SNMP – Page 2 – techish.net

IBM Storwize V3700 Service Module

The IBM Storwize V3700 does not support SNMP, only sending of SNMP traps. So to view the hardware in a canister of the V3700, you can access the Service console by HTTP using the IP address of the management interface you’ve configured.

Example: http://192.168.1.100/service

This is a different web interface than the standard http://192.168.1.100/ web interface.

You can also look at hardware on the console by SSHing to the V3700 unit.

Here are the informational commands as of v7.6 Storwize V3700.

Command	Description
lsarray	Displays array managed disks
lsarrayinitprogress	Displays the progress of array background initialization.
lsarraylba	Displays an array logical block address (LBA) for a drive and LBA.
lsarraymember	Displays the member drives of one or more array managed disks.
lsarraymembergoals	Displays the spare goals for member drives of one or more array members.
lsarraymemberprogress	Displays array member background process status.
lsarraysyncprogress	Displays how synchronized a RAID array is.
lscontroller	Displays the controllers visible to the system.
lscopystatus	Displays whether any file copies are currently in progress.
lscurrentuser	Displays the name and role of the logged-in user.
lsdependentvdisks	Displays which volumes will go offline if you remove a piece of hardware from the system.
lsdiscoverystatus	Displays whether a discovery operation is in progress.
lsdrive	Displays configuration information and drive VPD.
lsdrivelba	Maps array managed disk logical block address (LBA) to a set of drives.
lsdriveprogress	Displays the progress of various drive tasks.
lsdriveupgradeprogress	Displays the progress of drive firmware upgrade.
lsdumps	Displays files in a dumps directory on one of the node canisters in the system.
lsemailserver	Displays the email servers configured on the system.
lsemailuser	Displays email event notification settings for email recipients.
lsenclosure	Displays a summary of the enclosures.
lsenclosurebattery	Displays information about the batteries in the enclosure PSUs.
lsenclosurecanister	Displays status for each canister in an enclosure.
lsenclosurechassis	Displays information about the enclosure chassis.
lsenclosurepsu	Displays information about each power-supply unit (PSU) in the enclosure.
lsenclosureslot	Displays information about each drive slot in the enclosure.
lsenclosurestats	Displays enclosure statistics.
lseventlog	Displays system event log information.
lsfabric	Displays a report of the Fibre Channel connectivity between node canisters, controllers and hosts.
lsfcconsistgrp	Displays the FlashCopy consistency groups on the system.
lsfcmap	Displays the FlashCopy mappings on the system.
lsfcmapcandidate	Displays volumes available to create FlashCopy mappings.
lsfcmapdependentmaps	Displays the FlashCopy mappings that are dependent on a specified mapping.
lsfcmapprogress	Displays the progress of the background copy of a FlashCopy mapping.
lsfcportcandidate	Displays unconfigured, logged-in SAS host bus adapter (HBA) ports.
lsfeature	Displays available features."
lsfreeextents	Displays the number of free extents available on a managed disk.
lshbaportcandidate	Displays unconfigured, logged-in host bus adapter (HBA) ports.
lshost	Displays the hosts visible to the system."
lshostiogrp	Displays the I/O groups associated with a specified host.
lshostvdiskmap	Displays volumes that are mapped to a given host.
lsiogrp	Displays the I/O groups on the system.
lsiogrpcandidate	Displays I/O groups that can have node canisters added to them.
lsiogrphost	Displays the hosts mapped to an I/O group.
lsiscsiauth	Displays the Challenge Handshake Authentication Protocol (CHAP) secret configured for authenticating an entity to the system.
lsldap	Displays the system-wide Lightweight Directory Access Protocol (LDAP) configuration.
lsldapserver	Displays all configured Lightweight Directory Access Protocol (LDAP) servers.
lslivedump	Displays the livedump state of a node canister.
lsmdisk	Displays the managed disks visible to the system.
lsmdiskcandidate	Displays unmanaged disks by ID.
lsmdiskextent	Displays the extent allocation between managed disks and volumes.
lsmdiskgrp	Displays the storage pools on the system.
lsmdisklba	Displays managed disk and logical block address (LBA) for a volume LBA.
lsmdiskmember	Displays the volumes using extents on the specified managed disks.
lsmigrate	Displays the progress of current data migration operations.
lsnodecanister	Displays the node canisters that are part of the system.
lsnodecanisterhw	Displays the hardware configuration of node canisters in the system.
lsnodecanisterstats	Displays node canister statistics.
lsnodecanistervpd	Displays the vital product data (VPD) for each node canister.
lspartnership	Displays the current systems partnered with the local system.
lspartnershipcandidate	Displays systems available for setting up a partnership with.
lsportfc	Displays information about the Fibre Channel I/O ports.
lsportip	Displays the iSCSI IP addresses assigned for each port on each node canister in the system.
lsportsas	Displays information about the SAS ports.
lsportusb	Displays information about the USB ports used for encryption.
lsquorum	Displays the managed disks or drives the system is currently using to store quorum data.
lsrcconsistgrp	Displays the Metro or Global Mirror consistency on the system.
lsrcrelationship	Displays the Metro or Global Mirror relationships on the system.
lsrcrelationshipcandidate	Displays volumes available to form Metro Mirror or Global Mirror relationships.
lsrcrelationshipprogress	Displays the progress of the background copy of a Metro Mirror or Global Mirror relationship.
lsrepairsevdiskcopyprogress	Displays the repair progress for space-efficient volume copies.
lsrepairvdiskcopyprogress	Displays the progress of volume repairs and validations.
lsrmvdiskdependentmaps	Displays all mappings that must be stopped for a volume to be deleted.
lsroute	Displays the IP routing table.
lssasfabric	Displays which canisters are visible to a node canister, and the order of these canisters.
lssasportcandidate	Displays unconfigured, logged-in FC host bus adapter (HBA) ports.
lssecurity	Internal use only."
lssevdiskcopy	Displays the space-efficient copies of volumes.
lssnmpserver	Displays the SNMP servers configured on the system.
lssyslogserver	Displays the syslog servers configured on the system.
lssystem	Displays the local system.
lssystemip	Displays the system management IP addresses configured for each port.
lssystemstats	Displays the most recent values or a history of canister statistics.
lstimezones	Displays the time zones that are available on the system.
lsupdate	Displays information about system, enclosure, and drive update.
lsuser	Displays the users created on the system.
lsusergrp	Displays the user groups created on the system.
lsvdisk	Displays the volumes on the system.
lsvdiskaccess	Displays which IO groups volumes are accessible through.
lsvdiskcopy	Displays volume copy information.
lsvdiskdependentmaps	Displays FlashCopy mappings with target volumes dependent upon data held on a specified volume.
lsvdiskextent	Displays the managed disk extents that are provided for volumes.
lsvdiskfcmapcopies	Displays all mappings with a target volume containing a valid copy of a volume.
lsvdiskfcmappings	Displays the FlashCopy mappings to which a volume belongs.
lsvdiskhostmap	Displays volume to host mappings.
lsvdisklba	Displays the volume and logical block address (LBA) for a managed disk LBA.
lsvdiskmember	Displays the managed disks that are members of a volume.
lsvdiskprogress	Displays the progress during new volume formatting.

Sending SNMP Traps of Windows Events

Furthering my build-out for a monitoring solution which includes Observium as the primary SNMP polling system, I am writing an application to handle SNMP traps from my Windows servers.
Most of my servers are Windows 2008 R2 or Windows 2012 R2. With that being said, I can use evntwin.exe on the servers to setup traps for specific event logs on my Windows servers and send them to my trap receiver to further classify and alert/notify.
There are a few steps involved in the overall process here.

Create a Custom Event Log Source

Before I can translate a specific event log entry, I create an event log source DevTrap and use an Event ID of 1000. This is optional, as you’ll see in the next step you can dig right in and start filtering traps from any existing Event Log sources.

C:>eventcreate /T success /id 1000 /l application /d Test event to be trapped. /so DevTrap

Translate Events to Traps

Using evntwin.exe, I click on Custom and then Edit >>

From here, I can navigate the event log tree in the left pane and find my DevTrap source in the Application log.

Double clicking on the row will give me some properties for the event and allow me to modify when to generate the trap based on number of events within a specific time period. I left this as default since I’ll be testing manually and this won’t generate hundreds of traps.

Now the event is listed in the Events to be translated to traps box. I need to Apply and then Export the trap translations. If I wanted to add more, I could simply keep going before clicking Apply and Export.

When the Export dialog box opens, it wants to know where to save the configuration for the translations. Choose a location that makes sense. After saving, you can close evntwin.exe program.

A Look at events.cnf

So the events.cnf file was exported in the previous step. This file contains commands that will be used with evntcmd.exe to actually process and do something with the translations. Here is what my file contains thus far.

The format of the #pragma add line is:

#pragma add <LogName> <SourceName> <EventID> <EventCount> <TimeInterval>

I need to add a trap destination and community to this file:

#pragma ADD_TRAP_DEST public 10.147.204.88

I add the line and save my changes and the file looks as follows.

Here is a useful table if you want to build the file manually and include the trap destination. Find more information on the use of evntcmd.exe at Microsoft’s TechNet article.

ADD	specifies that you want to add an event to trap configuration.
DELETE	specifies that you want to remove an event to trap configuration
DELETE_TRAP_DEST	specifies that you do not want trap messages to be sent to a specified host within a community
ADD_TRAP_DEST	specifies that you want trap messages to be sent to a specified host within a community.
CommunityName	specifies, by name, the community in which trap messages are sent.
HostID	specifies, by name or IP address, the host to which you want trap messages to be sent
EventLogFile	specifies the file in which the event is recorded
EventSource	specifies the application that generates the event.
EventID	specifies the unique number that identifies each event

Using evntcmd.exe

Now that I have the configuration file as needed, I use evntcmd.exe to configure the trap translations and trap destinations. Run the command from an elevated command prompt.

evntcmd.exe events.cf

Here is what the output looks like after running the command.

At this point, any event logged in Application as source of DevTrap with ID of 1000 will send a trap to my manager on 10.147.204.88. I can test this by generating an event and monitoring my trap manager server to make sure I see it come across.

C:>eventcreate /T success /id 1000 /l application /d Test event to be trapped. /so DevTrap

Monitor ESXi Free using SNMP

ESXi 4.1 and 5.0 Enable SNMP

SSH to host and edit the SNMP.XML file:

vi /etc/vmware/snmp.xml

Make the following changes:

<config>
<snmpSettings>
<enable>true</enable>
<communities>public</communities>
<targets>192.168.1.100@public</targets>
</snmpSettings>
</config>

Restart management agents with the following command:

/etc/init.d/hostd restart

On ESXi 5.1 and 5.5 enable SNMP

SSH to host and run the following command:

esxcli system snmp set --communities=public --enable=yes --targets=192.168.1.100/public

Test SNMP trap

vicfg-snmp --server <ESXiServerIP> --username root --password <Password> --test

Reviewing the SNMP configuration

When I look at my SNMP configuration using vCLI (once again, this is a read operation so I can use vCLI), I see the following.

vi-admin@vma:~> vicfg-snmp --server <ESXiServerIP> --username root --password <Password> -s
Current SNMP agent settings:
Enabled : 1
UDP port : 161
Communities :
public
Notification targets :
192.168.1.100@162/public
Options :
EnvEventSource=indications

Cacti Cisco ASA Host Template

Came across a decent host template for Cisco ASA devices that works well with Cacti.
Grab the CISCO-FIREWALL-MIB if you don’t already have them. Get either Version 1 or Version 2 directly from Cisco and also get CISCO-SMI Version 1 or Version 2:

Determine where your MIBs are stored on your linux system:

linuxhost:~# snmptranslate -Dinit_mib .1.3|grep MIBDIRS
init_mib: Seen MIBDIRS: Looking in [...snip...] for mib dirs ...

You can use wget to download the MIB file version you want and specify where to save it according to one of the paths in the MIBDIRS output… I like putting them in /usr/share/snmp/mibs. Make sure the directory exists, if it doesn’t, just issue the following command:

linuxhost:~# mkdir -p /usr/share/snmp/mibs

Now, download the each of the MIBs (CISCO-FIREWALL-MIB and CISCO-SMI). Use the above links to get a direct link. I’m getting Version 2 of each of the MIBs.

linuxhost:~# wget -d -O /usr/share/snmp/mibs/CISCO-FIREWALL-MIB "ftp://ftp.cisco.com/pub/mibs/v2/CISCO-FIREWALL-MIB.my"
linuxhost:~# wget -d -O /usr/share/snmp/mibs/CISCO-SMI "ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SMI.my"

After it’s downloaded, run a test on the server and see if you can poll an ASA in your network. I’ll test the ConnectionStat entry:

linuxhost:~# snmpwalk -m +CISCO-FIREWALL-MIB  -c public -v 2c 192.168.9.253 -OS ConnectionStat
CISCO-FIREWALL-MIB::cfwConnectionStatDescription.protoIp.currentInUse = STRING: number of connections currently in use by the entire firewall
CISCO-FIREWALL-MIB::cfwConnectionStatDescription.protoIp.high = STRING: highest number of connections in use at any one time since system startup
CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.currentInUse = Counter32: 0
CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.high = Counter32: 0
CISCO-FIREWALL-MIB::cfwConnectionStatValue.protoIp.currentInUse = Gauge32: 113
CISCO-FIREWALL-MIB::cfwConnectionStatValue.protoIp.high = Gauge32: 508

It works without errors!
Notice you must specify the CISCO-FIREWALL-MIB using the -m +CISCO-FIREWALL-MIB argument.
To make this load automatically, modify your snmp.conf file. This is typically located in /etc/snmp/snmp.conf on Sys-V systems; To figure out where snmp reads it’s configuration file from, issue the following:

linuxhost:~# net-snmp-config --snmpconfpath
/etc/snmp:/usr/share/snmp:/usr/lib/snmp:/root/.snmp:/var/lib/snmp

This shows it checks each of those paths, in order, until it finds the snmp.conf; So, modify your snmp.conf file and add the following line: mibs +CISCO-FIREWALL-MIB
There may be an existing line mibs : — you can remove the colon and replace it with +CISCO-FIREWALL-MIB.
Next, run the snmpget command without the -m +CISCO-FIREWALL-MIB”and you should have success and no errors.
To get this setup in Cacti, log in to your cacti server as admin. In the console tab, navigate to the “Import Templates” menu item and click on it.

Download the Host Template zip file (from original site http://forums.cacti.net/download/file.php?id=7607 ).
Extract the files to your desktop or wherever.
In the Import Templates window, click “Browse…” and choose the cacti_host_template ZIP file to import.

You are now done.
You can create a new device and choose the Cisco ASA – Security Device from the host templates now.

Cisco IP SLA ICMP Echo Example

This is how I setup an ICMP-echo IP SLA on my Cisco Router to monitor when my internet goes out. If it goes down, I re-route traffic (I’ve excluded this part of the config). When it comes back up, I set the routing/NATing back to the original state (again, excluded from this post).
IP SLA Configuration:

ip sla 10
 ! Connection Monitor
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0
 frequency 10
ip sla schedule 10 life forever start-time now

Configure Cisco Embedded Event Manager (EEM) to handle an UP or DOWN state of SLA 10:

event manager applet primary_circuit_down
 event track 10 state down
 action 1.0 syslog msg "Primary Circuit is DOWN"
 ! You can insert other commands here to do something useful...
event manager applet main_circuit_up
 event track 10 state up
 action 1.0 syslog msg "Primary Circuit Appears UP"
 ! You can insert other commands here to do something useful...

This is the SLA configuration overview:

ciscorouter#sh ip sla conf
IP SLAs Infrastructure Engine-III
Entry number: 10 (Primary Circuit Monitor)
Owner:
Tag:
Operation timeout (milliseconds): 5000
Type of operation to perform: icmp-echo
Target address/Source interface: 8.8.8.8/GigabitEthernet0/0
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Verify data: No
Vrf Name:
Schedule:
   Operation frequency (seconds): 10  (not considered if randomly scheduled)
   Next Scheduled Start Time: Start Time already passed
   Group Scheduled : FALSE
   Randomly Scheduled : FALSE
   Life (seconds): Forever
   Entry Ageout (seconds): never
   Recurring (Starting Everyday): FALSE
   Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
   Number of statistic hours kept: 2
   Number of statistic distribution buckets kept: 1
   Statistic distribution interval (milliseconds): 20
Enhanced History:
History Statistics:
   Number of history Lives kept: 0
   Number of history Buckets kept: 15
   History Filter Type: None

Statistics of the IP SLA:

ciscorouter#sh ip sla stat
IPSLAs Latest Operation Statistics
IPSLA operation id: 10
        Latest RTT: 32 milliseconds
Latest operation start time: 17:42:41 EDT Fri Mar 30 2012
Latest operation return code: OK
Number of successes: 103
Number of failures: 0
Operation time to live: Forever