SNMP Configuration - Items, Triggers and Graphs

[Ztevie_46]

I have two hosts which are configured for snmp. The snmp setting is showing green for both. One host is showing 746 items, 347 triggers and 81 graphs. The other is only showing 15 items, 7 triggers and no graphs. Both hosts are Juniper devices. They have the same config for snmp and in Zabbix they both have the same template applied.

Any ideas why one of the hosts has less items, triggers and graphs?

[Ztevie_46]

I have now discovered the issue with this problem. It was caused by a mis-configuration on the Juniper devices I was trying to monitor, due to a quirk of JUNOS.

I was copying the config from a working device to a new device. This copy included the following two lines:-

"set snmp v3 usm local-engine user <user> authentication-<authentication-method> authentication-key <Authentication password>" and "set snmp v3 usm local-engine user <user> privacy-<privacy-method> privacy-key <privacy password>"

For "authentication-key" and "privacy-key" the word "key" should be "password". However when you commit the config to the device JUNOS automatically changes it to "key". So technically I was copying the wrong command.

After manually inputing the correct command the discoveries on zabbix connected and started receiving data from the device.

[cyber]

Any discoveries in "not supported" state? Are the devices themselves identical ( not just snmp config and template)? There can be exclusions in template, that prevent discovery of certain things. Like ignoring interfaces with certain names etc...

[Ztevie_46]

Thanks for your reply

Both devices are the same model.

There were some discoveries in "not supported" state. So I have just unlinked and cleared the template for the host, then reapplied it in Zabbix. Then I restarted snmp on the device itself and those discoveries are all now at "enabled". However, the items, triggers and graphs for thais device have still not updated.

[cyber]

Discovery usually takes some time, so wait a while...
Did you look, what was the error there, why those were not supported? That might explain...

[Ztevie_46]

I've just gone back again and checked the device I updated and the discoveries are back to "not supported".

The error message is "cannot connect to <IP ADDRESS>. Authentication failure (incorrect password, community or key). "

Do you know where this password that it is talking about would be configured in Zabbix? Just so that I can confirm it's the same password that is set on the device itself.

Weirdly, there is one discovery which is ok and is still sitting at enabled.

[cyber]

You said you have 2 hosts configured for snmp polling, you must have set the passwords also under host interface config?

[Ztevie_46]

I have now checked the passwords on both the Zabbix template macros and on the device itself and they are the same. But still getting the error message "cannot connect to <IP ADDRESS>. Authentication failure (incorrect password, community or key). " on the unsupported discovery rules with the red and white information note.

[cyber]

And connecting with snmpwalk from command line of server? Works ok with both devices and all the credentials?

[Ztevie_46]

Hi

Just an update on this issue

ACTION: SNMP walk tried on both a device that is working and one that is not
RESULT: For the device that is working the snmp walk is coming back with a timeout. For the device that is not working the walk comes back with an authentication failure (incorrect password, community or key). The passwords, community and keys that are configured on the device itself are the same as those defined in the "inherited macros" section of the Zabbix template being used.

ACTION: Compare Juniper models and software versions of devices that are not working and those that are.
RESULT: There appears to be no link to this being an issue, as I have devices that are the same model and on the same software version that are working fine.

ACTION: Is SNMP being blocked?
RESULT: I changed the template of the device that is not working (even though that template works on other devices). I started to receive data from the device on the new template. This was not an snmpv3 template though.
Also, even though I am not receiving any data on Zabbix when the original template is selected, I am seeing snmpv3 traffic being allowed in FW logs.

ACTION: On a device that is working. I reapplied the authentication and privacy keys that are detailed in the Zabbix template onto the device's config
RESULT: The device stopped reporting data and the discovery rule on the device's zabbix entry changed to "Not supported". When I rolled back the device's config it started working again.

[Ztevie_46]

I have now discovered the issue with this problem. It was caused by a mis-configuration on the Juniper devices I was trying to monitor, due to a quirk of JUNOS.

I was copying the config from a working device to a new device. This copy included the following two lines:-

"set snmp v3 usm local-engine user <user> authentication-<authentication-method> authentication-key <Authentication password>" and "set snmp v3 usm local-engine user <user> privacy-<privacy-method> privacy-key <privacy password>"

For "authentication-key" and "privacy-key" the word "key" should be "password". However when you commit the config to the device JUNOS automatically changes it to "key". So technically I was copying the wrong command.

After manually inputing the correct command the discoveries on zabbix connected and started receiving data from the device.