Translation between SNMP and SYSLOG Notifications

Transcription

1 Translation between SNMP and SYSLOG Notifications Vladislav Marinov Jacobs University Bremen Vladislav Marinov Translation between SNMP and SYSLOG Notifications 1

2 Outline 1 Background on SNMP and SYSLOG 2 Motivation 3 SNMP-to-SYSLOG Mapping Definition 4 Implementation Vladislav Marinov Translation between SNMP and SYSLOG Notifications 2

3 Outline 1 Background on SNMP and SYSLOG 2 Motivation 3 SNMP-to-SYSLOG Mapping Definition 4 Implementation Vladislav Marinov Translation between SNMP and SYSLOG Notifications 3

4 The SNMP Management Protocol An application layer protocol for management and configuration of network attached devices (such as routers, switches, etc.) Utilizes the Manager/Agent model The management information is stored in a Management Information Base (MIB) [4] A tree-like structure with individual variables being the leaves Each variable is identified by an Object Identifier (OID) OIDs are long numeric tags (also known as sysuptime.0 [4]) identifies the time elapsed since the system was last re-initialized Vladislav Marinov Translation between SNMP and SYSLOG Notifications 4

5 SNMP Notifications Format SNMP notification messages are sent by SNMP agents to notify SNMP managers that an event has occurred or that a condition is present The body of a message is carried in a SNMP Protocol Data Unit (PDU) A SNMPv2/3 notification messages PDU contains a list of varbinds [4] sysuptime.0 and snmptrapoid.0 are always the first two varbinds in the list SNMPv3 notifications carry two additional parameters - contextname and contextengineid SNMPv1 notifications follows a slightly different format [2]. RFC3584[3] defines how they can be mapped to SNMPv2/3 notifications Vladislav Marinov Translation between SNMP and SYSLOG Notifications 5

6 The SYSLOG Management Protocol Do you remember my first talk? A lightweight management protocol used to convey event notification messages [5] Mesages contain plain text No acknowledgement of SYSLOG messages Vladislav Marinov Translation between SNMP and SYSLOG Notifications 6

7 The SYSLOG Management Protocol Do you remember my first talk? A lightweight management protocol used to convey event notification messages [5] Mesages contain plain text No acknowledgement of SYSLOG messages Vladislav Marinov Translation between SNMP and SYSLOG Notifications 6

8 SYSLOG Message Format[5] A SYSLOG Message <66> T22:14:15.003Z foo.example.com evntslog - ID47 [examplesdid@0 iut="3" eventsource= "Application" eventid="1011"] An application event log entry... SYSLOG Header - contains priority, version, timestamp, hostname of originator, application name. process ID, message ID Structured Data - a number of structured data elements Each structured element has an identifier and a number of name-value pairs MSG Part - optional part, contains free-form text Vladislav Marinov Translation between SNMP and SYSLOG Notifications 7

9 Outline 1 Background on SNMP and SYSLOG 2 Motivation 3 SNMP-to-SYSLOG Mapping Definition 4 Implementation Vladislav Marinov Translation between SNMP and SYSLOG Notifications 8

10 Motivation and Goals Motivation Some operators prefer SNMP notifications, some operators prefer SYSLOG messages Some devices generate SNMP notifications, others generate SYSLOG messages Latest SYSLOG can carry structured data elements Goals Specify a mapping from SNMP notifications to SYSLOG messages as an Internet Draft Create a new SYSLOG structured data element to carry the SNMP notification parameters Implement a prototype of an SNMP-to-SYSLOG translator Vladislav Marinov Translation between SNMP and SYSLOG Notifications 9

11 Outline 1 Background on SNMP and SYSLOG 2 Motivation 3 SNMP-to-SYSLOG Mapping Definition 4 Implementation Vladislav Marinov Translation between SNMP and SYSLOG Notifications 10

12 SNMP-to-SYSLOG Translator Accept SNMP notifications, extract notification parameters and send them in a SYSLOG message The mapping is specified in ABNF format in [I-D.draft-marinov-syslog-snmp][6] Vladislav Marinov Translation between SNMP and SYSLOG Notifications 11

13 SNMP-to-SYSLOG Mapping The SYSLOG header contains values that are specific to the system on which the SNMP-to-SYSLOG translator is running Priority value of 29 - message of notice for a significant condition generated by a system daemon Application name of snmptrapd All SNMP data is kept in an snmp structured data element Most varbinds are represented by two SD parameters; one SD parameter for the OID and one SD parameter for the value sysuptime.0, snmptrapoid.0, contextname and contextengineid are dealt using special rules Vladislav Marinov Translation between SNMP and SYSLOG Notifications 12

14 SNMP Notification BER Encoding ASN.1 Interpretation 30:7C SEQUENCE { 04:08:80:00:02:B8:04:61:62: b :04:63:74:78:31 "ctx1" A7:6A SNMPv2-Trap-PDU { 02:03:6D:08:67 INTEGER :01:00 INTEGER 0 02:01:00 INTEGER 0 30:5D SEQUENCE OF { 30:0F SEQUENCE { 06:08:2B:06:01:02:01:01:03:00 sysuptime.0 43:03:01:72:8C } 30:17 SEQUENCE { 06:0A:2B:06:01:06:03:01:01:04:01:00 snmptrapoid.0 06:09:2B:06:01:06:03:01:01:05:04 linkup } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:01:03 ifindex.3 02:01:03 3 } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:07:03 ifadminstatus.3 02:01:01 up(1) } 30:0F SEQUENCE { 06:0A:2B:06:01:02:01:02:02:01:08:03 ifoperstatus.3 02:01:01 up(1) } } } } Figure: SNMP linkup Trap Vladislav Marinov Translation between SNMP and SYSLOG Notifications 13

15 SYSLOG Message <29> T22:14:15.003Z mymachine.example.com snmptrapd - ID47 [snmp ctxengine="800002b " ctxname="ctx1" sysuptime="94860" snmptrapoid=" " o=" " d="3" o=" " d="1" o=" " d="1"] Figure: SYSLOG linkup Notification Vladislav Marinov Translation between SNMP and SYSLOG Notifications 14

16 Outline 1 Background on SNMP and SYSLOG 2 Motivation 3 SNMP-to-SYSLOG Mapping Definition 4 Implementation Vladislav Marinov Translation between SNMP and SYSLOG Notifications 15

17 Implementation The Net-SNMP[1] SNMP open source implementation was extended A set of functions for manipulating the PDU varbinds A function for creating a SYSLOG message by extracting the SNMP notification parameters from the SNMP message A function for creating a transport endpoint (UDP socket) and sending the SYSLOG message via UDP A handler for the Net-SNMP snmptrapd daemon The implementation was tested with SNMPv1/2/3 notifications Vladislav Marinov Translation between SNMP and SYSLOG Notifications 16

18 Conclusion Translating of notifications between various management protocols is necessary in certain operational environments We have defined a new SYSLOG structured data element carrying the information from an SNMP notification An Internet Draft has been submitted to the SYSLOG working group of the IETF A prototype of an SNMP-to-SYSLOG translator has been implemented by extending the Net-SNMP code Future Work: Some further refining of the map specification following the IETF feedback (i.e should varbinds be also identified by a symbolic name) Definition and Implementation of reverse mapping? Vladislav Marinov Translation between SNMP and SYSLOG Notifications 17

19 References Net-SNMP, J. Case, M. Fedor, M. Schoffstall, J. Davin. A Simple Network Management Protocol (SNMP). RFC 1157, SNMP Research, Performance Systems International, Performance Systems International, MIT Laboratory for Computer Science, May R. Frye, D. Levi, S. Routhier, B. Wijnen. Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework. RFC 3584, Vibrant Solutions, Nortel Networks, Wind River Systems, Inc., Lucent Technologies, August R. Presuhn. Management Information Base (MIB) for the Simple Network Management Protocol (SNMP). RFC 3418, BMC Software, Inc., December R.Gerhards. The Syslog Protocol. Internet Draft (work in progress) <draft-ietf-syslog-protocol-23>, Adiscon GmbH, J. Schoenwaelder V. Marinov. Mapping Simple Network Management Protocol (SNMP) Notifications to SYSLOG Messages. Internet Draft (work in progress) <draft-marinov-syslog-snmp-01.txt>, Jacobs University Bremen, February Vladislav Marinov Translation between SNMP and SYSLOG Notifications 18