SNMP Monitoring on Windows

[emartine]

I am in the process of taking over monitoring of a server that has an application with several application interfaces on it. The external vendor is monitoring the application interfaces via SNMP.

I did a walk on the server and was able to get oids for the application interfaces. So I added a check in nagios but I always get the same response <SNMP OK "App Interfacename">

The vendor told me that they are monitoring an upper level oid that checks for any interfaces that are down.

.1.3.6.1.4.1.4184.2

I ran the check:
/usr/local/nagios/libexec/check_snmp -H <Server IP> --protocol=2c -C communityname -U user -A auth -o '.1.3.6.1.4.1.4184.2'
but I get

External command error: Error in packet
Reason: (genError) A general failure occured
Failed object: iso.3.6.1.4.1.4184.2


I am guessing I am not running the proper check? Your help would be greatly appreciated.

[scottwilkerson]

First, you are mixing 2c protocol with user and auth which are only used for version 3 protocol..

Also, what do you get when you run?

Code: Select all

snmpwalk -v 2c -c communityname <Server IP> -o .1.3.6.1.4.1.4184.2

[emartine]

-o is not a valid option for snmpwalk. I can run a mib browser and get lots of OIDs from the server however.

[scottwilkerson]

Sorry, I just meant

Code: Select all

snmpwalk -v 2c -c communityname <Server IP>  .1.3.6.1.4.1.4184.2

but being you said you have lots of OIDs, you need to pick 1 when running check_snmp

You cannot simply point it at the top of the tree

[emartine]

So the application that is running lots of interfaces on it.... Is the vendor lying to me when he says he is checking the top level oid to monitor when an interface goes down?

The server has about 120 total interfaces that need to be monitored. I am assuming I would have to monitor each one individually. But what would be the proper method?

[scottwilkerson]

So the application that is running lots of interfaces on it.... Is the vendor lying to me when he says he is checking the top level oid to monitor when an interface goes down?

IDK if you can say lying, but they didn't give you an exact OID, the gave the top of their tree... each of those things under that (that isn't a sub-tree) can be monitored, there may be 20,000 things. The trick with SNMP is knowing which of the things OIDs) are important.

The server has about 120 total interfaces that need to be monitored. I am assuming I would have to monitor each one individually. But what would be the proper method?

I would find the exact OID of one of these interfaces, then you can take one number off the end and use that as the base OID when running the SNMP Walk Wizard, you can then get a list of all of the interfaces that can be monitored (hopefully the vendor has the interfaces in one sub-tree), then you can name them and finish the wizard

[emartine]

In the application itself there is an interface called sm33 and the value that comes up from an snmp walk is sm33
.1.3.6.1.4.1.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51


#snmpwalk -v 2c -c community IPaddress .1.3.6.1.4.1.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51
SNMPv2-SMI::enterprises.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51 = STRING: "sm33"

I am pretty sure that is the interface and OID that goes along with it since the mib browser comes up with the same name under the value for that OID. I added a check using /usr/local/nagios/libexec/check_snmp

/usr/local/nagios/libexec/check_snmp -H IP -C communityname -P 2c -o .1.3.6.1.4.1.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51

But the result is always the same even after the interface was manually shutdown it still says:

<SNMP OK "sm33">

[scottwilkerson]

Given you example, this OID .1.3.6.1.4.1.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51 just points to the name of the interface, not it's status, you need to find the OID that points to the status

[emartine]

I received some more information from the vendor regarding the events that transpired in their logs for the interface being down. I sent you a PM with details to give you more clarity on the scope of what I am trying to do. I also attached the actual SNMP walk I get when I run the command below against the server.

How can I tell from this what I should be monitoring? Should I be trying all of them?

[scottwilkerson]

I looked at your PM, and I can't answer the question as I have never used this hardware, I would ask the vendor what is the oid to the status for the interface that corresponds to the interface name that is listed in .1.3.6.1.4.1.4184.2.3.2.1.1.12.73.67.79.80.50.52.49.53.72.48.65.72.7.51.77.95.83.70.51.51