SNMP Detecting absense of a value

[netgeek1979]

Greetings,

I am trying to (in my case) detect VIA SNMP whether SQL is running. We have the port check covered, but we also want to ensure that the SQLSERVER.exe service is actually running.

I've managed to detect formulate my item as:
HOST-RESOURCES-MIB::hrSWRunStatus["index","HOST-RESOURCES-MIB::hrSWRunName","sqlservr.exe"]

This gives a "1" if it finds it; and is nonexistent in 'latest data' when SQL is down.

This is part of the problem; as when SQL is down, that value in that table no longer exists & the item goes to 'Not Supported".

In this case; the nonexistence is an error and I would like to trap it as such, but to no avail.

I had attempted to use a ....sqlservr.exe.nodata(60)}=1 trigger to try to trap this to no avail.

[welkin]

I'm also interested in a solution for this issue


regards welkin

[netgeek1979]

I've come across this:

https://support.zabbix.com/browse/ZBX-1003

But that was done in 1.6 way back in '09.

I would have assumed that something got into the actual code since thing. Even at that; this does seem like a hack and it seems like a reasonable thing to know when something was there; and then it's not there.

Especially if it's something like a disk!

disk s:\ is there
oh no! disk s:\ isn't there!
Alert!
:-)

[netgeek1979]

It appears that fundamentally; the 'nodata' check reports just fine on a static OID.

It's when we're doing the Index lookup that it appears to fail. I imagine there should be a way to tell the indexing to 'expect' that the lookup may fail and thus report no data (so nodata() can pick up on it).

[Zaniwoop]

Is there any reason why you want to do it via SNMP?

It's very easy to do via the agent.

[welkin]

In my case i monitor VPN Tunnels on a Fortigate untit. I don`t think there`s an agent for the FortiOS

regards
welkin

[netgeek1979]

I agree;

I'm sure the agent will do it just fine. My concern at this point is:

Why is there not consistency between how the agent functions & how SNMP functions. As a fundamental design issue; I would hope that the core idea is to present data at the same level "somewhere" in zabbix.

This, alas, seems to not be the case as the thinking of SNMP data collection does not seem to follow the same flow/rules as the agent.

In my particular environment (high security), we do not allow anything that's not 100% critical on our servers. (yes, I know the argument there, and yes I've made it).


I'm also using some things as an example, but welkin provides another great one. There are devices that do not allow the agent at all, but have dynamic OID's that disappear that we would like to be alerted on.



Interestingly enough; my engineer things he has come up with a fairly elegant solution, but we won't use it unless it gets accepted into the mainline code.

We're currently researching what it takes to contribute; since it appears that the zabbix code isn't easily contributed to.


He sees the issue as this:
If we have recieved data from an OID/Index previously, then instead of setting:
ret = UNSUPPORTED;

We'll return supported, but no data. This way the 'nodata' check can trigger and we're off to the prophesied land of OZ.


Any ideas on the best way to get this in?