Advanced SNMP LLD - Dynamic Indexes

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

    Advanced SNMP LLD - Dynamic Indexes

    Hi all!

    I faced a problem with the new (Zabbix 2.0) Low Level Discovery (LLD) for SNMP which made LLD unusable for me. Therefore I decided to build an external script to use it for LLD. Of course it should integrate into Zabbix seamless, I did't want to re-invent the whole LLD functionality!

    Motivation
    The problem I was facing was, that I had some OIDs which hadn't the Index position in the last element of the OID. The last element of those OIDs where always zero.
    Also I hat OIDs which had more than one element I would like to use for indexing. For example some of the OIDs had a trailing IP Address as part of the OID. something like this:
    .1.2.3.4.0.1.0.1.0.198.18.0.123 = [email protected]
    .1.2.3.4.0.1.0.2.0.198.18.0.123 = Logintime
    .1.2.3.4.0.1.0.3.0.198.18.0.123 = Security Level
    .1.2.3.4.0.2.0.1.0.198.18.1.10 = [email protected]
    .1.2.3.4.0.2.0.2.0.198.18.1.10 = Logintime
    .1.2.3.4.0.2.0.3.0.198.18.1.10 = Security Level

    I wanted to use multiple Indexes to dynamically discover those values. For the example above I wanted to have 2 Indexes, first would be the Index for the User Number (1 or 2) which is Element 6, and the second Index should be the trailing IP Address.

    The build-in low level discovery for SNMP of Zabbix 2.0 only interprets the last element, therefore it was useless for me.

    Solution
    Because I couldn't solve this problem with the build-in LLD for SNMP, I built my own.

    If you are interested how I solved that problem, please check out my git repository: github.com/simonkowallik/Zabbix-Addons

    For the above example, my discovery rule looks like this:
    Name: My.Discovery.RuleName
    Key: advsnmp.discovery[{HOST.IP},"-v2c -cpublic",.1.2.3.4.0,1.1,5.4]

    I have {#ADVSNMPINDEX1} for the 1 and 2 (User Number)
    and {#ADVSNMPINDEX2} for the IP Address.

    My SNMPv2 Items of this this discovery rule will have OIDs like:
    .1.2.3.4.0.{#ADVSNMPINDEX1}.0.1.0.{#ADVSNMPINDEX2} = [email protected]
    .1.2.3.4.0.{#ADVSNMPINDEX1}.0.2.0.{#ADVSNMPINDEX2} = Logintime
    .1.2.3.4.0.{#ADVSNMPINDEX1}.0.3.0.{#ADVSNMPINDEX2} = Security Level


    I hope this little Addon is helpfull for some of you!
    Feedback is welcome!

    br,
    netmon

    #2
    Excellent, I hope that with this as a base a lot can be done.

    However in my application there is clear text as a Index. SNMP OID syntax is [lenght of text].[char1].[char2]...[charN]

    I did not do complete analysis of this as it is not easy to know what kind of information is in OID.

    I modified your code a bit to just convert index to ASCII-string. It is very rought conversion but with this you should have clear text item name based on prototype.

    Code:
     # print all INDEXES
        my $ctr = 1;
        foreach my $index ( split(/;/, $line_index) ) {
          next if (!$index);
          print "\t\t\"{#ADVSNMPINDEX$ctr}\": \"$index\",\n";
          my $temp = "";
          while ($index =~ /\.(\d{1,3})/osg) {
            if ($1 > 32 && $1 < 127) {
              $temp .= chr($1);
            }
          }
          print "\t\t\"{#ADVSNMPINDEXTEXT$ctr}\": \"$temp\",\n";
    
          $ctr++
        }

    Comment


      #3
      Hi Netmon, could you please give a look at this bug?

      https://github.com/simonkowallik/Zabbix-Addons/issues/1

      Thank you

      Comment


        #4
        Thanks a lot for your autodiscovery tool, it is exactly what I needed.

        Comment


          #5
          Originally posted by netmon View Post
          Hi all!


          I hope this little Addon is helpfull for some of you!
          Feedback is welcome!

          br,
          netmon
          Hey there! This looks extremely handy as when I query for a disk status of a Dell Equallogic SAN that is part of a group it returns statuses for each disk of each member which requires multiple indexes. One question I have is, what do I use for the item prototypes when using this as the discovery method?

          Kind regards,
          Elvar

          Comment


            #6
            Monitoring Dell Equallogics for Disk Errors

            A buddy of mine ended up writing a script for me in order to effectively monitor two Dell Equallogics for disk errors that are in an group together. I had to use this script due to the current limitations with the built in Zabbix LLD and the inability for me to get Netmon's script to work as well. Hopefully this will help some others out there who need to monitor Dell Equallogic SANs. I have attached a picture so you can get an idea of how the disk error data is displayed.



            Script attached.

            Cheers!
            Attached Files

            Comment


              #7
              As I found advsnmp.discovery script not to be flexible and I had all the time problems with command line indexing I build my own enhanced tsicsnmp.discovery.

              My script is simple and straight forward on consuming OID indices on the run. And properly generating POSTOID if something was not analyzed by commands.

              Source code can be found on github.com

              https://github.com/joriws/tsicsnmp.discovery

              Code:
              ./tsicsnmp.discovery 127.0.0.1 "-v2c -cpublic" .1.3.6.1.4.1.9.9.336.1.6.1.1.3 a 1 t e
              
              Analyzes OID index 16.78.73.45.73.78.84.69.82.78.65.84.73.79.78.65.76.12.86.105.114.116.117.97.108.76.83.48.45.51.0
              INDEX1 "a" =       aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
              INDEX2 "1" =                                                          11
              INDEX3 "t" =                                                             tttttttttttttttttttttttttttttttttttttttt
              INDEX4 "e" =                                                                                                      e
              
              Output
                 "{#TSICSNMPOID}": "16.78.73.45.73.78.84.69.82.78.65.84.73.79.78.65.76.12.86.105.114.116.117.97.108.76.83.48.45.51.0",
                 "{#TSICSNMPFULLOID}": ".1.3.6.1.4.1.9.9.336.1.6.1.1.3.16.78.73.45.73.78.84.69.82.78.65.84.73.79.78.65.76.12.86.105.114.116.117.9
                 "{#TSICSNMPPOSTOID}": "",
                 "{#TSICSNMPPOSTOIDTEXT}": "",
                 "{#TSICSNMPVALUE}": "1",
                 "{#TSICSNMPINDEX1}": "16.78.73.45.73.78.84.69.82.78.65.84.73.79.78.65.76",
                 "{#TSICSNMPINDEXTEXT1}": "NI-INTERNATIONAL",
                 "{#TSICSNMPINDEX2}": "12",
                 "{#TSICSNMPINDEXTEXT2}": "12",
                 "{#TSICSNMPINDEX3}": "86.105.114.116.117.97.108.76.83.48.45.51",
                 "{#TSICSNMPINDEXTEXT3}": "VirtualLS0-3",
                 "{#TSICSNMPINDEX4}": "0",
                 "{#TSICSNMPINDEXTEXT4}": "",
              Last edited by jhgrc; 03-10-2013, 14:51. Reason: Example command line and output

              Comment


                #8
                Hi netmon/jhgrc,

                First I want to say thanks for writing these great discovery tools.

                I apologise if the following question stems from being a beginner with Zabbix. I'm still trying to figure it out but I thought it wouldn't hurt to ask.

                After creating an external check discovery rule, which calls either of these tools, should one be able to use the macros e.g. {#TSICSNMPINDEX1} etc or {#ADVSNMPINDEX1} when providing the SNMP OID for a new item or does it only work with an item prototype?

                When I try this with a new item it shows as "Not supported" status and the zabbix_server.log has:

                "item [10.1.1.11:Test_Key] became not supported: No Such Instance currently exists at this OID"

                For example -

                Key : Test_Key
                SNMP OID: .1.3.6.1.4.1.5951.4.1.2.7.1.6.{#TSICSNMPINDEX1}.{# TSICSNMPINDEX2}.{#TSICSNMPINDEX3}

                If I snmpget the OID I think "SNMP OID" should be expanding to the value is returned fine.

                Many thanks for any assistance or guidance,

                Cheers,
                Daniel

                Comment


                  #9
                  Originally posted by danleonard80 View Post
                  After creating an external check discovery rule, which calls either of these tools, should one be able to use the macros e.g. {#TSICSNMPINDEX1} etc or {#ADVSNMPINDEX1} when providing the SNMP OID for a new item or does it only work with an item prototype?

                  When I try this with a new item it shows as "Not supported" status and the zabbix_server.log has:

                  "item [10.1.1.11:Test_Key] became not supported: No Such Instance currently exists at this OID"

                  For example -

                  Key : Test_Key
                  SNMP OID: .1.3.6.1.4.1.5951.4.1.2.7.1.6.{#TSICSNMPINDEX1}.{# TSICSNMPINDEX2}.{#TSICSNMPINDEX3}

                  If I snmpget the OID I think "SNMP OID" should be expanding to the value is returned fine.
                  Above/discussed tools should be used on item prototypes only. Items are non-dynamic. They probably could use macros but those macros are not defined in item creation time.

                  Please note, you can also use {#TSICSNMPOID} as "SNMP OID" which contains all OID indices/bytes after queried OID.

                  .1.3.6.1.4.1.5951.4.1.2.7.1.6.{#TSICSNMPOID}
                  .1.3.6.1.4.1.5951.4.1.2.7.1.5.{#TSICSNMPOID} (for another OID table/item)
                  .1.3.6.1.4.1.5951.4.1.2.7.1.10.{#TSICSNMPOID} (for another OID table/item)

                  If more support for TSICSNMP.discovery is required on this issue, please provide SNMPWALK data and Item discovery "key"/tsicsnmp.discovery command line how you analyzed data.

                  Comment


                    #10
                    I made enhancements for code. New code is available at GIT.

                    New features:
                    - i for IP-address analysis, synonym for 4 to capture 4 digits.
                    - analyzing OID from the END by adding hyphen "-" to front: i => -i
                    - this does not work for ASCII analysis "a"
                    - changed POSTOID to OIDNOTCAPTURED because OID data not analyzed can now be in the middle of OID as we can analyze from right/end.

                    Bug fixes:
                    - removed dual period printing of OIDTEXT

                    Code:
                    $ ./tsicsnmp.discovery 127.0.0.1 "-v2c -cpublic" ....1.1.5 -1 -1 1 i
                    
                    Means:
                    INDEX1 = last OID number
                    INDEX2 = second last OID number
                    INDEX3 = first OID number
                    INDEX4 = IP analysis (4 bytes)
                    
                    {
                            "data":[
                                    {
                                            "{#TSICSNMPOID}": "1.2.2.1.1.1000000.1000000000",
                                            "{#TSICSNMPFULLOID}": "....1.1.5.1.2.2.1.1.1000000.1000000000",
                                            "{#TSICSNMPOIDNOTCAPTURED}": "",
                                            "{#TSICSNMPOIDNOTCAPTUREDTEXT}": "",
                                            "{#TSICSNMPVALUE}": "4",
                                            "{#TSICSNMPINDEX1}": "1000000000",
                                            "{#TSICSNMPINDEXTEXT1}": "1000000000",
                                            "{#TSICSNMPINDEX2}": "1000000",
                                            "{#TSICSNMPINDEXTEXT2}": "1000000",
                                            "{#TSICSNMPINDEX3}": "1",
                                            "{#TSICSNMPINDEXTEXT3}": "1",
                                            "{#TSICSNMPINDEX4}": "2.2.1.1",
                                            "{#TSICSNMPINDEXTEXT4}": "2.2.1.1",
                                    },

                    Comment


                      #11
                      jhgrc, I've founded a bug into your script. The script returns a not-qualified JSON file. It ends every last OID in every JSON object by comma. But a last OID in an object MUST be ended without comma.
                      I suggest a patch for the script:

                      Code:
                      --- tsicsnmp.discovery  2014-04-23 15:47:51.000000000 +1100
                      +++ tsicsnmp2.discovery 2014-04-23 15:48:14.000000000 +1100
                      @@ -233,10 +233,12 @@
                      
                           # print OIDS in command order, initilize counter to 1 for this master oid
                           my $ctr=1;
                      +   my $firstoid=1;
                           foreach my $aoid (@{$INDEXES{$analyzed_oid}{a}}) { # go through command analyzed array
                      +      $firstoid!=0?$firstoid=0:print ",\n";
                              print "\t\t\t\"{#TSICSNMPINDEX$ctr}\": \"$aoid\",\n";
                              # check command code via index and determine ascii printing mode according to result
                      -      print "\t\t\t\"{#TSICSNMPINDEXTEXT$ctr}\": \"". asciioid($aoid, $CMD_ARRAY[$ctr-1] eq 'a'?0:1) ."\",\n";
                      +      print "\t\t\t\"{#TSICSNMPINDEXTEXT$ctr}\": \"". asciioid($aoid, $CMD_ARRAY[$ctr-1] eq 'a'?0:1) ."\"\n";
                      
                              # increase counter
                              $ctr++;

                      Comment


                        #12
                        Hi,

                        thanks for reporting this. Earlier Zabbix did not complain this so it was left unnoticed by me. Later Zabbix 2.2.3 started giving errors about JSON object so I needed to fix it.

                        I fixed the GIT-version but instead of your patch I simply pushed strings to array and joined them together outside of the loop.

                        Code:
                           my @output=();
                           foreach my $aoid (@{$INDEXES{$analyzed_oid}{a}}) { # go through command analyzed array
                              push @output,"\t\t\t\"{#TSICSNMPINDEX$ctr}\": \"$aoid\"";
                              # check command code via index and determine ascii printing mode according to result
                              push @output, "\t\t\t\"{#TSICSNMPINDEXTEXT$ctr}\": \"". asciioid($aoid, $CMD_ARRAY[$ctr-1] eq 'a'?0:1) ."\"";
                        
                              # increase counter
                              $ctr++;
                           }
                        
                           print join(",\n", @output) . "\n";

                        Comment


                          #13
                          I created a wiki page on http://zabbix.org/wiki/Advanced_SNMP_Discovery to summarize and link to the advanced SNMP discovery scripts discussed here. I also added a script for discovering multiple values having common indexes.
                          This will enable you to process things like this:
                          Code:
                          .1.2.3.4.5.6.7.8.9.0.0 = item1 descr
                          .1.2.3.4.5.6.7.8.9.0.1 = item1 descr
                          .1.2.3.4.5.6.7.8.9.0.2 = item2 descr
                          .1.2.3.4.5.6.7.8.9.0.3 = item2 descr
                          .1.2.3.4.5.6.7.8.9.0.4 = item3 descr
                          .1.2.3.4.5.6.7.8.9.0.5 = item3 descr
                          
                          .1.2.3.4.5.6.7.8.9.1.0 = statstype1 descr
                          .1.2.3.4.5.6.7.8.9.1.1 = statstype2 descr
                          .1.2.3.4.5.6.7.8.9.1.2 = statstype1 descr
                          .1.2.3.4.5.6.7.8.9.1.3 = statstype2 descr
                          .1.2.3.4.5.6.7.8.9.1.4 = statstype1 descr
                          .1.2.3.4.5.6.7.8.9.1.5 = statstype2 descr
                          
                          .1.2.3.4.5.6.7.8.9.2.0 = item1 actual stats of statstype1
                          .1.2.3.4.5.6.7.8.9.2.1 = item1 actual stats of statstype2
                          .1.2.3.4.5.6.7.8.9.2.2 = item2 actual stats of statstype1 
                          .1.2.3.4.5.6.7.8.9.2.3 = item2 actual stats of statstype2 
                          .1.2.3.4.5.6.7.8.9.2.4 = item3 actual stats of statstype1 
                          .1.2.3.4.5.6.7.8.9.2.5 = item3 actual stats of statstype2
                          by calling the mvsnmp.discovery script like this:
                          Code:
                          mvsnmp.discovery[192.1.1.1,"-v2c -cpublic",.1.2.3.4.5.6.7.8.9.0 .1.2.3.4.5.6.7.8.9.1]
                          returning:
                          Code:
                          {#MVSNMPINDEX}  = 0
                          {#MVSNMPVALUE1} = item1 descr
                          {#MVSNMPVALUE2} = statstype1 descr
                          {#MVSNMPINDEX}  = 1
                          {#MVSNMPVALUE1} = item1 descr
                          {#MVSNMPVALUE2} = statstype2 descr
                          {#MVSNMPINDEX}  = 2
                          {#MVSNMPVALUE1} = item2 descr
                          {#MVSNMPVALUE2} = statstype1 descr
                          {#MVSNMPINDEX}  = 3
                          {#MVSNMPVALUE1} = item2 descr
                          {#MVSNMPVALUE2} = statstype2 descr
                          {#MVSNMPINDEX}  = 4
                          {#MVSNMPVALUE1} = item3 descr
                          {#MVSNMPVALUE2} = statstype1 descr
                          {#MVSNMPINDEX}  = 5
                          {#MVSNMPVALUE1} = item3 descr
                          {#MVSNMPVALUE2} = statstype2 descr
                          so you can generate items like this:
                          Code:
                           <item description> <stats description> = <actual stats of this statstype>

                          Comment


                            #14
                            Is this still supported on Zabbix 3.4? I cam across a template which is referencing "advsnmp.discovery[{HOSTNAME},"-v2c -c{$SNMP_COMMUNITY}",1.3.6.1.4.1.2620.1.5.13.1.2,1. 3]" in its discovery rules and I can't find any sure answer on whether or not I should try to install this.

                            Comment


                              #15
                              Originally posted by syntax53 View Post
                              Is this still supported on Zabbix 3.4? I cam across a template which is referencing "advsnmp.discovery[{HOSTNAME},"-v2c -c{$SNMP_COMMUNITY}",1.3.6.1.4.1.2620.1.5.13.1.2,1. 3]" in its discovery rules and I can't find any sure answer on whether or not I should try to install this.
                              Just confirmed: this script is working with Zabbix 4.0 beta 1. I' ll assume that it works on 3.4 as well. Of course Perl is a prerequisite for this script.

                              Comment

                              Announcement

                              Collapse
                              No announcement yet.
                              Working...
                              X