. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

Net-SNMP CLI 11 Probing a device: SNMP WALKs . . . . . . . . . . . . . . . . . . 11 Polling Individual OIDs: SNMP GETs . . . . . . . . . . . . . . . 13 Net-SNMP CLI Tool Options . . . . . . . . . . . . . . . . . . . . 13

4 Polling Applications 15 4.1 Simple Polling with PERL . . . . . . . . . . . . . . . . . . . . . . 15 4.2 The Net-SNMP PERL Module . . . . . . . . . . . . . . . . . . . 16 5 Trap Handlers 19 5.1 The Trap Daemon Configuration . . . . . . . . . . . . . . . . . . 19 5.2 A Simple Trap Handler . . . . . . . . . . . . . . . . . . . . . . . 20 5.3 Starting the Trap Daemon . . . . . . . . . . . . . . . . . . . . . . 21 6 The 6.1 6.2 6.3 6.4 Net-SNMP C API SNMP Internals . . . . . . . . Watching SNMP on the wire A simple example . . . . . . . Closing Thoughts . . . . . . . 23 23 24 27 29

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

1

Chapter 1

Introduction to SNMP
1.1 General Overview

Simple Network Management Protocol is a simple method of interacting with networked devices. The standard was defined by IETF RFC 1157 in May of 1990. SNMP can often seem quite confusing and overly complicated, its available APIs tend to put alot of wrapping around what should be very simple. The available books on the topic tend to only complicate the subject, not demystify it. SNMP is extremely easy for any programmer to understand. A gross over simplification can explain the system simply. A network device runs an SNMP agent as a daemon process which answers requests from the network. The agent provides a large number of Object Identifiers (OIDs). An OID is a unique keyvalue pair. The agent populates these values and makes them available. An SNMP manager (client) can then query the agents key-value pairs for specific information. From a programming standpoint it’s not much different than importing a ton of global variables. SNMP OIDs can be read or written. While writing information to an SNMP device is fairly rare, it is a method used by several management applications to control devices (such as an administrative GUI for your switches). A basic authentication scheme exists in SNMP, allowing the manager to send a community name (think cleartext password) to authorize reading or writing of OIDs. Most devices use the insecure community name ”public”. SNMP communication is preformed via UDP on ports 161 and 162. Notice that I didn’t mention MIBs yet! The importance of MIBs are greatly overrated. MIBs look complicated at first, but they are extremely simple. OIDs are numerical and global. An OID looks similar to an IPv6 address and different vendors have different prefixes and so forth. The OIDs are long enough that it’s complicated for a human to remember or make sense of them, so a method was devised for translating a numeric OID into a human readable form. This translation mapping is kept in a portable flat text file called a Management Information Base or MIB. You do not need a MIB to use SNMP or query

2

CHAPTER 1. INTRODUCTION TO SNMP

3

SNMP devices, however without a MIB you’ll have to simply guess what the data your looking at means. In some cases this is easy, such as seeing host names, disk usage numbers, or port status information. Other times it can be more difficult and a MIB is more useful. It is not unusual for some applications to be written using strictly numeric IODs allowing the end user to avoid the hassles of properly installing a MIB. The action of ”installing” a MIB is really just putting it in a place where your SNMP client application can find it to perform the translation. SNMP can be used in 2 ways: polling and traps. Polling just means that you write an application that sets an SNMP GET request to an agent looking some value. This method is useful because if the device responds you get the information you want and if the device does not respond you know there is a problem. Polling is an active form of monitoring. On the other hand, SNMP traps can be used for passive monitoring by configuring an agent to contact another SNMP agent when some action occurs. Looking at traps deeper, a network device such as a router can be configured to send SNMP traps for certain events. For instance, you can configure Cisco IOS to send traps either when an individual event occurs such as a linkDown (IOS: snmp-server enable traps snmp linkdown) or when any defined trap event happens (IOS: snmp-server enable traps snmp). When a trap event occurs, the agent on the device will send the trap to a pre-configured destination commonly called a trap host. The trap host will have it’s own agent running which will accept and process the traps as they come in. The processing of these traps are done by trap handlers. Trap Handlers can be written in any language and are provided with information from the sent trap via STDIN. The handler can then do whatever is appropriate to respond to the trap, such as sending email or doing anything else you could want. SNMP is most commonly used in conjunction with a Network Management System (NMS). Popular NMS’s include BMC Patrol, CA Unicenter, Sun Management Console (formerly SyMon), IBM Tivoli NetView, and the world famous HP OpenView. Even an Open Source NMS is now available, the aptly named OpenNMS. The goal of a NMS is to provide a single point of monitoring and administration of all your SNMP enabled devices. By configuring your device agents to allow write access you can even manipulate your environment from a single application. When an environment is architected around a NMS solution you can be given unparalleled levels of control and visibility over your entire environment at a glance. While Net-SNMP provides all the tools you would need to build your own NMS we won’t discuss the subject any further here. However, bear in mind that if you think the vendor of your SNMP enabled device isn’t as forthcoming about details of their agent implementation as you’d like, it’s most likely because they would like you to simply buy their NMS or a plug-in to use their device with one of the other popular NMS’s.

CHAPTER 1. INTRODUCTION TO SNMP

4

1.2

Three Flavors of SNMP

Three different version of SNMP exist: SNMPv1 (RFC’s 1155, 1157, and 1212), SNMPv2c (RFC’s 1901 through 1908), and SNMPv3 (RFC’s 3411 though 3418). The co-existence of all three versions are detailed in RFC 3584. SNMPv1 is the original standard for community based management. SNMPv2 was derived from the SNMPv1 framework but had no message definition, which was later revamped aa SNMPv2c, a community based version of SNMPv2 with a message format similar to SNMPv1. SNMPv2 added several new datatypes (Counter32, Counter64, Gauge32, UInteger32, NsapAdress, and BIT STRING), as well as enhancements to OID tables and the setting of OID values. SNMPv3 is an extensable SNMPv2 framework with a new message format, ACL and security abilities, and remote configuration of SNMP parameters. SNMP is based on several other standards including the Abstract Syntax Notation 1 Basic Encoding Rules (ASN.1 BER) which defines the SNMP used Datatypes and the Structure of Management Information (SMI) which details the grammar used by SNMP MIBs. SMI comes in two varieties: SMIv1 (RFC 1155) and SMIv2 (RFC 2578). SMIv1 is now obsolete and should not be used. If you choose to modify MIBs at some point you’ll need to learn SMIv2 and ASN.1 syntax, but otherwise they are interesting but unnecessary to learn. To this day, SNMPv1 and SNMPv2c are the most commonly used, however due to the insecurity inherent to these protocols read-only access is typical. In general, don’t bother with SNMPv3 unless you really need the added security features.

1.3

What we won’t discuss

There are several subject we will not be discussing in this paper. These topics include writing agents or sub-agents, writing MIB modules, trap generation and trap sending, synchronous vs asynchronous SNMP coding, and MIB parsing. Something that scares new or inexperienced coders away from the Net-SNMP documentation is the seemingly constant reference to synchronous and asynchronous applications. Don’t be afraid, thats referring to applications that can’t afford to sit and wait for a response. If your application needs a non-blocking method of handling SNMP traffic, use the asynchronous interface (eg: GUIs, Threads, Forking, etc). Otherwise, just stick with the synchronous interfaces for typical use. Lastly, this document addresses the use of Net-SNMP on UNIX systems only. Please refer to the Net-SNMP website for information regarding development on Win32.

Chapter 2

MIBs & OIDs
OIDs, or Object Identifiers, uniquely identify key values offered by an SNMP agent. MIBs, or Management Information Bases, provide a map between numeric OIDs and a textual human readable form.

2.1

OIDs

SNMP OIDs are laid out in a hierarchy forming unique addresses into a tree similar to the DNS hierarchy. Like many other forms of addressing, OIDs can be used in 2 forms: fully qualified and relative (sometimes called ”relevant”). The fully qualified form starts from the root and moves outward to the individual value on a device. An example of a fully qualified address is: .1.3.6.1.4.1.789.1.6.4.8.0 This OID could be rewritten in human readable form as: .iso.org.dod.internet.private.enterprises.netapp.netapp1.raid.diskSummary.diskSpareCount.0 All fully qualified OIDs will begin with .iso.org.dod.internet.private represented numerically as .1.3.6.1.4. Almost all OIDs will then be followed by enterprises (.1) and a unique number for the vendor as assigned by the Internet Assigned Numbers Authority (IANA). In the example OID 789 represents the vendor ID for the Network Appliance Corporation (NetApp). Everything beyond the vendor ID is based on the vendors implementation and may vary between implementations. Please note the prefixing dot before iso. Similar to the trailing dot in DNS, properly qualified IODs begin with a dot representing the root. The complete list of enterprise assignments can be found at the IANA website: http://www.iana.org/assignments/enterprise-numbers The relative form of an OID, on the other hand, begins from the enterprises value and leaves all the implied addressing off. So we can use the relative form of 5

CHAPTER 2. MIBS & OIDS

6

the above OID as enterprises.netapp.netapp1.raid.diskSummary.diskSpareCount.0 or numerically as .1.789.1.6.4.8.0 . A common form of writing OIDs is by the name of the MIB and a unique key defined within the MIB. For instance, we could rewrite the above OID into the condensed form NETWORK-APPLIANCE-MIB::diskSpareCount.0 . This condensed form follows the convention of MIB Name::Unique Key.instance. Some keys, while unique, can be represented by multiple instances of that key, and thus all OIDs end with an instance value. This is why you’ll notice that most OIDs end with a .0 .

2.2

MIBs

The structure of a MIBs internals are a little strange and foreign at first, but it’s structured well enough that you can poke through it pretty intelligently without really knowing what your doing. The structure of a MIB comes from the Structure of Management Information (SMI) standard detailed in IETF RFC 1155 and 2578. If you choose to modify or write your own MIBs you’ll benefit from understanding SMI before hacking much on MIBs. Lets look at the header of a MIB to get a better idea of how they work: -- PowerNet-MIB { iso org(3) dod(6) internet(1) private(4) -enterprises(1) apc(318) } PowerNet-MIB DEFINITIONS ::= BEGIN IMPORTS enterprises, IpAddress, Gauge, TimeTicks DisplayString OBJECT-TYPE TRAP-TYPE

FROM FROM FROM FROM

RFC1155-SMI RFC1213-MIB RFC-1212 RFC-1215;

apc products apcmgmt

OBJECT IDENTIFIER ::= OBJECT IDENTIFIER ::= OBJECT IDENTIFIER ::=

{ enterprises 318 } { apc 1 } { apc 2 }

Comments can be inserted into a MIB by prepending them with two dashes. In the header the declaration BEGIN starts off the MIB. Imports can be used to pull information from other MIBs, typically those mandated by the MIB-II standard. The MIB lays out the structure of OID addresses starting from the enterprises value. Here the enterprise value 318 maps to ”apc” (relative address .1.318). Typically then several categories are defined. Here we see 2 categories: products (.1.318.1) and apcmgmt (.1.318.2). Notice that in the curly braces two values are specified, its parent address followed by its address. So the products

CHAPTER 2. MIBS & OIDS

7

identifier is parented by the apc identifier which is parented by the enterprises identifier, so on and so forth. This type of categorization and subcategorizing will typically continue on in the header of the MIB for awhile segmenting the available keys into tight subgroupings. By segmenting values out in this way it makes the available keys easier to navigate. The real meat of the MIB is in the description of object types. Here’s an example of a integer key: upsBasicOutputStatus OBJECT-TYPE SYNTAX INTEGER { unknown(1), onLine(2), onBattery(3), onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8), switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11), onSmartTrim(12) } ACCESS read-only STATUS mandatory DESCRIPTION "The current state of the UPS. If the UPS is unable to determine the state of the UPS this variable is set to unknown(1)." ::= { upsBasicOutput 1 } Here is defined the upsBasicOutputStatus key with a return type of INTEGER. The returned integer maps to one of 12 different return values as listed. Notice that in the MIB a description of the key is provided. These descriptions can be extremely useful in determining which objects can best provide the data you want, especially if you don’t have MIB documentation supplied by the vendor. Notice also that the last line of the object type description includes the numeric value 1 with upsBasicOutput as the parent. If we follow this parenting backwards in the MIB we’d find that upsBasicOutput has the value 1 and is parented by upsOutput which has the value 4 and is parented by ups which has a value of 1, which is parented by hardware which has a value of 1, which is parented by products with a value of 1 which is parented by apc with a value of 318, which is parented by enterprises with a value of 1. So, if we put all that mapping together we get a relative address for the key upsBasicOutputStatus of .1.318.1.1.1.4.1.1.0. Remember that the trailing .0 represents the first instance

CHAPTER 2. MIBS & OIDS

8

of the key. Applications called MIB Browsers can easily parse a MIB and make navigation much quicker than flipping through the file in vim, but don’t be fooled into thinking it’s difficult without such a tool. So, whats really important to notice here is that the MIB is really just providing us with a road map of the OIDs available on the agent we wish to get values from. A MIB describes both where to find a value and what it returns. We can still interface with a device without the MIB, it’s just much easier when you get a return of ”Up” instead of ”1”. By leveraging the options of the NetSNMP CLI tools you can decide just how you wish to return output which will be different if your just using the tool from the command line (where ”Up” is preferable) or if your calling the tool from a script (where ”1” is preferable).

2.3

OID DataTypes

SMI defines a fixed number of datatypes which are returned by OIDs. These datatypes include: Integer Signed 32bit Integer (values between -2147483648 and 2147483647). Integer32 Same as Integer. UInteger32 Unsigned 32bit Integer (values between 0 and 4294967295). Octet String Arbitrary binary or textual data, typically limited to 255 characters in length. Object Identifier An OID. Bit String Represents an enumeration of named bits. This is an unsigned datatype. IpAddress An IP address. Counter32 Represents a non-negative integer which monotonically increases until it reaches a maximum value of 32bits-1 (4294967295 dec), when it wraps around and starts increasing again from zero. Counter64 Same as Counter32 but has a maximum value of 64bits-1. Gauge32 Represents an unsigned integer, which may increase or decrease, but shall never exceed a maximum value. TimeTicks Represents an unsigned integer which represents the time, modulo 2ˆ (4294967296 dec), in hundredths of a second between two epochs. 32 Opaque Provided solely for backward-compatibility, its no longer used. NsapAddress Represents an OSI address as a variable-length OCTET STRING.

CHAPTER 2. MIBS & OIDS

9

Net-SNMP tools will report the datatype when returning an OID unless you otherwise disregard it. As an example of that you’ll see: SNMPv2-MIB::sysContact.0 = STRING: Ben Rockwood IF-MIB::ifPhysAddress.1 = STRING: 0:c0:b7:63:ca:4c SNMPv2-MIB::sysUpTime.0 = Timeticks: (47372422) 5 days, 11:35:24.22 IF-MIB::ifAdminStatus.1 = INTEGER: up(1) SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.318.1.3.7 RFC1213-MIB::atPhysAddress.1.1.10.10.1.1 = Hex-STRING: 00 50 73 28 47 A0 RFC1213-MIB::atNetAddress.1.1.10.10.1.1 = Network Address: 0A:0A:01:01 IF-MIB::ifSpeed.1 = Gauge32: 10000000 SNMPv2-MIB::snmpInPkts.0 = Counter32: 316 SNMPv2-MIB::snmpOutPkts.0 = Counter32: 314 This is a fairly typical spread of datatypes returned by Net-SNMP tools. Notice that some values are being automatically interpreted by Net-SNMP, such as the sysUpTime and ifAdminStatus. The MIB was used when these values were returned and Net-SNMP was nice enough to find the return value in the MIB and give us the textual representation of the value.

2.4

MIB-II

IETF RFC 1213 ”defines the second version of the Management Information Base (MIB-II) for use with network management protocols in TCP/IP-based internets.” All SNMP agent and tool distributions should include MIBs that will comply with MIB-II and all devices should at the very least return values that comply with the MIB-II standard. Within the MIB-II standard several OID groups are defined, including: The System Group Basic system identification and information OIDs such as sysDescr, sysContact, sysName, SysLocation, etc. (Reported by NetSNMP in SNMPv2-MIB) The Interfaces Group Network Interface information such as ifDescr, ifType, ifSpeed, ifAdminStatus, etc. (Reported by Net-SNMP in IF-MIB) The Address Translation Group Address Translation (AT) information mapping Physical to Logical addressing such as atNetAddress, atPhysAddress, etc. (Reported by Net-SNMP in RFC1213-MIB) The IP Group IP stats and settings such as ipInReceives, ipForwarding, ipInAddrErrors, etc. (Reported by Net-SNMP in IP-MIB) The ICMP Group ICMP stats and settings such as icmpInMsgs, icmpInErrors, icmpInRedirects, etc. (Reported by Net-SNMP in IP-MIB) The TCP Group TCP stats and settings such as tcpActiveOpens, tcpPassiveOpens, tcpInErrs, etc. (Reported by Net-SNMP in TCP-MIB)

CHAPTER 2. MIBS & OIDS

10

The UDP Group UDP stats and settings such as udpInDatagrams, udpInErrors, etc. (Reported by Net-SNMP in UDP-MIB) The EGP Group EGP stats and settings (if the device support EGP) such as egpNeighAs, egpNeighMode, etc (Reported by Net-SNMP in RFC1213MIB) The Transmission Group Device specific media transmition stats and settings (Reported by Net-SNMP in RFC1213-MIB or your vendor MIB) The SNMP Group SNMP stats and settings such as snmpInPkts, snmpInASNParseErrs, snmpInTraps, etc. (Reported by Net-SNMP in SNMPv2MIB) If you do a default walk of an SNMP device the MIB-II data should be returned. All data with the exception of the EGP and Transmission groups are requirements of the standard. For most networking devices such as routers this information is usually sufficient to provide most of the information you could want.

2.5

Adding MIBs to Net-SNMP

Additional MIBs can be added to your Net-SNMP installation by simply copying them into the $(PREFIX)/share/snmp/mibs directory. MIBs should be (re)named to follow the convention (MIB NAME).txt for clarity. You can find the MIBs proper name on the first uncommented line of the MIB (eg: NameMIB DEFINITIONS ::= BEGIN ). For example, if you downloaded MIB for the JetDirect Management Card found on HP LaserJet printers it might have been named something like ”hpjetdirect.mib”. The header of the MIB looks like the following: -- (C) COPYRIGHT HEWLETT-PACKARD COMPANY 1997. -- LaserJet 5Si Printer Model Specific MIB. -LaserJet5Si-MIB DEFINITIONS ::= BEGIN This MIB should be renamed to ”LaserJet5Si-MIB.txt” and copied into the Net-SNMP mibs/ directory. By following this convention it assures greater clarity when utilizing the various MIBs and a consistency with all other installed MIBs. MIBs can be specified by a command line tool using the -m argument or the MIBS environmental variable for libsnmp applications including the PERL module. MIBs can be referenced locally by supplying a proper path (ie: m ”./MY MIB.txt”) or globally by supplying the MIB name without the .txt suffix (ie: -m ”MY MIB”) if it’s located in the Net-SNMP MIBs directory.

Chapter 3

The Net-SNMP CLI
The Net-SNMP project provides a robust SNMP implementation with an easy to use CLI. The CLI is the best place to start when writing an SNMP application, especially if your writing an application thats specific to a device. Using the CLI we can preform walks and gets to probe the device and hone in on the data we want.

3.1

Probing a device: SNMP WALKs

When you decide that you want to write an SNMP monitoring application for a given device you need to start by understanding whats available to you. If you have a MIB you can read through it to get a feel. If you have MIB documentation you have an even better leg up. Whether you have a MIB or not, the best way to start out is to walk the device asking the device agent for every value it can supply you. Given this output you can then know exactly what is being reported where and how you want to tackle it in code. The snmpwalk tool can walk the OID tree based on a starting OID or by default with no OID which just returns the MIB-II OIDs. Lets walk a device (APC UPS) and look at whats output using the snmpwalk command. $ snmpwalk -v1 -c public 10.10.1.224 SNMPv2-MIB::sysDescr.0 = STRING: APC Web/SNMP Management Card SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.318.1.3.7 SNMPv2-MIB::sysUpTime.0 = Timeticks: (47372422) 5 days, 11:35:24.22 SNMPv2-MIB::sysContact.0 = STRING: Ben Rockwood SNMPv2-MIB::sysName.0 = STRING: APC-3425 SNMPv2-MIB::sysLocation.0 = STRING: 3425EDISON SNMPv2-MIB::sysServices.0 = INTEGER: 72 IF-MIB::ifNumber.0 = INTEGER: 1 IF-MIB::ifIndex.1 = INTEGER: 1 IF-MIB::ifDescr.1 = STRING: veya 11

CHAPTER 3. THE NET-SNMP CLI ........ SNMPv2-MIB::snmpOutGetResponses.0 = Counter32: 338 SNMPv2-MIB::snmpOutTraps.0 = Counter32: 0 SNMPv2-MIB::snmpEnableAuthenTraps.0 = INTEGER: 0 $

12

A large amount of the output was removed for clarity, but you get the idea. We can see the System, Interfaces, and SNMP groups from the MIB-II standard in the example output. While the MIB-II information is interesting, unless your probing a basic router you’ll want a lot more information than is supplied. To get an extended idea of whats available we need to give the tool a starting OID from which to walk. To see everything we can supply the enterprise OID, since all OIDs will start from that root. This can be done both with and without a MIB. Without a MIB you’ll be forced to use a ”best guess” approach to interpreting values. However if you do have a MIB the output is generally self explanatory and can serve as a reference when writing your application. Lets first walk without a MIB (there is a lot of output, I recommend redirecting output to a file): $ snmpwalk -v1 -c public 10.10.1.224 .1.3.6.1.4.1.318 SNMPv2-SMI::enterprises.318.1.1.1.1.1.1.0 = STRING: "Silcon DP340E" SNMPv2-SMI::enterprises.318.1.1.1.1.1.2.0 = STRING: "UPS_IDEN" SNMPv2-SMI::enterprises.318.1.1.1.1.2.1.0 = STRING: "314.10.D" ..... In this example we’re asking the snmpwalk tool to walk all OIDs starting from our base OID .1.3.6.1.4.1.318 (the fully qualified OID up to the vendor identification, which is 318 for APC). For this device I get a total of 308 OIDs returned. However, because all we have to judge the OIDs meaning by is the output this isn’t entirely helpful unless the OID value is a string. If we do have a vendor MIB we can use that to walk the device and get far more useful output: $ snmpwalk -v1 -c public -m "./APC-POWERNET.txt" 10.10.1.224 apc PowerNet-MIB::upsBasicIdentModel.0 = STRING: "Silcon DP340E" PowerNet-MIB::upsBasicIdentName.0 = STRING: "UPS_IDEN" PowerNet-MIB::upsAdvIdentFirmwareRevision.0 = STRING: "314.10.D" ..... In this example we’re performing the same operation as before but we’re supplying a MIB to be used (the -m option) and instead of using the numeric representation of the APC enterprise prefix we can simply use the unique identifier ”apc” instead to accomplish the same thing. In both cases I returned a total of 308 OIDs, but clearly the MIB assisted output is far more understandable. SNMP walking is the SNMP application developers equivalent to a port scan, providing a sound base on which to continue exploring and developing

CHAPTER 3. THE NET-SNMP CLI

13

applications for your device. To avoid confusion it is recommended that all development begin by redirecting a full walk to a local file for reference.

3.2

Polling Individual OIDs: SNMP GETs

The Net-SNMP tool snmpget can retrieve the value of an OID and return it STDOUT in any form that you wish. It can be used for debugging applications or called directly from a scripting language to create ”quick and dirty” SNMP monitoring applications. Lets use the snmpget tool by passing an OID to it: $ snmpget -v1 -c public -m "./APC-POWERNET.txt" 10.10.1.224 \ > PowerNet-MIB::upsAdvInputLineVoltage.0 PowerNet-MIB::upsAdvInputLineVoltage.0 = Gauge32: 118 $ In this example I used the APC MIB (APC-POWERNET.txt) for the UPS Input Line Voltage of my APC with the IP address of 10.10.1.224. I can see from the output that the current voltage is 118VAC. I could have just as easily called for this OID directly using it’s numeric OID and thus not needed the MIB. This is a useful way of writing SNMP applications that don’t need the MIB. We can pass snmpget an output option that would display the fully qualified numeric OID which we could then use in our script, so that if we moved that script to another system we wouldn’t have to worry about the MIB. Obviously, the only problem with doing this is that if the SNMP agent on the target device is ever updated and we’re not using the MIB to retrieve values we might start probing the wrong OID and getting bad data. For this reason you should generally use the MIB if possible.

3.3

Net-SNMP CLI Tool Options

All the Net-SNMP tools use some similar arguments. A full list can be seen by calling the tool with no options. At a bare minimum, each command should be executed by supplying the version of SNMP that you wish to use (-v1, -v2c, or -v3), the community name of the target agent (-c community name) and the IP or hostname of the target agent. All other arguments are optional. Two of the most useful arguments include -m to specify a MIB to be used and -O to modify the output. The -m argument can either be called with the proper name of the MIB (eg: ”-m MY MIB”) when its located in the system MIB directory (typically /usr/local/share/snmp/mibs) or with the filename of the MIB including path (eg: ”-m ./MY MIB.txt”). I’ll point out here something that you might have noticed already: the suffix for MIBs is typically .txt not .mib. I can’t say why this is done but it is the accepted standard. Furthermore, usually the MIB name is in all caps and is

CHAPTER 3. THE NET-SNMP CLI

14

referred without the suffix. Thus when you place MY MIB.txt in the system MIB directory you will call that MIB as simply MY MIB. The -O argument can reorganize the output of a given Net-SNMP command in several different ways depending on how we want it displayed. You can see a list of different formating options in the help information for the individual tool. Lets just look at some examples: $ snmpget -v1 -c public -m "./APC-POWERNET.txt" \ > 10.10.1.224 PowerNet-MIB::upsAdvInputLineVoltage.0 PowerNet-MIB::upsAdvInputLineVoltage.0 = Gauge32: 119 $ snmpget -v1 -c public -m "./APC-POWERNET.txt" -On \ > 10.10.1.224 PowerNet-MIB::upsAdvInputLineVoltage.0 .1.3.6.1.4.1.318.1.1.1.3.2.1.0 = Gauge32: 119 $ snmpget -v1 -c public -m "./APC-POWERNET.txt" -Ov \ > 10.10.1.224 PowerNet-MIB::upsAdvInputLineVoltage.0 Gauge32: 119 $ snmpget -v1 -c public -m "./APC-POWERNET.txt" -Oq \ > 10.10.1.224 PowerNet-MIB::upsAdvInputLineVoltage.0 PowerNet-MIB::upsAdvInputLineVoltage.0 118 $ snmpget -v1 -c public -m "./APC-POWERNET.txt" -Ovq \ > 10.10.1.224 PowerNet-MIB::upsAdvInputLineVoltage.0 118 Notice that the later two forms output is much nicer and easily parsed. It is not unusual for scripted applications to be implemented solely using the last output form, like this: #!/usr/local/bin/perl $SNMP_GET_CMD = "snmpget -v1 -c public -Ovq"; $SNMP_TARGET = "10.10.1.224"; my $voltage = ‘${SNMP_GET_CMD} ${SNMP_TARGET} .1.3.6.1.4.1.318.1.1.1.3.2.1.0‘; chomp($voltage); print("${SNMP_TARGET} as an Input Line Reading of ${voltage}VAC\n"); When I run that script I get the following tidy output: $ ./lineinput.pl 10.10.1.224 as an Input Line Reading of 118VAC This is the easiest way to write and prototype SNMP monitoring applications.

Chapter 4

Polling Applications
Polling applications are the most common type of SNMP monitoring applications written. They typically consist of several SNMP GETs or WALKs that deposit the returned values into string variables to be manipulated and processed however you see fit. In the case of a disk array or NetApp Filer that might mean getting the disk count OIDs and then sending mail if the ”Failed” disk count is higher than 0. If you were monitoring a router you might simply retrieve the packet counts and error counters OIDs and then send those values to a graphing application such as RRD to be processed. Writing polling applications is not difficult at all. With a basic understanding of your preferred programming language and some string parsing knowledge you can write almost any type of application you could require.

4.1

Simple Polling with PERL

In the last chapter we looked at a simple PERL script that would get an OID and then nicely format the output. We can use this method to string several gets together and build more useful monitoring applications. Lets look at a ”full featured” application that uses a simple polling method using the CLI interface to snmpget: #!/usr/local/bin/perl $SNMP_GET_CMD = "snmpget -v1 -c public -Ovq -m PowerNet-MIB"; $SNMP_TARGET = "10.10.1.224";

chomp($model = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsBasicIdentModel.0‘); chomp($serial = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvIdentSerialNumber.0‘) chomp($cap = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvBatteryCapacity.0‘); chomp($temp = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvBatteryTemperature.0‘); chomp($out_load = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvOutputLoad.0‘); chomp($out_v = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvOutputVoltage.0‘); 15

CHAPTER 4. POLLING APPLICATIONS

16

chomp($out_f = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsAdvOutputFrequency.0‘); chomp($out_status = ‘${SNMP_GET_CMD} ${SNMP_TARGET} PowerNet-MIB::upsBasicOutputStatus.0‘ $model =~ s/\"//g; $serial =~ s/\"//g; print $SNMP_COMMUNITY, Version => 1); # Populate a VarList with OID values. $APC_VLIST = new SNMP::VarList([’upsBasicIdentModel’], [’upsAdvIdentSerialNumber’], [’upsAdvBatteryCapacity’], [’upsAdvBatteryTemperature’], [’upsAdvOutputLoad’], [’upsAdvOutputVoltage’], [’upsAdvOutputFrequency’], [’upsBasicOutputStatus’]); # Pass the VarList to getnext building an array of the output @APC_INFO = $SESSION->getnext($APC_VLIST); $APC_INFO[0] =~ s/\"//g; $APC_INFO[1] =~ s/\"//g; # Output the results. print variables; vars; vars = vars->next_variable) print_value(vars->name, vars->name_length, vars); snmp_free_pdu(response); snmp_close(sess_handle); return (0); } This example can be compiled like this and run like this: $ gcc ‘net-snmp-config --cflags‘ ‘net-snmp-config --libs‘ \ > ‘net-snmp-config --external-libs‘ snmp_test.c -o snmp_test $ ./snmp_test apc STRING: "Silcon DP340E" STRING: "SE00XXXXXX " $ You can see in the code that init snmp() gets the ball rolling. snmp sess init() accepts a session structure address, this function will populate the bulk of the session structure with default values. Once the session structure is primed we

CHAPTER 6. THE NET-SNMP C API

29

can modify it to meet our needs, such as defining the SNMP version, community name (not forgetting the length of the community name), and the hostname of agent referred to as the peername. When the session structure is ready for use, we can open the session with snmp open() which will return a new session structure as a handle. While you normally should refrain from using non-installed MIBs, in this example I’ve demonstrated how to add a directory to the internal MIB path and then read a MIB into the MIB tree using the add mibdir() and read mib() functions. Now that the session is open and the MIBs we’ll use are loaded into the tree we can create and populate the PDU(s) we’ll be sending. snmp pdu create() will setup the base PDU information based on the supplied type of PDU (specified in macro form) and return the populated PDU structure. Now that we have the PDU we can use the read objid() and snmp add null var() functions to first read the OID from the MIB and then add that OID as a variable to the variable list used by the PDU. We can repeat this process several times to continue packing our PDU full of OIDs. Typically you’ll see this type of operation wrapped in a loop, but I’ve illustrated it long hand for simplicity sake. Once our session is open and our PDU is ready with all the OIDs we want crammed into the variable list we can actually send the request and await the response. This action is done in a single step using the snmp synch response() function. The function is passed the open session handle, the PDU to send, and an empty PDU structure to accept the response which includes the populated values for each OID in the variable list. At this point you can extract and manipulate the returned data either by utilizing built in functions such as print value() or by simply directly accessing the structures. Other convince functions for value output can be found in the net-snmp/library/mib.h header. Finally, to properly clean up, the PDU(s) should be freed and the sessions closed using the snmp free pdu() and snmp close() functions.

6.4

Closing Thoughts

This is just a small taste of what the C API is capable of, but it should be enough to get you moving in the right direction with a firm base to grow on. Components like SQLite, PostgreSQL, RRDtool, GNU Plot, EWL and other X toolkits, and many more can be combined easily to facilitate any type of management application you could desire to build. Net-SNMP provides both the power to get just what you want the way you want but also the flexibility to build your own tools that are just as good if not better than your vendors supplied application at little to no cost.