snmp source != sourceip

[tekknokrat]

When using server (mysql) only and configured ListenIP/SourceIP and performing snmp checks zabbix uses the first ip of interfaces for sending the snmpcheck.

ListenIP=10.4.128.240
SourceIP=10.4.128.240

$ sudo tcpdump -n -i eth0 -c 1 udp and port 161
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
21:01:17.031031 IP 10.4.128.6.43633 > 10.4.190.16.161: GetRequest(30) .1.3.6.1.2.1.2.2.1.2.2

As you see the source ip 10.4.128.6 is wrongly used.

In this configuration the result will never be received. Can this be fixed in 1.6.3?

[xs-]

I remember an issue with libsnmp. Libsnmp was changed a bit to have the ability to use a specific source address. (and zabbix compilation failed when using this older version). They fixed it so that compilation wouldn't use this option when an older version of libsnmp was encountered during compilation.

So in short, use the latest libsnmp and recompile zabbix against it.

[tekknokrat]

I remember an issue with libsnmp. Libsnmp was changed a bit to have the ability to use a specific source address. (and zabbix compilation failed when using this older version). They fixed it so that compilation wouldn't use this option when an older version of libsnmp was encountered during compilation.

So in short, use the latest libsnmp and recompile zabbix against it.

I have ubuntu lts where libsnmp is this version:

libsnmp-base
libsnmp-base:
Installed: 5.4.1~dfsg-4ubuntu4.2

Can you perhaps remember which version contain these fixes?

[xs-]

That version should support the feature.
If you compiled your zabbix_server binary against this libsnmp version, it should all work.
If not, dunno.

[tekknokrat]

Ok, I tried that manually not via the package build but with manual build with this rules:

./configure --enable-server --with-pgsql --with-net-snmp --with-libcurl

src/zabbix_server/pinger:

./Makefile:SERVER_LDFLAGS =     -L/usr/lib -lpq   -lcurl -lidn -lldap -lrt -L/usr/lib -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lgssapi_krb5 -lz -lgnutls  -L/usr/lib -lnetsnmp -lcrypto  -L/usr/lib -lnetsnmp -lcrypto
./Makefile:SERVER_LIBS =       -lcurl  -lnetsnmp 
./Makefile:SNMP_LDFLAGS =  -L/usr/lib -lnetsnmp -lcrypto
./Makefile:SNMP_LIBS = -lnetsnmp

The result is the same. I have seen some bugreports and other threads nothing with a final solution, only that this should be supported via SourceIP.

- https://support.zabbix.com/browse/ZBX-591
- https://support.zabbix.com/browse/ZBX-231
- http://www.zabbix.com/forum/showthread.php?t=11336
- http://www.zabbix.com/forum/showthread.php?t=11487

[tekknokrat]

I've now added some debug output to checks_snmp.c to see what ip is used for snmp request:

--- old/zabbix-1.6.2/src/zabbix_server/poller/checks_snmp.c     2009-03-25 11:00:03.000000000 +0100
+++ zabbix-1.6.2/src/zabbix_server/poller/checks_snmp.c 2009-03-25 16:24:54.000000000 +0100
@@ -361,10 +361,12 @@
                                        session.peername, session.remote_port);
        }
 
-#ifdef HAVE_SNMP_SESSION_LOCALNAME
-       if (NULL != CONFIG_SOURCE_IP)
+       if (NULL != CONFIG_SOURCE_IP){
                session.localname = CONFIG_SOURCE_IP;
-#endif
+               zabbix_log(LOG_LEVEL_DEBUG,"SourceIP is used here: %s",CONFIG_SOURCE_IP);
+       }
+
+       zabbix_log(LOG_LEVEL_DEBUG,"SourceIP used for snmp check: %s",session.localname);
 
        SOCK_STARTUP;
        ss = snmp_open (&session);
@@ -640,10 +642,8 @@
                        session.remote_port);
        }
 
-#ifdef HAVE_SNMP_SESSION_LOCALNAME
        if (NULL != CONFIG_SOURCE_IP)
                session.localname = CONFIG_SOURCE_IP;
-#endif
 
        SOCK_STARTUP;
        ss = snmp_open(&session);

The output in logfile now shows me 186 which is indeed the service ip.

5555:20090325:163216 In int_in_list(list:,value:10048)
5555:20090325:163216 End int_in_list(ret:FAIL)
5555:20090325:163216 In get_value(key:ifInOctets[index,ifDescr,eth0])
5555:20090325:163216 In get_value_snmp(key:ifInOctets[index,ifDescr,eth0],oid:ifInOctets["index","ifDescr","eth0"])
5555:20090325:163216 Special processing
5555:20090325:163216 method:index
5555:20090325:163216 oid_index:ifDescr
5555:20090325:163216 index_value:eth0
5555:20090325:163216 In snmp_normalize(oid:ifDescr)
5555:20090325:163216 End of snmp_normalize():1.3.6.1.2.1.2.2.1.2
5555:20090325:163216 In cache_get_snmp_index(oid:1.3.6.1.2.1.2.2.1.2,value :eth0)
5555:20090325:163216 End of cache_get_snmp_index(index:0):FAIL
5555:20090325:163216 In snmp_get_index(oid:1.3.6.1.2.1.2.2.1.2,value:eth0)
5555:20090325:163216 SNMP [[email protected]:161:161]
5555:20090325:163216 SourceIP is used here: 192.168.2.186
5555:20090325:163216 SourceIP used for snmp check: 192.168.2.186
5555:20090325:163216 snmp_get_index: snmp_pdu_create()
5577:20090325:163216 In process_escalations()
5577:20090325:163216 Query [select escalationid,actionid,triggerid,eventid,r_eventid, esc_step,status from escalations where status in (0,1) and nextcheck<=1237995136 and escalationid between 000000000000000 and 099999999999999]
5577:20090325:163216 Escalator spent 0.000747 seconds while processing escalation items. Nextcheck after 3 sec.

tcpdump still shows that hostip (185) is used:

16:42:17.886967 IP 192.168.2.185.56177 > 172.20.121.32.161: GetNextRequest(29) .1.3.6.1.2.1.2.2.1.2

[tekknokrat]

seems to be a problem with other packages too, like this thread from January

http://www.zabbix.com/forum/showthread.php?t=11487

@Devs might you have a look on that?