Using SNMP to Obtain Port Counter Statistics During Live Migration of a Virtual Machine. Ronny L. Bull Project Writeup For: CS644 Clarkson University

Transcription

1 Using SNMP to Obtain Port Counter Statistics During Live Migration of a Virtual Machine Ronny L. Bull Project Writeup For: CS644 Clarkson University Fall 2012

2 Abstract If a managed switch is used during the process of benchmarking virtual machine migrations important information such as port counter statistics can be gathered to verify the amount of data that was passed over the course of an individual migration. Modern managed switches tend to provide a web based interface that displays all of this information at a glance. However if the intent is to include this information within a script that automates the migration and data collection process then other methods need to be explored. SNMP proves to be a useful tool that can be harnessed in a simple bash script to query a compatible device for the desired results. Introduction A Dlink GS108Tv2 switch is being utilized in an experimental virtual migration testbed by a small group of Computer Science graduate students at Clarkson University. The switch is fully managed and provides a web based interface for controlling, managing, and displaying statistics. Previously researchers were using the web interface during virtual machine migration testing in order to manually keep track of how many octet packets were being passed over the network on a single port during each test. It was proposed to attempt to parse the web interface in order to pull the statistics directly from it into the automated live migration scripts for processing. However due to the dynamic nature of the web interface this proved to be very complicated, and other options were explored. It was found that the Dlink GS108Tv2 switch supports SNMP, and all of the information that the switch is able to provide can be easily obtained by running the snmpwalk command against it from a Linux computer. Further investigation yielded that the SNMP suite of utilities also included snmpget which allows for the querying of a single item from a SNMP device's MIB which is much more efficient than parsing the entire MIB for a single entry using snmpwalk. SNMP Basics The snmpwalk command returns the entire MIB table from the switch that includes every piece of information that can be gathered from the switch via SNMP. This command can take quite some time to finish and produces a very large amount of data to stdout. Therefore it is recommended to redirect the output of the command to a file for later parsing. snmpwalk -v 2c c public > snmp_dump.txt The above example will run snmpwalk using SNMP version 2c on a switch at a remote IP address of SNMP uses community strings for security, and in this case the community string public is being passed which allows for read only access to the information on the switch. If the community string private was used it would allow write access to certain items on the switch that permit their values to be changed via SNMP. Sadly the counters we are interested in obtaining results from are read only so they do not allow resetting via SNMP. The above command returns a large amount of data, of which we were interested in the 64 bit counters for each switch port. The following is a block extracted from snmp_dump.txt which contains 5570 lines of very similar entries. iso = Counter64: iso = Counter64: iso = Counter64: 0 iso = Counter64:

3 iso = Counter64: iso = Counter64: iso = Counter64: iso = Counter64: iso = Counter64: iso = Counter64: 0 iso = Counter64: 0 iso = Counter64: 0 iso = Counter64: 0 Notice how each entry is labeled in a very cryptic fashion. After a bit of research it was discovered that each SNMP device is usually accompanied by a set of MIB database files that are specific to that device. These files can be loaded when running any SNMP utility so that more descriptive labels can be acquired during output. The MIB files for the Dlink switch were located on the CDROM that shipped with the device and were copied to a workstation that was used to run SNMP queries against the switch. After loading the MIB files the following labels were returned for the same set of values that were presented above. IF-MIB::ifHCInOctets.1 = Counter64: IF-MIB::ifHCInOctets.2 = Counter64: IF-MIB::ifHCInOctets.3 = Counter64: 0 IF-MIB::ifHCInOctets.4 = Counter64: IF-MIB::ifHCInOctets.5 = Counter64: IF-MIB::ifHCInOctets.6 = Counter64: IF-MIB::ifHCInOctets.7 = Counter64: IF-MIB::ifHCInOctets.8 = Counter64: IF-MIB::ifHCInOctets.13 = Counter64: IF-MIB::ifHCInOctets.14 = Counter64: 0 IF-MIB::ifHCInOctets.15 = Counter64: 0 IF-MIB::ifHCInOctets.16 = Counter64: 0 IF-MIB::ifHCInOctets.17 = Counter64: 0 In order to successfully load the MIB files to achieve the above results the following procedure was performed on a Gentoo Linux workstation: First it is helpful to know the SNMP search path: type net-snmp-config snmpconfpath Which returned: /etc/snmp:/usr/share/snmp:/usr/lib64/snmp:/home/ronny/.snmp:/var/lib/net-snmp This output indicated the locations where SNMP will read configuration and MIB information from. Second the MIB contents from the Dlink CDROM were copied to /home/ronny/.snmp, which consisted of a large number of files with a.my extension as well as one file called TRANS.TBL. Lastly a file was created in /home/ronny/.snmp called snmp.conf in which the following entry was made: mib +ALL After performing the above procedure the snmpwalk program successfully loads the configurations from the.my files in ~/.snmp and maps the OID numbers that were being outputted before to

4 meaningful strings that correspond to what is being displayed on the web page. As see in the above example output. SNMPGET In order to query the switch and obtain a single entry via SNMP rather than the entire list that snmpwalk provides the snmpget command is used. This provides a much more efficient way of obtaining the desired results than parsing the ouput of snmpwalk each time. The snmpget command has very similar syntax to what is used for snmpwalk as can be seen by the following example. snmpget -v 2c c public iso The above example runs snmpget with SNMP version 2c against using the community string public (since get is a read only operation) to return the value from the OID iso The output from the above example looks like so: iso = Counter64: The utilization of the specific MIB files from the Dlink CDROM provides the following output when using the same command. Which illustrates how the MIB files can be used to translate the OID's into meaningful labels. IF-MIB::ifHCInOctets.8 = Counter64: After seeing the power and efficiency of the snmpget program, it was harnessed within a bash script to automate the collection of port counter statistics during live migration of virtual machines. In order to return just the value rather than the entire line of output awk was used to filter and store the value to a variable in the script that could later be processed. ifinoctets8_start=`snmpget -v 2c c public iso awk {'print $4'}` The above example is used to store the counter value prior to triggering the live migration then a second variable called ifinoctets8_stop is used to collect the ending counter value after the migration has finished. The two values are subtracted and the result is returned to indicate the total octets that were transferred during the migration. Hurdles At first an attempt was made to match numbers from the snmpwalk dump with entries on the web interface to try to locate the variables that were of interested, however this proved to be difficult since the 64 bit counters that were needed were not being parsed out, and only 32 bit versions were being returned that kept rolling over and did not match what the web interface was displaying. After a bit of trial and error it was discovered that initially the snmpwalk commands were run using the -v 1 flag which indicated the command to be run using SNMP version 1, which seems to lack 64 bit support. By running the snmpwalk command with the -v 2c flag the command was issued using SNMP version 2c which allows for the collection of 64 bit statistics. Once the 64 bit counter information was able to be queried from the switch it was possible to match values with the web interface to narrow down the selections. These values were also confirmed by running snmpwalk with the specific MIB database files provided on the Dlink CDROM that allowed for

5 more descriptive names of the labels. Impact on Live Migration Research Project The automatic collection of switch port statistics during virtual machine migration allows researchers greater accuracy in the collection and dissemination of data that was previously collected and parsed manually. Now a single script can be run that collects various statistics not only from the switch, but also from the virtual machine that is being migrated. Important information such as memory, swap, and disk utilization, as well as port counter statistics are now being logged during each migration to a file for later review. Each entry is date and time stamped to provide easy retrieval of the desired information. Not only does the script collect data, but it also triggers the migration scripts in the process. Therefore it could be setup in a cron job for complete automation of the live migration process. Ways to Extend the Script Though the automation script is rather powerful in its current form, there is always room for improvement. One thing that comes to mind to make the script process more efficiently is to change current method of collecting memory, swap, and disk statistics from the virtual machines being migrated. Currently the script utilizes a mix of SSH, grep, and awk commands in order to retrieve the information from /proc/meminfo and the df command. If an SNMP server daemon were setup and ran on the virtual machine then the snmpget command could be used to retrieve this information without the use of SSH, reducing the resources used on the virtual machine during the migration process as well the extra network traffic overhead. This would also have a secondary effect of speeding up the retrieval of the statistics as well as the entire migration process as a whole due. In order to successfully migrate the script to fully utilizing SNMP for the gathering of all statistical information further investigation into the collection of memory, cpu, swap, and disk statistics from a Linux host would be necessary to determine the proper OID labels to query. Conclusion SNMP though sometimes thought of as a security hole can be quite useful when statistical information needs to be acquired from a device that supports it. It allows for a wealth of information to be queried from a compatible device which can then be used to validate experimental benchmark results. With very little introductory knowledge of SNMP an administrator or researcher can quickly be brought up to speed on how to utilized this suit of tools in order to gain valuable insight on how network devices are performing, as well as the load that is being incurred upon them. References - NET-SNMP documentation website SNMP Wikipedia article