count of processes returned from SNMP item

[arikin]

I am trying to count the number of entries that match "httpd" at the time of check. Like a snapshot sampling.

Type: SNMPv2 agent
SNMP OID: HOST-RESOURCES-MIB::hrSWRunIndex["index","hrSWRunName", "httpd"]
SNMP community: public
SNMP port: 161
Key: hrSWRunName.httpd
Type of information: Text

It only returns the parent PID of the matching process...
Is there a way to returned all matches and count them?
Saw a count function but that seems to be for the zabbix_agent.

This agent-less SNMP method is turning out to be lots of fun

[wikisb]

Hi Arikin
if you want to count the number of processes of one service (sshd, httpd, postgres, ....) you have to modify the snmp.conf.
For example if you want to count the number of processes of httpd that are running in one machine, in the snmp.conf of that machine you should add:
"proc httpd" you can put it anywhere in the file.
then if you restart snmpd and add in zabbix an item (snmp) with OID:
"1.3.6.1.4.1.2021.2.1.5.1"
zabbix will get the number of processes of type httpd that are running in that machine

if you put more than one like:
"proc httpd" -> OID:1.3.6.1.4.1.2021.2.1.5.1
"proc sshd" -> OID: 1.3.6.1.4.1.2021.2.1.5.2

the same happens when you want to monitorize the HD of a machine with lots of partitions.
you should add for each partition in snmp.conf
"disk /" so you can get HDtotal or HDused of that partition. -> "disk partitionname"
"disk /data"
"disk /boot"
you have to restart snmpd so it works.
and then with the apropiate OID you can get the info you want
1.3.6.1.4.1.2021.9.1.6.x -> HDtotal
1.3.6.1.4.1.2021.9.1.8.x -> HDused

SNMP rules!!

[arikin]

Out of our hands

wikisb,

Thank you very much for a complete solution.

It didn't work with NET-SNMP 5.5 on FreeBSD but that probably has something to do with other settings.

Sad thing is that we can't ask all our customers to adjust their snmp settings.

Maybe I just have to borrow from a nagios plugin that counts all matching process STRINGS... Need to adjust the return values from that script though. But its all perl so that will be easy.

http://nagios.manubulon.com/snmp_process.html

[arikin]

External script

To save people reading this, trial and error here is how I "got my data"

This is a script from the Net::SNMP examples

That was quickly modified to input & output in Zabbix acceptable formats (maybe).

1) I am using Centos 6 with zabbix installed via yum
My zabbix server setting was in /etc/zabbix/
So did a quick grep to find the scripts directory:

cat /etc/zabbix/zabbix_server.conf | grep ExternalScripts
    ### Option: ExternalScripts
    # ExternalScripts=/etc/zabbix/externalscripts
    ExternalScripts=/etc/zabbix/externalscripts

2) Went there and made a file to paste into.

cd /etc/zabbix/externalscripts
nano proc_count.pl
chown zabbix:zabbix proc_count.pl
chmod 755 proc_count.pl

3) Added custom macros to the Host. If you have to allow for custom snmp ports per host.
{$COMMUNITY}
{$SNMP.PORT}

4) Created a new Template
PROC COUNT

5) Added an Item to that template.
Description: HTTPD
Type: External check
Key: proc_count.pl[{$COMMUNITY} {$SNMP.PORT} 'httpd']
Type of information: Numeric (unsigned)

6) Went back to the Host and added that template to "Linked templates"

Below is the actual code. I tried to use named parameters but the host address being passed as default messed that up. This script is simple so you can edit it for your own purposes.

Note: If you don't have Net::SNMP module then be sure to install it first:

perl -MCPAN -e shell
  cpan> install Net::SNMP

#!/usr/bin/perl

use strict;
use warnings;

use Net::SNMP qw(:snmp);

# run_name_table
my $OID_ifTable = '1.3.6.1.2.1.25.4.2.1.2';

my $OID_ifPhysAddress = '1.3.6.1.2.1.2.2.1.6';
my $hostname  = $ARGV[0];
my $community = $ARGV[1] || 'public';
my $port      = $ARGV[2] || 161;
my $process   = $ARGV[3];
my $count     = 0;

if ( defined($hostname) && defined($process) ) {
  my ($session, $error) = Net::SNMP->session(
     -hostname    => $hostname,
     -community   => $community,
     -port        => $port,
     -nonblocking => 1,
     -translate   => [-octetstring => 0],
     -version     => 'snmpv2c',
  );

  if (!defined $session) {
    printf "ERROR: %s.\n", $error;
    exit 1;
  }

  my %table; # Hash to store the results

  my $result = $session->get_bulk_request(
     -varbindlist    => [ $OID_ifTable ],
     -callback       => [ \&table_callback, \%table ],
     -maxrepetitions => 1,
  );

  if (!defined $result) {
    printf "ERROR: %s\n", $session->error();
    $session->close();
    exit 1;
  }

  # Now initiate the SNMP message exchange.
  snmp_dispatcher();
  $session->close();

  # Print the results, specifically formatting ifPhysAddress.

  for my $oid (oid_lex_sort(keys %table)) {
    if ($table{$oid} eq $process) {
      #printf "%s = %s\n", $oid, unpack 'H*', $table{$oid};
      $count++;
    }
  }
}

print "$count";

exit 0;

sub table_callback {
  my ($session, $table) = @_;

  my $list = $session->var_bind_list();

  if (!defined $list) {
    printf "ERROR: %s\n", $session->error();
    return;
  }

  # Loop through each of the OIDs in the response and assign
  # the key/value pairs to the reference that was passed with
  # the callback.  Make sure that we are still in the table
  # before assigning the key/values.

  my @names = $session->var_bind_names();
  my $next  = undef;

  while (@names) {
    $next = shift @names;
    if (!oid_base_match($OID_ifTable, $next)) {
      return; # Table is done.
    }
    $table->{$next} = $list->{$next};
  }

  # Table is not done, send another request, starting at the last
  # OBJECT IDENTIFIER in the response.  No need to include the
  # calback argument, the same callback that was specified for the
  # original request will be used.

  my $result = $session->get_bulk_request(
     -varbindlist    => [ $next ],
     -maxrepetitions => 10,
  );

  if (!defined $result) {
    printf "ERROR: %s.\n", $session->error();
  }

  return;
}

Notes:
- This script assumes SNMPv2. Best to copy it and make a ver. 3 or work in another parameter for that.
- If you don't want custom SNMP ports just replace that with 161 in the script and remove the macro.
- Basic error checking is done but... no guarantees.
- SNMP logs shows about 7-10 accesses to get the table information. The whole Process table would have taken 52 accesses in comparison. That is for each time the script is ran.
- Open to any ideas or improvements. Only about 5% of it is my work anyway.
- Made the process name static because otherwise all the item keys would be the same and you would get an error if you tried to use more than one of them.