Tag: SNMP

Cacti Dell R750 iDRAC Temperature

I’ve setup a template to monitor a Dell R750 server via configured SNMP access on iDRAC.

My server has only two CPU (Intel Xeon Gold 6338N). I did not create this as a robust type of template, where it will walk all CPUs. Eventually I’ll get to that, but for now each data source OID is set manually.

Here are the OIDs:

OIDDescription
.1.3.6.1.4.1.674.10892.5.4.700.20.1.6.1.1CPU1 Temp
.1.3.6.1.4.1.674.10892.5.4.700.20.1.6.1.2CPU2 Temp
.1.3.6.1.4.1.674.10892.5.4.700.20.1.6.1.3System Board Inlet Temp
.1.3.6.1.4.1.674.10892.5.4.700.20.1.6.1.4System Board Exhaust Temp

Download

Cisco WAP571 SNMP poll of apRadioNumAssociatedStations returning 0

For some reason on a Cisco WAP571, the SNMP value returned from apRadioNumAssociatedStations is always zero.

This is true on firmware tested WAP571 (pgwap571, 1.1.0.3).

I have a few of these units around that are not updated to the latest firmware and will test that OID.

I can find data in the apAssocTable to create indexes. For now I’ve created a hack to just snmptable the apAssocTable and count return index values to then pass to Cacti to graph.

snmptable -Cl -CB -Ci -OX -Cb -Cc 16 -Cw 64 -v2c -c <community> <host:port> CISCO-WLAN-ACCESS-POINT-MIB::apAssocTable | grep index | wc -l

snmptable

snmptable -Cl -CB -Ci -OX -Cb -Cc 16 -Cw 64 -v2c -c <community> <host:port> CISCO-WLAN-ACCESS-POINT-MIB::apAssocTable

On a Cisco WAP571, it produces the following output.

Interface       Authenticated   Associated      RxPackets
TxPackets       RxBytes         TxBytes         ListenInterval
LastRssi        TxDropBytes     RxDropBytes     TxDropPackets
RxDropPackets   ClntQoSStatus   BwLimitUp       BwLimitDown
ACLType         ACL             Policy          TsViolateTxPack
TsViolateRxPack Uptime

index: [8:c5:e1:35:b5:89]
wlan1vap2       yes             yes             17056
23016           3871353         25017797        10
32              0               0               0
0               Disabled        0               0
None                                            Wrong Type (sho
Wrong Type (sho 00:01:03

index: [48:90:2f:cd:9f:35]
wlan1vap2       yes             yes             75219
433258          14643877        530054579       2
22              0               0               0
0               Disabled        0               0
None                                            Wrong Type (sho
Wrong Type (sho 00:02:10

index: [7c:f3:1b:bf:ca:ff]
wlan0vap2       yes             yes             14351
23055           1897849         28821887        5
15              0               0               0
0               Disabled        0               0
None                                            Wrong Type (sho
Wrong Type (sho 00:00:36

index: [8c:83:e1:ce:33:f2]
wlan1vap2       yes             yes             91
93              15906           37253           5
39              0               0               0
0               Disabled        0               0
None                                            Wrong Type (sho
Wrong Type (sho 00:00:19

index: [b8:d7:af:f:47:4c]
wlan1vap2       yes             yes             9948
8279            1935919         3804742         10
30              0               0               0
0               Disabled        0               0
None                                            Wrong Type (sho
Wrong Type (sho 00:06:30

Ransomware: id-3509099450_[mk.goro@aol.com].0oxr4

UPDATE 6/8/2017: This is a CRyPTON Variant, see below.

A new variant of Dharma CryptON (CryptON 36 variant, to be precise), seems to have hit a server;  here are some of the details I’ve been gathering.

Ransom Note

A file named ### DECRYPT MY FILES ###.txt is placed in each directory where encrypted files are located with the following content.

*** ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED ***
To decrypt your files you need to buy the special software – «Nemesis decryptor»
You can find out the details / buy decryptor + key / ask questions by email: mk.goro@aol.com
Your personal ID: 3509099450

Encrypted Files

Encrypted files have the following appended: .id-3509099450_[mk.goro@aol.com].0oxr4

Registry Entry

An interesting Registry entry is observed:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeKJ8CvJIB1H5nRcJZ]
"KJ8CvJIB1H5nRcJZd"="32B7DAEBA948B330EA098023EE44F4C003D3ADFD3D1DFEC22DEA17F1030C8C5D"
"KJ8CvJIB1H5nRcJZn"="B70D46F62D9189C86EB4017E7F83B2F81AEFD85392883862DC9AF3912EA38D6311EAE04DFC9473ABB19D510AE58852F91FA6933EAA5161EE2372EEF1E033A1E857BAB9603840A6F4CEEB54AF0E4332CF1617DFBD553A99F07873DEEFC66504B1A975862171DC6D74A970FB9580C389E708C950066FFC65596DBE51AE757BE10F7AB43285511704B9F71EF0615B0203F551EDA54CEBB93BD8609C88D7129DE39390B9D88595FD9A1B460F8F3B50D2B9EEA155DBCCD2F084E88877799559D51F190667D01E0F0858B0F27EE5D0A5F64310FD731EC53F89A2C5EEDCCD999A1620BA48469D51A00A545A33CEB7563610A3D3BE65CC7B5FCCE76C7181E316BB2FE6D9"
"KJ8CvJIB1H5nRcJZs"="1"

Google search for any parts of .0oxr4 comes up short as well as any of the information in the Registry key HKEY_LOCAL_MACHINESOFTWAREWow6432NodeKJ8CvJIB1H5nRcJZ
 
Searching for the email mk.goro@aol.com indicates this may be a ransomware that can be decrypted, according to ID Ransomware website.  However, I have found nothing that works for decrypting.

I have attached two sample files, an original Informant SNMP zip file pulled from a backup as well as the encrypted file.

Still a work in progress…

Update: 6/8/2017

From: https://www.bleepingcomputer.com/forums/t/632389/dharma-ransomware-filenameemaildharmawalletzzzzz-support-topic/page-99

Any files that are encrypted with the newest variant of CryptON (Cry9, Cry36, Cry128, X3M, Nemesis) will have a random 5 character hexadecimal extension appended to the end of the encrypted data filename (i.e. .id-1163283255_[liukang@mortalkombat.su].08c85, .id-1163283255_[mk.baraka@aol.com].830s7) and leave files (ransom notes) named ### DECRYPT MY FILES ###.txt.
There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

This is a cry36 variant and apparently not decrypted at this time, see: https://support.emsisoft.com/topic/27231-cry9-invalid-crypton-file-pair/?page=4#comment-171791

IBM Storwize V3700 Commands

Here is a listing of commands on the IBM Storwize V3700 along with their descriptions.

Command Description
activatefeature Activates a function using a trial period or license key.
addhostiogrp Maps I/O groups to a host object.
addhostport Adds worldwide port names (WWPNs) or iSCSI names to a host object.
addvdiskaccess Adds to the set of I/O groups in which a Volume can be made accessible to hosts.
addvdiskcopy Adds a copy to an existing volume
applydrivesoftware Upgrades drives.
applysoftware Updates the system code.
cancellivedump Cancels a livedump.
catauditlog Displays the in-memory contents of the audit log.
cfgportip Assigns an IP address to each node canister ethernet port for iSCSI I/O.
charray Changes the attributes of an array.
charraymember Changes an array member's attributes, or swaps a member of a RAID array.
chauthservice Configures the remote authentication service of the system.
chcontroller Changes the attributes of a controller.
chcurrentuser Changes the attributes of the current user.
chdrive Change the attributes of a drive.
chemail Sets or changes contact information for email event notifications.
chemailserver Changes the attributes of an email server.
chemailuser Changes the attributes for an email recipient.
chenclosure Changes enclosure properties.
chenclosurecanister Changes the properties of an enclosure canister.
chenclosureslot Changes the properties of an enclosure slot.
cherrstate Marks an unfixed error as fixed or a fixed error as unfixed.
cheventlog Changes events in the event log.
chfcconsistgrp Changes the attributes of a FlashCopy consistency group.
chfcmap Changes the attributes of a FlashCopy mapping.
chhost Changes the attributes of a host object.
chiogrp Changes the name and other attributes of an I/O group.
chldap Changes the system-wide Lightweight Directory Access Protocol (LDAP) configuration.
chldapserver Changes a Lightweight Directory Access Protocol (LDAP) server.
chmdisk Changes the attributes of a managed disk.
chmdiskgrp Changes the attributes of a storage pool.
chnodecanister Changes the name and other attributes of a node canister.
chnodecanisterhw Updates the hardware configuration for a node canister.
chpartnership Changes the partnership bandwidth between the local and remote system.
chquorum Changes the quorum association.
chrcconsistgrp Changes the attributes of a Metro Mirror or Global Mirror consistency group
chrcrelationship Changes the attributes of a Metro Mirror or Global Mirror relationship.
chsecurity Changes security settings.
chsnmpserver Changes the attributes of an SNMP server.
chsyslogserver Changes the attributes of a syslog server.
chsystem Changes the attributes of an existing system.
chsystemip Changes the IP configuration parameters for the system.
chuser Changes the attributes of a user.
chusergrp Changes the attributes of a user group.
chvdisk Changes the attributes of a volume.
cleardumps Cleans the dump directories on a specified node canister.
clearerrlog Clears all entries from the event log.
cpdumps Copies dump files to the configuration node canister from another node canister.
deactivatefeature Deactivates a function.
detectmdisk Detects new managed disks and rebalances managed disk access.
dumpallmdiskbadblocks Dumps bad block counts to a dump.
dumpauditlog Resets or clears the contents of the in-memory audit log.
dumperrlog Dumps the contents of the event log to a text file.
dumpmdiskbadblocks Writes managed disk bad block counts and locations to a dump.
enablecli Enables the CLI for a recovered system.
expandvdisksize Expands the size of a volume by a given capacity.
finderr Finds the highest severity unfixed error in the event log.
includemdisk Includes a managed disk that has been excluded by the system.
lsarray Displays array managed disks
lsarrayinitprogress Displays the progress of array background initialization.
lsarraylba Displays an array logical block address (LBA) for a drive and LBA.
lsarraymember Displays the member drives of one or more array managed disks.
lsarraymembergoals Displays the spare goals for member drives of one or more array members.
lsarraymemberprogress Displays array member background process status.
lsarraysyncprogress Displays how synchronized a RAID array is.
lscontroller Displays the controllers visible to the system.
lscopystatus Displays whether any file copies are currently in progress.
lscurrentuser Displays the name and role of the logged-in user.
lsdependentvdisks Displays which volumes will go offline if you remove a piece of hardware from the system.
lsdiscoverystatus Displays whether a discovery operation is in progress.
lsdrive Displays configuration information and drive VPD.
lsdrivelba Maps array managed disk logical block address (LBA) to a set of drives.
lsdriveprogress Displays the progress of various drive tasks.
lsdriveupgradeprogress Displays the progress of drive firmware upgrade.
lsdumps Displays files in a dumps directory on one of the node canisters in the system.
lsemailserver Displays the email servers configured on the system.
lsemailuser Displays email event notification settings for email recipients.
lsenclosure Displays a summary of the enclosures.
lsenclosurebattery Displays information about the batteries in the enclosure PSUs.
lsenclosurecanister Displays status for each canister in an enclosure.
lsenclosurechassis Displays information about the enclosure chassis.
lsenclosurepsu Displays information about each power-supply unit (PSU) in the enclosure.
lsenclosureslot Displays information about each drive slot in the enclosure.
lsenclosurestats Displays enclosure statistics.
lseventlog Displays system event log information.
lsfabric Displays a report of the Fibre Channel connectivity between node canisters, controllers and hosts.
lsfcconsistgrp Displays the FlashCopy consistency groups on the system.
lsfcmap Displays the FlashCopy mappings on the system.
lsfcmapcandidate Displays volumes available to create FlashCopy mappings.
lsfcmapdependentmaps Displays the FlashCopy mappings that are dependent on a specified mapping.
lsfcmapprogress Displays the progress of the background copy of a FlashCopy mapping.
lsfcportcandidate Displays unconfigured, logged-in SAS host bus adapter (HBA) ports.
lsfeature Displays available features.
lsfreeextents Displays the number of free extents available on a managed disk.
lshbaportcandidate Displays unconfigured, logged-in host bus adapter (HBA) ports.
lshost Displays the hosts visible to the system.
lshostiogrp Displays the I/O groups associated with a specified host.
lshostvdiskmap Displays volumes that are mapped to a given host.
lsiogrp Displays the I/O groups on the system.
lsiogrpcandidate Displays I/O groups that can have node canisters added to them.
lsiogrphost Displays the hosts mapped to an I/O group.
lsiscsiauth Displays the Challenge Handshake Authentication Protocol (CHAP) secret configured for authenticating an entity to the system.
lsldap Displays the system-wide Lightweight Directory Access Protocol (LDAP) configuration.
lsldapserver Displays all configured Lightweight Directory Access Protocol (LDAP) servers.
lslivedump Displays the livedump state of a node canister.
lsmdisk Displays the managed disks visible to the system.
lsmdiskcandidate Displays unmanaged disks by ID.
lsmdiskextent Displays the extent allocation between managed disks and volumes.
lsmdiskgrp Displays the storage pools on the system.
lsmdisklba Displays managed disk and logical block address (LBA) for a volume LBA.
lsmdiskmember Displays the volumes using extents on the specified managed disks.
lsmigrate Displays the progress of current data migration operations.
lsnodecanister Displays the node canisters that are part of the system.
lsnodecanisterhw Displays the hardware configuration of node canisters in the system.
lsnodecanisterstats Displays node canister statistics.
lsnodecanistervpd Displays the vital product data (VPD) for each node canister.
lspartnership Displays the current systems partnered with the local system.
lspartnershipcandidate Displays systems available for setting up a partnership with.
lsportfc Displays information about the Fibre Channel I/O ports.
lsportip Displays the iSCSI IP addresses assigned for each port on each node canister in the system.
lsportsas Displays information about the SAS ports.
lsportusb Displays information about the USB ports used for encryption.
lsquorum Displays the managed disks or drives the system is currently using to store quorum data.
lsrcconsistgrp Displays the Metro or Global Mirror consistency on the system.
lsrcrelationship Displays the Metro or Global Mirror relationships on the system.
lsrcrelationshipcandidate Displays volumes available to form Metro Mirror or Global Mirror relationships.
lsrcrelationshipprogress Displays the progress of the background copy of a Metro Mirror or Global Mirror relationship.
lsrepairsevdiskcopyprogress Displays the repair progress for space-efficient volume copies.
lsrepairvdiskcopyprogress Displays the progress of volume repairs and validations.
lsrmvdiskdependentmaps Displays all mappings that must be stopped for a volume to be deleted.
lsroute Displays the IP routing table.
lssasfabric Displays which canisters are visible to a node canister, and the order of these canisters.
lssasportcandidate Displays unconfigured, logged-in FC host bus adapter (HBA) ports.
lssecurity Internal use only.
lssevdiskcopy Displays the space-efficient copies of volumes.
lssnmpserver Displays the SNMP servers configured on the system.
lssyslogserver Displays the syslog servers configured on the system.
lssystem Displays the local system.
lssystemip Displays the system management IP addresses configured for each port.
lssystemstats Displays the most recent values or a history of canister statistics.
lstimezones Displays the time zones that are available on the system.
lsupdate Displays information about system, enclosure, and drive update.
lsuser Displays the users created on the system.
lsusergrp Displays the user groups created on the system.
lsvdisk Displays the volumes on the system.
lsvdiskaccess Displays which IO groups volumes are accessible through.
lsvdiskcopy Displays volume copy information.
lsvdiskdependentmaps Displays FlashCopy mappings with target volumes dependent upon data held on a specified volume.
lsvdiskextent Displays the managed disk extents that are provided for volumes.
lsvdiskfcmapcopies Displays all mappings with a target volume containing a valid copy of a volume.
lsvdiskfcmappings Displays the FlashCopy mappings to which a volume belongs.
lsvdiskhostmap Displays volume to host mappings.
lsvdisklba Displays the volume and logical block address (LBA) for a managed disk LBA.
lsvdiskmember Displays the managed disks that are members of a volume.
lsvdiskprogress Displays the progress during new volume formatting.
lsvdisksyncprogress Displays the progress of volume copy synchronization.
migrateexts Migrates extents from one managed disk to another.
migratevdisk Migrates an entire volume from one storage pool to another.
mkarray Creates a managed disk array and adds it to a storage pool.
mkemailserver Creates an email server.
mkemailuser Adds an email recipient of event and inventory notifications.
mkfcconsistgrp Creates a new FlashCopy consistency group.
mkfcmap Creates a new FlashCopy mapping.
mkfcpartnership mkfcpartnership
mkhost Creates a logical host object.
mkippartnership mkippartnership
mkldapserver Creates a Lightweight Directory Access Protocol (LDAP) server.
mkmdiskgrp Creates a storage pool.
mkpartnership Creates a one-way Metro Mirror or Global Mirror partnership between the local and remote system.
mkrcconsistgrp Creates a Metro Mirror or Global Mirror consistency group.
mkrcrelationship Creates a new Metro Mirror or Global Mirror relationship.
mksnmpserver Creates an SNMP server to receive notifications.
mksyslogserver Creates a syslog server to receive notifications.
mkuser Creates a local or a remote user to access a system.
mkusergrp Creates a user group.
mkvdisk Creates a sequential, striped, or image mode volume.
mkvdiskhostmap Creates a mapping between a volume and a host.
movevdisk Changes the caching I/O group of a Volume.
ping Diagnoses IP configuration.
preplivedump Reserves system resources required for a livedump.
prestartfcconsistgrp Prepares a FlashCopy consistency group for starting.
prestartfcmap Prepares a FlashCopy mapping for starting.
recoverarray Recovers a corrupt array.
recoverarraybysystem Recovers a corrupt array.
recovervdisk Acknowledges volume data loss and brings the volume back online.
recovervdiskbyiogrp Acknowledges data loss for all volumes in the specified I/O group and brings the volumes back online.
recovervdiskbysystem Acknowledges data loss for all volumes in the system and brings the volumes back online.
repairsevdiskcopy Repairs the metadata on a space-efficient volume.
repairvdiskcopy Detects and corrects any volume copies that are not identical.
resetleds Simultaneously switches off all LEDs in the system.
rmarray Removes a managed disk array from the configuration.
rmemailserver Deletes an email server.
rmemailuser Remove an email recipient from your system.
rmfcconsistgrp Deletes a FlashCopy consistency group.
rmfcmap Deletes an existing FlashCopy mapping.
rmhost Deletes a host object.
rmhostiogrp Deletes mappings between I/O groups and a host object.
rmhostport Deletes worldwide port names (WWPNs) or iSCSI names from a host object.
rmldapserver Deletes a Lightweight Directory Access Protocol (LDAP) server.
rmmdisk Deletes a managed disk from a storage pool.
rmmdiskgrp Deletes a storage pool.
rmnodecanister Deletes a node canister from the system.
rmpartnership Removes a Metro Mirror or Global Mirror partnership on one system.
rmportip Removes an iSCSI IP address from a node canister ethernet port.
rmportip_tms Removes properties of an IP port.
rmrcconsistgrp Deletes a Metro Mirror or Global Mirror consistency group.
rmrcrelationship Deletes a Metro Mirror or Global Mirror relationship.
rmsnmpserver Delete an SNMP server.
rmsyslogserver Deletes a syslog server.
rmuser Deletes a user.
rmusergrp Deletes a user group.
rmvdisk Deletes a volume.
rmvdiskaccess Deletes from the set of I/O groups in which a Volume can be made accessible to hosts.
rmvdiskcopy Removes a volume copy.
rmvdiskhostmap Deletes a volume-to-host mapping.
sainfo Displays service action views.
satask Performs service action tasks.
sendinventoryemail Sends an inventory email to all recipients enabled to receive inventory email notifications.
setdisktrace Sets a list of disks of a given type to include in a disk trace.
setlocale Changes the locale setting and command output to the chosen language.
setpwdreset Views or changes the status of the password-reset feature.
setsystemtime Sets the time for the system.
settimezone Sets the time zone for the system.
settrace Sets options for tracing I/O operations.
showtimezone Displays the current time zone settings for the system.
shrinkvdisksize Reduces the size of a volume by the specified capacity.
splitvdiskcopy Creates a separate volume from a synchronized copy of a mirrored volume.
startemail Activates the email and inventory notification function.
startfcconsistgrp Starts a FlashCopy consistency group.
startfcmap Starts a FlashCopy mapping.
startrcconsistgrp Starts the Metro Mirror or Global Mirror consistency group copy process.
startrcrelationship Starts the Metro Mirror or Global Mirror relationship copy process.
startstats Changes the interval at which per-node canister statistics are collected.
starttrace Starts tracing I/O operations.
stopemail Stops the email and inventory notification function.
stopfcconsistgrp Stops all processing associated with a FlashCopy consistency group.
stopfcmap Stops all processing associated with a FlashCopy mapping.
stoprcconsistgrp Stops the copy process for a Metro Mirror or Global Mirror consistency group, or enables write access to the secondary volumes in the group.
stoprcrelationship Stops the copy process for a Metro Mirror or Global Mirror stand-alone relationship, or enables write access to a consistent secondary volume.
stopsystem Shuts down a single node canister or the entire system.
stoptrace Stops tracing I/O operations for the specified disk type.
svc_livedump Triggers a livedump of the system.
svc_snap Collects log files used by support for troubleshooting.
svcconfig Recovers, restores, or creates a backup of the system configuration.
switchrcconsistgrp Reverses the roles of primary and secondary volumes in a Metro Mirror or Global Mirror consistency group.
switchrcrelationship Reverses the roles of primary and secondary volumes in a stand-alone Metro Mirror or Global Mirror relationship.
testemail Sends a test email notification to one user or to all users of the email notification function.
testldapserver Tests a Lightweight Directory Access Protocol (LDAP) server.
triggerdrivedump Collects support data from a disk drive.
triggerenclosuredump Forces the specified enclosure or enclosures to dump data.
triggerlivedump Captures a livedump to the internal disk on the node canister.