslutils.c:55: warning: assignment discards qualifiers from pointer target type
sslutils.c:58: warning: assignment discards qualifiers from pointer target type
sslutils.c:65: warning: assignment discards qualifiers from pointer target type
sslutils.c:69: warning: assignment discards qualifiers from pointer target type

So basically to get this to work is I also installed

- yum install gettext -y
- yum install openssh openssh-clients

After this everything compiled correctly. I then copied all the plugin only files from the .../nagios-plugins-release-2.0/plugins to the /usr/local/nagios/libexec directory (backing up the existing ones first!). Restarted the nagios service (service nagios restart) and the snmpd services (service snmpd restart) for good measure. I attempted to run through the Nagios snmp wizard again and it failed. I changed the syntax to:

check_xi_service_snmp! -o <OID> -P 3 -L authPriv -U <UserName> -a <AuthenticationProtocol> -A 'AuthenticationPassword' -X 'PrivacyPassword' -x <PrivacyProtocol> -m <MIB>

And everything worked!!! My question now is, it appears to be an issue with the wizard. The following forum post (http://support.nagios.com/forum/viewtop ... 16&t=10218) has replacements for this. Are these wizards still relevant and will they fix the syntax issues?

Also just want to say thanks to sreinhardt for your help! (Also to Google and the Nagios forum!)

[sreinhardt]

If you have had nagios installed prior to when that made it into the official wizard versions, it would be available via Admin->Manage Wizards->Check for updates. Otherwise yes that should be accurate today, as checking our internal version, shows no updates since that zip.

[page]

Well I have decided to manually edit the "Monitor the service with this command..." line manually for now.

I also want to provide the additional information as I assume that if you are using SNMPv3 you care a bit about security. One of the issues with the following line is that it assumes you have to put the authentication and privacy passwords on the "Monitor the service with this command..." in plain text

check_xi_service_snmp! -o <OID> -P 3 -L authPriv -U <UserName> -a <AuthenticationProtocol> -A 'AuthenticationPassword' -X 'PrivacyPassword' -x <PrivacyProtocol> -m <MIB>

That is not necessarily true. You can use a macro to hide these. Within the /usr/local/nagios/etc/resource.cfg file you can put your username and passwords as follows:

Code: Select all

#My SNMPv3 Username
$USER5$=<UserName>
#My SNMPv3 Auth Password
$USER6$=<AuthenticationPassword>
#My SNMPv3 Priv Password
$USER7$=<PrivacyPassword>

(Just keep increasing the number)

You can then reference these as follows:

check_xi_service_snmp! -o <OID> -P 3 -L authPriv -U $USER5$ -a <AuthenticationProtocol> -A $USER6$ -X $USER7$ -x <PrivacyProtocol> -m <MIB>

I think that is all that is need to make this work. I really hope this helps prevents someone from having to spend countless hours figuring this out (sreinhardt can add corrections). Hopefully Nagios will create documentation on the entire SNMPv3 procedure soon. Now on the SNMPv3 Traps, but that is another forum post.

[sreinhardt]

With the coming 2014 release, snmpv3 has support in just about every wizard and plugin that could support it, so yes I think documentation will be on our hopefully short list of things to do. Nice guide though, I will have to come back to it when doing documentation. Ugh traps now?