Error when checking windows service with snmp v3

[Astergiou]

Hello,

we use snmp v3 to check some pci hosts.
Check for hard disk is working as expected but service checks return the following error

ERROR: Received usmStatsWrongDigests.0 Report-PDU with value 171 during synchronization.

NagiosSNMPv3error.jpg

Username and password of SNMPv3 are correct as the the checks work

[tgriep]

If the names of the services are fairly long or that there are a lot of services on the Windows host, you may need to increase the octet length so the plugin can gather all the the data it needs.
Edit the checks you are using and add the following option to increase it to 65534 bytes.

Code: Select all

--octetlength=65534

Save the change and see if this fixes the issue.

Here is a description of the option.

-o, --octetlength=INTEGER
max-size of the SNMP message, usefull in case of Too Long responses.
Be carefull with network filters. Range 484 - 65535, default are
usually 1472,1452,1460 or 1440.

[Astergiou]

Tried it

Same error

[nagios@hqpnagios02 ~]$ /usr/local/nagios/libexec/check_snmp_win.pl -H 10.50.48.57 --octetlength=65534 --login=nms --passwd=Pk7HsywJ0ny8ecA4pKIw --privpass=mwezacluyBA7RMvDjBwP --protocols=sha,aes -r -n 'YSoft Infrastructure Service Proxy'
ERROR: Received usmStatsWrongDigests.0 Report-PDU with value 7 during synchronization.

[tgriep]

The error does suggest that it is an authentication issue.

Can you run the following so I can see what version of the plugin you are using?

Code: Select all

/usr/local/nagios/libexec/check_snmp_win.pl --help

Run these 2 commands and post the output here.

Code: Select all

/usr/local/nagios/libexec/check_snmp_win.pl -H 10.50.48.57 --octetlength=65534 --login=nms --passwd=Pk7HsywJ0ny8ecA4pKIw --privpass=mwezacluyBA7RMvDjBwP --protocols=sha,aes -r -n 'YSoft Infrastructure Service Proxy' -v
/usr/local/nagios/libexec/check_snmp_win.pl -H 10.50.48.57 --octetlength=65534 --login=nms --passwd=Pk7HsywJ0ny8ecA4pKIw --privpass=mwezacluyBA7RMvDjBwP --protocols=sha,aes -r -n 'YSoft' -v

Thanks.

[Astergiou]

Hello

output

[nagios@hqpnagios02 ~]$ /usr/local/nagios/libexec/check_snmp_win.pl -H 10.50.48.57 --login=nms --passwd=Pk7HsywJ0ny8ecA4pKIw --privpass=mwezacluyBA7RMvDjBwP --protocols=sha,aes -r -n 'YSoft Infrastructure Service Proxy' -v
no timeout defined : 5
SNMPv3 login
ERROR: Received usmStatsWrongDigests.0 Report-PDU with value 401 during synchronization.

[nagios@hqpnagios02 ~]$ /usr/local/nagios/libexec/check_snmp_win.pl -H 10.50.48.57 --octetlength=65534 --login=nms --passwd=Pk7HsywJ0ny8ecA4pKIw --privpass=mwezacluyBA7RMvDjBwP --protocols=sha,aes -r -n 'YSoft' -v
no timeout defined : 5
SNMPv3 login
ERROR: Received usmStatsWrongDigests.0 Report-PDU with value 403 during synchronization


root@hqpnagios02:/home/astergiou# /usr/local/nagios/libexec/check_snmp_win.pl --help

SNMP Windows Monitor for Nagios version 1.2
GPL licence, (c)2004-2007 Patrick Proy

Usage: check_snmp_win [-v] -H <host> -C <snmp_community> [-2] | (-l login -x passwd) [-p <port>] -n <name>[,<name2] [-T=service] [-r] [-s] [-N=<n>] [-t <timeout>] [-V]
-v, --verbose
print extra debugging information (and lists all services)
-h, --help
print this help message
-H, --hostname=HOST
name or IP address of host to check
-C, --community=COMMUNITY NAME
community name for the host's SNMP agent (implies SNMP v1 or v2c with option)
-2, --v2c
Use snmp v2c
-l, --login=LOGIN
Login for snmpv3 authentication (implies v3 protocol with MD5)
-x, --passwd=PASSWD
Password for snmpv3 authentication
-p, --port=PORT
SNMP port (Default 161)
-T, --type=service
Check type :
- service (default) checks service
-n, --name=NAME[,NAME2...]
Comma separated names of services (perl regular expressions can be used for every one).
By default, it is not case sensitive.
-N, --number=<n>
Compare matching services with <n> instead of the number of names provided.
-s, --showall
Show all services in the output, instead of only the non-active ones.
-r, --noregexp
Do not use regexp to match NAME in service description.
-o, --octetlength=INTEGER
max-size of the SNMP message, usefull in case of Too Long responses.
Be carefull with network filters. Range 484 - 65535, default are
usually 1472,1452,1460 or 1440.
-t, --timeout=INTEGER
timeout for SNMP in seconds (Default: 5)
-V, --version
prints version number
Note :
The script will return
OK if ALL services are in active state,
WARNING if there is more than specified (ex 2 service specified, 3 active services matching),
CRITICAL if at least one of them is non active.
The -n option will allows regexp in perl format
-n "service" will match 'service WINS' 'sevice DNS' etc...
It is not case sensitive by default : WINS = wins

[tgriep]

Can you upload the /usr/local/nagios/libexec/check_snmp_win.pl plugin here so I can view it and run some tests with it?

[tgriep]

One more question, what version of Windows is the server running and what software package are you using on the Windows server to allow SNMP v3 traffic?

[Astergiou]

Script as requested

check_snmp_win.txt

We are using windows server 2016 with MG-SOFT snmp agent
https://www.mg-soft.si/agent.html

thank you

[tgriep]

Strange thing. That plugin does not fully support SNMP v3.

It sets the auth and the priv password to the same password and it does not support the protocols option, it is hard coded to use md5 for the auth protocol and it does not have a priv protocol option.

To get it to work, you would have to re-write sections of the plugin to fully support SNMPv3.

[Astergiou]

Thank you for your answer.
How could you explain how with the same plugin on the same server all checks work except of the services check?

Could I use other plugin for the services check?

thank you