Questions[snmp](server)

A lot of things about SNMP seemed cumbersome to me even 15 years ago. One example is the concept of MIB being a local resource to "make sense" of the otherwise numeric OIDs.

Has SNMP been modernized or mutated into something else? Is it still a must-have feature for network equipment?

I've done a fresh install of Ubuntu 12.04LTS, and installed the snmpd and snmp packages.

If I type:

snmpwalk -m ALL -v2c -c public localhost 1.3

I get swathes of errors, of the form:

Cannot adopt OID in SQUID-MIB: cacheClients ::= { cacheProtoAggregateStats 15 }
Cannot adopt OID in NET-SNMP-EXTEND-MIB: nsExtendLineIndex ::= { nsExtendOutput2Entry 1 }
Cannot adopt OID in NET-SNMP-EXTEND-MIB: nsExtendOutLine ::= { nsExtendOutput2Entry 2 }
Cannot adopt OID in UCD-SNMP-MIB: laIndex ::= { laEntry 1 }
Cannot adopt OID in UCD-SNMP-MIB: laNames ::= { laEntry 2 }
Cannot adopt OID in UCD-SNMP-MIB: laLoad ::= { laEntry 3 }
Cannot adopt OID in UCD-SNMP-MIB: laConfig ::= { laEntry 4 }
Cannot adopt OID in UCD-SNMP-MIB: laLoadInt ::= { laEntry 5 }
Cannot adopt OID in UCD-SNMP-MIB: laLoadFloat ::= { laEntry 6 }
Cannot adopt OID in UCD-SNMP-MIB: laErrorFlag ::= { laEntry 100 }
Cannot adopt OID in UCD-SNMP-MIB: laErrMessage ::= { laEntry 101 }
Cannot adopt OID in NET-SNMP-AGENT-MIB: nsNotifyRestart ::= { netSnmpNotifications 3 }
Cannot adopt OID in NET-SNMP-AGENT-MIB: nsNotifyShutdown ::= { netSnmpNotifications 2 }
Cannot adopt OID in NET-SNMP-AGENT-MIB: nsNotifyStart ::= { netSnmpNotifications 1 }

There a literally hundreds of these.

If snmp doesn't even like the distro-included MIBs, what chance to I have of getting my own used? (I get the same form of error with my own MIB, on a different machine, which is why I set up a clean install to test the distro's sanity.)

Do other distros have this issue? Is there something obvious that I am overlooking here?

Amazon CloudWatch has a decent console, and an alarm system which uses Amazon SNS for notifications.

Originally it only gave you AWS metrics, e.g. EC2 instance CPU utilization.

Recently they added custom metrics. You can use the CloudWatch REST API to push your own arbitrary metrics.

I'm wondering if anyone has tried to use an agent that would poll various servers (some at EC2, some not) via SNMP and/or WMI, and push those samples as custom metrics to CloudWatch? So now in CloudWatch you can see all your metrics (both AWS and not) together in one place.

Note: I understand that some monitoring tools can pull from EC2, which is another way to get everything in one place, and might be superior to some people for a variety of reasons. But I'm asking about the way where CloudWatch is the one place.

If anyone is doing this, what are you using as the agent?

How hard can this be? I want to get the current CPU performance from a remote Win 2k3 machine. I need to use SNMP because the machine is behind a firewall.

Assumptions:

• I understand networking/can configure any kind of IP address/port forwarding/firewall/stuff.
• I understand SNMP - I know how to use my tool to get a value from an OID on a target machine.
• I know what I want to do with the result from my SNMP request.
• I have enabled SNMP on the Windows Server, configured the relevant IP security/community stuff.
• I can already ask the Windows server standard stuff using SNMP about how many disks/network interfaces it has etc.

Question: - What OID do I used to simply ask current performance usage.

I have spent many hours asking Google - clearly asking the wrong question :S .... How hard can this be?

I'm implementing a network monitoring solution for a very large network (approximately 5000 network devices). We'd like to have all devices on our network send SNMP traps to a single box (technically this will probably be an HA pair of boxes) and then have that box pass the SNMP traps on to the real processing boxes. This will allow us to have multiple back-end boxes handling traps, and to distribute load among those back end boxes.

One key feature that we need is the ability to forward the traps to a specific box depending on the source address of the trap. Any suggestions for the best way to handle this?

Among the things we've considered are:

• Using snmptrapd to accept the traps, and have it pass them off to a custom written perl handler script to rewrite the trap and send it to the proper processing box
• Using some sort of load balancing software running on a Linux box to handle this (having some difficulty finding many load balancing programs that will handle UDP)
• Using a Load Balancing Appliance (F5, etc)
• Using IPTables on a Linux box to route the SNMP traps with NATing

We've currently implemented and are testing the last solution, with a Linux box with IPTables configured to receive the traps, and then depending on the source address of the trap, rewrite it with a destination nat (DNAT) so the packet gets sent to the proper server. For example:

# Range: 10.0.0.0/19       Site: abc01    Destination: foo01
iptables -t nat -A PREROUTING -p udp --dport 162 -s 10.0.0.0/19 -j DNAT --to-destination 10.1.2.3
# Range: 10.0.33.0/21       Site: abc01    Destination: foo01
iptables -t nat -A PREROUTING -p udp --dport 162 -s 10.0.33.0/21 -j DNAT --to-destination 10.1.2.3
# Range: 10.1.0.0/16       Site: xyz01    Destination: bar01
iptables -t nat -A PREROUTING -p udp --dport 162 -s 10.1.0.0/16 -j DNAT --to-destination 10.3.2.1

This should work with excellent efficiency for basic trap routing, but it leaves us completely limited to what we can mach and filter on with IPTables, so we're concerned about flexibility for the future.

Another feature that we'd really like, but isn't quite a "must have" is the ability to duplicate or mirror the UDP packets. Being able to take one incoming trap and route it to multiple destinations would be very useful.

Has anyone tried any of the possible solutions above for SNMP traps (or Netflow, general UDP, etc) load balancing? Or can anyone think of any other alternatives to solve this?