SNMP Monitoring. The Sequel by Manuel Deschambault. Support Tool Architect Symbiotic System Design

Transcription

1 SNMP Monitoring The Sequel by Manuel Deschambault Support Tool Architect Symbiotic System Design

2 How many repeat offenders? 2

3 What group do you belong to?! 1- What is SNMP?! 2- I know what SNMP is but never used it.! 3- I ve used SNMP but it works on Macs?

4 Simple Network Management Protocol

5 SNMP Basics! What it does How it works What we can do with it Why use SNMP How the Mac uses it

6 What it does? Protocol used by devices to transmit: Performance data Health status Notification of events Supported by most IT equipment Not leveraged much outside the data center More versatile than most users know

7 How it works Data made available from the device What s a community? Data format What s a MIB? Querying the available data SNMPWalk SNMPGet What is different with a trap?

8 ! What can we do with it? Performance gathering Trending Threshold alert Event Response

9 Why use SNMP? 9

10 Why use SNMP? 10

11 Why use SNMP? 11

12 Why use SNMP? 12

13 Why use SNMP? 13

14 Why use SNMP? 14

15 ! How the Mac uses it Enter Net-SNMP Open standard

16 ! How the Mac uses it Enter Net-SNMP Open standard

17 ! How the Mac uses it Enter Net-SNMP Open standard

18 ! How the Mac uses it Enter Net-SNMP Open standard

19 ! How the Mac uses it Enter Net-SNMP Open standard

20 Turning it on!! (sudo) Edit /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist Set the Disabled key to false, save (sudo) launchctl load /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist

21 Anatomy of snmpd.conf Monolithic text file in /etc/snmp/ Sections for: Read only community name Read/write community name System location System contact Extension scripts Process information Volume information

22 snmpd.conf The monolithic file does not lend well to management with usual Mac deployment tools Simple text file, we should be able to compose it from modular components Need to automate everything

23 /etc/snmp snmpd.conf Components rocommunity.txt syscontact.txt syslocation.txt Extensions examplescript.sh 23

24 Components folder was modified move /etc/snmp/snmpd.conf to /etc/snmp/snmp.conf.previous set default values for: -rocommunity (public) -syslocation (not specified) -syscontact (not specified) read: -/etc/snmp/components/rocommunity.txt -/etc/snmp/components/syslocation.txt -/etc/snmp/components/syscontact.txt are values valid? Yes No override defaults use defaults for each script do: list all scripts in /etc/snmp/components/extensions push rocommunity > /etc/snmp/snmpd.conf push syslocation >> /etc/snmp/snmpd.conf push sys contact >> /etc/snmp/snmpd.conf extract the OID extract the name take next script No is it last one Yes restart net-snmp daemon push "extend <OID> <name> <script path> >> /etc/snmp/snmpd.conf 24

25 OK, now we can develop Not so fast Need to make sure any data you return does not conflict with net-snmp extension scripts from other sources Best method is to control the OID you use Having your an IANA PEN number for your organisation guarantees that your data is return on your unique OID branch 25

26 Getting an IANA PEN number Make sure your company is not already registered by looking up their directory: enterprise-numbers/enterprise-numbers If you do not already have a PEN number registered, apply for one at: 26

27 In best Kenny Rogers voice Once, Twice, Three time a shell script 27

28 Multi-purpose scripts Return value (echo) 28

29 Multi-purpose scripts Return value (echo) Exit status 29

30 Multi-purpose scripts Return value (echo) Exit status Arbitrary code execution (roaming) 30

31 Script runs every hour is alerts.txt valid? Yes is serverip.txt valid? No list all scripts in /etc/snmp/components/extensions ls /etc/snmp/components/extensions/so_* Yes No for each script do: No can we ping serve rip? run script passing alerts.txt take next script Yes is it last one No Exit script Yes 31

32 32