Nagios Support Forum

Hi Forum

So I have been tasked with a interesting little project, our company are starting to use ML4G Machine Link devices, which are effectively 4G/5G modems for use on our remote sites (of which we have over 200).

The problem I am faced with is that being a 4G modem, if it gets stolen it can be used anywhere as a backdoor into our SCADA Network, so what I would like to do it use the SNMP GPS coordinates I can retrieve from the device and set an alert based on coordinates changing a certain amount to set off a critical alert.

Would anyone know how I could achieve this please?

At present I have the following information returned via SNMP, at first I did consider setting the alert based on cell tower but some of the devices jump between towers so I can't use this method

That does sound like an interesting project.
There is not a plugin that I could find that would do what you need so you would have to create some sort of script to achieve what you need.

First, you would have to determine the OID you need to poll from the device to get the coordinates.

An example of the command is as follows What you would have to do is run the custom plugin with an option for where the GPS coordinates should be for the device.
The custom plugin would have to use the scheck_snmp plugin to poll the device and compare the current coordinate with the coordinates provided and if the difference is large enough, you would have the plugin generate an alert.


The check_snmp plugin does have the ability to store a retrieved value and then use subsequence runs to do rate calculation.

--rate
Enable rate calculation. See 'Rate Calculation' below

Rate Calculation:
In many places, SNMP returns counters that are only meaningful when
calculating the counter difference since the last check. check_snmp
saves the last state information in a file so that the rate per second
can be calculated. Use the --rate option to save state information.
On the first run, there will be no prior state - this will return with OK.
The state is uniquely determined by the arguments to the plugin, so
changing the arguments will create a new state file.

It is used for counters. If the OID you are checking returns a string, the rate calculation won't work and you would have to write something for that.

@tgriep

Thank you for your response, I myself am not a programmer but we do have a team of them here, I run this by them and see what they can come up with

The 4G routers themselves also have geofencing capabilities, so I may be able to get them to send out a passive check if moved from their location, which would be a far easier method.

Please leave this thread unlocked. when i have figured it out i will post how it is done for anyone else looking at doing this in the future.

OK, we'll leave it open for updates.
Using the geofencing capabilities would be a good idea if the system can send out SNMP Traps when they are moved.
As long as you can get a MIB file from the manufacturer and setup inbound Traps to the Nagios server, it shouldn't be too hard to do.

@tgriep

Yep I have the mib file, the device stores a copy of the mibs on it for use in this situation, I already have full alerting setup within Nagios for a single device and it is reporting everything back correctly.

I think the best way is to use SNMP Traps, rather than custom coding stuff. I can get the device to send out a Trap when moved (at present 1km) from it's location. This in turn generates a critical alert in Nagios which then forwards the alerts to our ticketing system to automatically generate a ticket.

You can lock this one if you like SNMP Traps are the way to go.

Excellent! Good to hear that you have a path forward on this. Locking thread.